Mac OS X Internals: A Systems Approach

2.5. A User-Space View of the File System

The Mac OS X user space is where end users and most developers spend their computing time. The file systemor rather, its content and layoutis fundamental to how users interact with the system. The Mac OS X file system's layout is largely a superimposition of Unix-derived and NEXTSTEP-derived file systems, with many traditional Macintosh influences.

2.5.1. File System Domains

The Unix-style file system view in Mac OS X can be used to access all files and directories on a volume, including the Mac OS Xspecific portions of the file system. Some Unix-specific aspects of this view include standard directories such as /bin/, /dev/, /etc/, /sbin/, /tmp/, /usr/, /usr/X11R6/,^[18] /usr/include/, /usr/lib/, /usr/libexec/, /usr/sbin, /usr/share/, and /var/.

^[18] Some components, such as the X Window System, are optional. If they are not installed, certain directories may not be present.

Mac OS X conceptually divides the file system into four domains: User, Local, Network, and System.

2.5.1.1. The User Domain

The User domain contains user-specific resources. In Unix terminology, this is a user's home directory. For a user named amit, the default local home directory location is /Users/amit/, and the default network home directory location is /Network/Users/amit/. A user's home directory contains several standard directories, such as .trash, Applications, Desktop, Documents, Library, Movies, Music, Pictures, Public, and Sites. Certain per-user directories such as Public and Sites are meant to be publicly accessible and therefore have read permissions for other users.

2.5.1.2. The Local Domain

The Local domain contains resources available to all users on a single system. It includes shared applications and documents. It is usually located on the boot volume, which, typically, is also the root volume. The /Applications/ directory lies in the Local domain. Unlike the User domain, which can be arbitrarily manipulated by its owning user, only a user with system administrator privileges may modify the Local domain.

2.5.1.3. The Network Domain

The Network domain contains resources available to all users on a local area networkfor example, applications and documents that are shared over a network. The Network domain is usually located on a file server and is locally mounted on a client machine under /Network/. Only a user with network administrator privileges may modify this domain. Specific directories within this domain include Applications, Library, Servers, and Users.

2.5.1.4. The System Domain

The System domain contains resources belonging to Mac OS X. Its contents include the operating system, libraries, programs, scripts, and configuration files. Like the Local domain, the System domain resides on a boot/root volume. Its standard location is the /System/ directory.

The system searches for resources such as fonts and plug-ins in various domains in the order of the most specific domain first and the most general domain last, that is, User, Local, Network, and System.

2.5.2. The /System/Library/ Directory

Each file system domain contains several standard directories, some of which may exist in multiple (or all) domains. Perhaps the most interesting directory in any domainand one that exists in all domainsis Library. It contains a hierarchy of several standard subdirectories. In particular, a substantial part of the operating system resides in /System/Library/. Let us look at examples of its contents.

• /System/Library/ contains system-level caches for various types of data. Most notably, it contains the kernel and kernel extension (kext) caches. A kernel cache contains kernel code, prelinked kernel extensions, and information dictionaries of any number of kernel extensions. Kernel caches reside in /System/Library/Caches/com.apple.kernelcaches/.

• /System/Library/Extensions/ contains device drivers and other kernel extensions. The multiextension (or mkext) cache/System/Library/Extensions.mkextcontains multiple kernel extensions and their information dictionaries. An mkext cache is used during early system startup. A kext repository cache containing the information dictionaries of all kernel extensions^[19] in /System/Library/Extensions/ exists as the file /System/Library/Extensions.kextcache.

  ^[19] The kext repository cache also includes the information dictionaries of any plug-ins that may reside within kernel extensions.

• /System/Library/Frameworks/ contains those Apple-provided frameworks and shared libraries that have published APIs.

• /System/Library/PrivateFrameworks/ contains those Apple-provided frameworks and shared libraries that are private to Apple and not available to third-party programmers.

• /System/Library/Filesystems/ contains loadable file systems.

• /System/Library/LaunchAgents/ and /System/Library/LaunchDaemons/ contain launchd configuration files for system-level agents and daemons. The launchd program (/sbin/launchd) is the master daemon that manages other daemons and agents beginning with Mac OS X 10.4.

The /System/Library/CoreServices/ directory contains several system components used in the system's normal operation, such as the Dock and Finder applications. Other examples include those listed here.

• AppleFileServer.app is the Apple Filing Protocol (AFP) server.

• The BezelUI directory contains the program and images to display user-interface overlays in a variety of situations: when the user adjusts screen brightness or volume using keyboard buttons, when the user presses the eject button, when the batteries of an Apple Bluetooth mouse or keyboard are low, and so on.

• BootX (PowerPC) and boot.efi (x86) are the Mac OS X bootloaders.

• CCacheServer.app is the Kerberos Credentials Cache Server.

• Classic Startup.app is the Classic virtual environment provider.

• Crash Reporter.app is used for sending a problem report to Apple when an application crashes or when the system restarts after a kernel panic. It prompts the user before sending the report, which consists of system information and the crashed program's debugging information. Figure 22 shows the sequence of GNU debugger (GDB) commands used to generate the debugging information. These commands are part of the gdb-generate-crash-report-script GDB script, which resides as a resource within Crash Reporter.app.

• Network Diagnostics.app is used for solving Internet connection problems.

• OBEXAgent.app is the Bluetooth file exchange agent.

• loginwindow.app is roughly analogous to the login program on a UNIX system.

• pbs is the pasteboard server and a helper daemon for Cocoa applications.

Figure 22. Sequence of GDB commands for generating a crash report