Sample Header Ad - 728x90

How can directories in a macOS APFS root directory be in other filesystems without being links or mountpoints?

6 votes
1 answer
582 views
I found a very unusual behaviour about the root file system / on modern macOS which are now all using the Apple propriatary file system APFS. With a basic set of filesystems defined through the Big Sur installation as follows:
### 18:04       noether:/       # mount | grep disk1
/dev/disk1s5s1 on / (apfs, sealed, local, read-only, journaled)
/dev/disk1s4 on /System/Volumes/VM (apfs, local, noexec, journaled, noatime, nobrowse)
/dev/disk1s2 on /System/Volumes/Preboot (apfs, local, journaled, nobrowse)
/dev/disk1s6 on /System/Volumes/Update (apfs, local, journaled, nobrowse)
/dev/disk1s1 on /System/Volumes/Data (apfs, local, journaled, nobrowse)
/dev/disk1s5 on /Volumes/noether 1 250 Go 1 (apfs, sealed, local, journaled, nobrowse)
### 18:04       noether:/       #
I discovered that at the base of this file system, i.e. in / directly there are files which belongs to the / FS when some other belongs to the /System/Volumes/Data FS:
### 18:14       noether:/       # ffs
--------------------------------------------
file                    volume                          
--------------------------------------------
.file                   /                               
.vol                    /                               
Applications            /System/Volumes/Data            
Library                 /System/Volumes/Data            
System                  /                               
Users                   /System/Volumes/Data            
Volumes                 /System/Volumes/Data            
bin                     /                               
cores                   /System/Volumes/Data            
dev                     /dev                            
etc                     /System/Volumes/Data            
home                                                    
opt                     /System/Volumes/Data            
private                 /System/Volumes/Data            
sbin                    /                               
tmp                     /System/Volumes/Data            
usr                     /                               
var                     /System/Volumes/Data            
### 18:14       noether:/       #
( where ffs is a small shell script¹ printing the FS a file belongs to in the working directory ). How is this possible when there is only one FS which can be mounted on / and some of these files are symbolic links toward /System/Volumes/Data ( like home ) but some others are plain directories ( like opt and private ):
### 18:20       noether:/       # ls -alt
total 18
drwxr-xr-x  19 root  wheel   608 Aug  3 18:50 Volumes
drwxrwxr-x  32 root  admin  1024 Aug  3 12:33 Applications
drwxr-xr-x  15 root  admin   480 Jul 19 15:54 Users
lrwxr-xr-x   1 root  wheel    25 Jul 13 23:22 home -> /System/Volumes/Data/home
dr-xr-xr-x   3 root  wheel  8886 Jul 13 23:22 dev
drwxr-xr-x  15 root  wheel   480 Mar 26 21:47 opt
drwxr-xr-x  71 root  wheel  2272 Jan 20  2024 Library
drwxr-xr-x  20 root  wheel   640 Jan  1  2020 .
drwxr-xr-x  20 root  wheel   640 Jan  1  2020 ..
lrwxr-xr-x   1 root  admin    36 Jan  1  2020 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
----------   1 root  admin     0 Jan  1  2020 .file
drwxr-xr-x   2 root  wheel    64 Jan  1  2020 .vol
drwxr-xr-x@  9 root  wheel   288 Jan  1  2020 System
drwxr-xr-x@ 38 root  wheel  1216 Jan  1  2020 bin
drwxr-xr-x   2 root  wheel    64 Jan  1  2020 cores
lrwxr-xr-x@  1 root  wheel    11 Jan  1  2020 etc -> private/etc
drwxr-xr-x   6 root  wheel   192 Jan  1  2020 private
drwxr-xr-x@ 65 root  wheel  2080 Jan  1  2020 sbin
lrwxr-xr-x@  1 root  wheel    11 Jan  1  2020 tmp -> private/tmp
drwxr-xr-x@ 11 root  wheel   352 Jan  1  2020 usr
lrwxr-xr-x@  1 root  wheel    11 Jan  1  2020 var -> private/var
### 18:20       noether:/
I know that this cannot work on any Unix. This can only be related to APFS special features. I am digging inside the Apple documentation about this anomaly. ____ ¹) ffs source:
#!/bin/sh
printf "--------------------------------------------\n%-20s\t%-32s\n--------------------------------------------\n" "file" "volume" 
for _file in .* * ; do
if [ -e ${_file} ] ; then
        _volume=df ${_file} | awk '/dev/ { print $NF}'
        printf "%-20s\t%-32s\n" "${_file}" "${_volume}"
fi
done
Asked by athena (1085 rep)
Aug 4, 2024, 05:25 PM
Last activity: Aug 5, 2024, 05:51 AM