Should /Volumes be accessible by browser and what should be in them.

Question

Level 1

8 points

Should /Volumes be accessible by browser and what should be in them.

Hello,

I have a few questions regarding whether browsers should be able to access the /Volume directory that has access to /Preboot and /Macintosh HD when uploading files.

I was uploading a resume through a browser and noticed that that finder was set at /Volume where I can see /Preboot and /Macintosh HD. I looked into Preboot and found a directory with digits and hypens and found 3 directories in there.

System/ usr/ var/

In each of those directories, they had encryped files such as EncryptedRoot.plist.wipekey, plist files, and efires such as disk_passwordUI.efires and guest_userUI.efires which are important files and should not be accessible by the browser file upload.

1. Was my mac laptop security compromised or is this the expected setup of encrypted password and identity?

2. Should the plist files, efries, and other encrypted files be in /Volume/Preboot/<encrypt code>/?

null-OTHER, macOS High Sierra (10.13.2), MacBook Pro

Posted on Jan 22, 2018 3:08 PM

Reply

Answer 1

Kappy

Level 10

362,465 points

Jan 22, 2018 3:33 PM in response to wesley299

No, browsers should have no direct access to the /Volume directory. Neither should you unless you know what you are doing, which you apparently don't. I don't even know if you mean Safari or the Finder. Nor do I know exactly what you did to end up in /Volumes.

Your computer isn't infected nor compromised except by your potential for doing damage. I caution you not to mess with any OS system or invisible files. Do not move, remove, replace, or rename any system files. If you aren't going to listen to my caution then please know how to recover from whatever you do. Never change nor delete something unless you know exactly the consequences and how to fix what you do.

Reply

Answer 2

Kappy

Level 10

362,465 points

Jan 22, 2018 3:56 PM in response to wesley299

Yes, those items belong to a volume formatted APFS. You can navigate system files through Terminal if you know how.

Reply

Answer 3

wesley299 Author

Level 1

8 points

Jan 22, 2018 3:39 PM in response to Kappy

Thanks for responding. To clarify the situation. I was uploading a resume through Firefox and found that the browser directory was set in the Volume directory. I am not sure how that happened, so I cleared the recent places just in case with the command below.

defaults delete -g NSNavRecentPlaces

Can you clarify on the Preboot directory with the plist file, efires, and admin files. Should that be in the /Volume directory?

Edit: I'm able to navigate to the Volume directory through the terminal and cat the files.

Reply

Answer 4

wesley299 Author

Level 1

8 points

Jan 22, 2018 5:16 PM in response to Kappy

I restarted my laptop and checked if the Volume and Macintosh HD is accessible through Firefox browser or Finder. I found that they were grayed out which is good.

Though that brings up the question as to how I got the the Firefox browser to access the Preboot directory without being grayed out.

Reply

Answer 5

wesley299 Author

Level 1

8 points

Jan 23, 2018 9:34 PM in response to Kappy

Alright got something. Some reason the chrome and firefox browser is able to access the Preboot directory. What is triggering for the files to be accessible?

Reply