Just An Ordinary Innocent Little Old Text File

This can't be intentional. This has to be an accident.

Get It Try It

Boy. If Adam Leventhal and the engineers at Sun are pissed at what Apple have done to DTrace what are the Unix people going to say when they find out what Apple have done to the file system?

Because things are getting way out of control. First we had the massive data loss bug so ordinary people and especially sysadmins are paranoid about file system maintenance - and now we have this?

The document controller in OS X 10.5 Leopard doesn't worry about opening files for writing anymore. It just zaps them the F outta there - and then tries to move a temporary file back to fill the vacancy.

Lovely.

Not that many Macheads would notice this of course. Because they still don't know they're running Unix and not a Beige Box OS™. But people trying to take this system seriously will notice. They already have. And if they're worried about massive data loss with the world's oldest Unix code written and debugged ages ago for the world's simplest file operations they just got some great icing to put on their Beige Cake™.

The following is a Tracker session on OS X Leopard. The test is simple: create a text file, save it, and track it. See where the 'OS' goes to do something as simple as that.

There's really nothing to be seen except in the user temporary directory. Located under Leopard at the 'rolls off yer tongue' path '/private/var/folders/3t/3tLObI4nFuC+9x16zdhIg++++TI/TemporaryItems'.

[Be sure to look in there from time to time. A lot of cruft accumulates that the system doesn't bother cleaning up for you.]

But the user temporary directory has been modified. That's why it's in a bold font. That's what the bold font means. And as the directory is empty that can mean only one thing: there have been files there during the tracking session but they're there no more.

Meanwhile the 'inode' on the file 'Just An Ordinary Innocent Little Old Text File.rtx' has changed. Meaning that file is not the same file anymore. It's a new file moved in from the temporary directory. The old file is gone. The trick question is: was the temporary file saved before the original was destroyed?

Here's what the Tracker info sheets say about the user temporary directory. Twelve seconds after the session started something happened in this directory. Nowhere else on the entire system - just in this directory.

If only directories could talk.


More could be done with a DTrace script but that's for another day.

Apple's document controller has always used temporary locations as a safeguard but prior to OS X 10.5 Apple respected file system permissions and opened (and didn't open) files for writing like anyone else.

Now it's all been thrown to the wind. Official OS vendor code officially circumvents system guidelines and the calm wisdom of nearly forty years use by the likes of Bell Labs, Unix System Laboratories, International Business Machines, Hewlett-Packard, Sun Microsystems, Novell, SuSE, and the thousands of 'distros' dependent on the Linux kernel.

Apple have accomplished more in their ten years with Unix than any other institution or corporation in the nearly forty years Unix has been around. To make a mess of things that is.

But it's all a blooper, right? An innocent oversight? Don't count on it. The iPhone runs as root, giving it absolutely no security advantage over Microsoft Windows, and this despite Apple being handed the most secure personal operating system in use today.

Apple are right; they know what they're doing; they really do. It's the rest of IT who never had a clue.

At least they're good for a laugh.

See Also
Developers Workshop: Y.G.B.K.
Industry Watch: Without a DTrace
The Technological: Contact the Vendor for an Updated Version II