Hidden file with extended attributes appeared out of thin air

Question

Level 1

8 points

Hidden file with extended attributes appeared out of thin air

in terminal in the / directory there is a folder called "private" I believe my file permission for this folder are messed up because I am not supposed to see this folder when using finder. I went to my time machine back up and did a permissions check on "/private/"

Time Machine (when using finder the folder is hidden)
drwxr-xr-x@ 6 root wheel 204 Nov 28 05:47 private/
com.apple.FinderInfo 32
com.apple.metadata:_kTimeMachineNewestSnapshot 50
com.apple.metadata:_kTimeMachineOldestSnapshot 50

New install (shows up in finder)
drwxr-xr-x 6 root wheel 204 Dec 6 22:19 private/

From what I can tell the @ symbol is a extended attribute and somehow makes this file hidden to finder. I just don't know how to reset this to how it used to be.

I tried using xattr but can't get the man page for it to see how to use it.

Any help would be great.

MacBook Pro, Mac OS X (10.6.5), Momentus XT

Posted on Dec 7, 2010 7:25 AM

Reply

Answer 1

etresoft

Level 9

50,854 points

Dec 7, 2010 7:46 AM in response to grantsales

Run Disk Utility and Repair Permissions.

Reply

Answer 2

jsd2

Level 5

6,245 points

Dec 7, 2010 7:56 AM in response to grantsales

It's probably not the extended attribute, but rather that /private has lost its "hidden" flag.

To see if a flag is present, you need to add the -O (capital letter O) option to the ls command. You can add -@ if you also want to see extended attributes, though as mentioned, I don't think that is the issue here. In my own system:
-------------------------
$ ls -ldO@ /private
drwxr-xr-x@ 6 root wheel hidden 204 Nov 4 2009 /private
com.apple.FinderInfo 32
---------------

To add back the hidden flag if it is not present, you would enter the following, and type Return

sudo chflags hidden /private

Enter your admin password when prompted (it will not echo on the screen) and type Return.

Message was edited by: jsd2

Reply

Answer 3

grantsales Author

Level 1

8 points

Dec 7, 2010 9:46 AM in response to jsd2

Running "repair disk permissions" did nothing. It found some things that it fixed but after a reboot the folder was still in finder.

How does the chflags hidden differ from adding the "." in front of the folder name? Cause I know that adding that will also hide things from finder as well

Reply

Answer 4

grantsales Author

Level 1

8 points

Dec 7, 2010 9:49 AM in response to grantsales

$ ls -ldO@ /private
drwxr-xr-x 6 root wheel - 204 Dec 7 10:24 /private/

Notice how my folder doesn't have extended attributes. It does in Time Machine. As a last resort I'll just restore it from my time machine but I was hoping to actually figure out how to do this rather then doing a restore.

Reply

Answer 5

jsd2

Level 5

6,245 points

Dec 7, 2010 10:49 AM in response to grantsales

$ ls -ldO@ /private
drwxr-xr-x 6 root wheel - 204 Dec 7 10:24 /private/

Notice how my folder doesn't have extended attributes.

There is another difference - compare your listing:
ls -ldO@ /private
drwxr-xr-x 6 root wheel - 204 Dec 7 10:24 /private/

with the first line of mine:
$ ls -ldO@ /private
drwxr-xr-x@ 6 root wheel hidden 204 Nov 4 2009 /private
com.apple.FinderInfo 32

Note the word "hidden" after "wheel" in my listing. That is a file flag, which can be added or removed to an item with the Terminal command chflags. *Man chflags* includes the following in its list of flag keywords:
-------------
hidden set the hidden flag \[Hide item from GUI]
-------------------------

An item will be hidden from Finder if its name begins with a period, OR if it carries a "hidden" flag.

I did some experimenting - I removed the hidden flag from my own /private folder with:

sudo chflags nohidden /private

Two things happened:

1) The /private folder became visible in Finder

2) Both the "hidden" flag and the "com.apple.FinderInfo" extended attribute disappeared from my listing, such that it was now the same as yours:

$ ls -ldO@ /private
drwxr-xr-x 6 root wheel - 204 Nov 4 2009 /private

I then added back the hidden flag with

sudo chflags hidden /private

Two things happened:

1) The /private folder became invisible again.

2) Both the hidden flag and the extended attribute re-appeared.

$ ls -ldO@ /private
drwxr-xr-x@ 6 root wheel hidden 204 Nov 4 2009 /private
com.apple.FinderInfo 32

Bottom line: I would still try the command I gave you earlier:

sudo chflags hidden /private

Reply

Answer 6

grantsales Author

Level 1

8 points

Dec 7, 2010 10:55 AM in response to jsd2

Worked. Thanks for your help

Reply