Hello, whilst editing sudoers at 07:24 this morning via visudo I noticed that there are two files which get changed simultaneously as shown below. Then in fact what I noticed is that /private/etc contains exactly what /etc contains.
Why is this? What is the difference between these two directories? Why do they contain a mirror of eachother?
mbp:~ m$ ls -l /etc/sudoers
-r--r----- 1 root wheel 1325 Jun 15 07:24 /etc/sudoers
mbp:~ m$ ls -l /private/etc/sudoers
-r--r----- 1 root wheel 1325 Jun 15 07:24 /private/etc/sudoers
mbp:~ m$ sudo visudo
Thanks, Michelle
It's OSX's UNIX core. Apparently /etc/, /var/ and so forth are all supposed to be symlinks to things inside /private/. That's why they change simultaneously; it's actually the same dir. Apple's UNIX implementation is a bit eccentric.
As for why they chose to do it this way, if I had to guess, it's so they could lump all the UNIX stuff together in one folder and keep it strictly apart from everything else.
1 Like
ls -l /
You'll see, among other things (or should see):
lrwxr-xr-x@ 1 root wheel 11B Mar 7 18:05 etc -> private/etc
lrwxr-xr-x@ 1 root wheel 11B Mar 7 18:27 var -> private/var
As pointed out, they are links to the actual directories in the /private directory.
The lowercase L at the start of the line indicates a link, as does the string after the link name (linkname -> target).
I've seen this, or a similar setup in another Unix platform waaaay back when. It's not "entirely" unusual or necessarily Apple-centric.
On my machine there are other directories under /private, but from a system use perspective, etc and var are probably the most frequently accessed directories there, so a link cuts down on some typing.
An annoying side note to links is, typing ls -l /var displays the information about the link file, not the directory contents, while ls -l /var/ displays the directory contents. 
Not a show stopper, but requires an additional 2 characters (up arrow then /, or up arrow then backspace) be typed if the result is not the intended one.
1 Like