Macintosh HD/private , why i am seeing this?

[djrod]

Hi everyone.

Today I realize I have a system folder called private that I don't think I should be viewing, looking at TimeMachine backups, this folder did not show a week ago.

I'm running Snow Leopard 10.6.1, how can I hide it again?

 

[Darth.Titan]

Yeah that's supposed to be hidden. You can try

defaults write com.apple.finder AppleShowAllFiles FALSE

and then

killall Finder

in Terminal

Anybody know off the top of their head to turn on the hidden attribute for a directory? I don't know if a permissions repair would do any good or not...

 

[bankshot]

Sounds like the extended attribute that tells the Finder to ignore /private has been altered or deleted. You can verify this with the following commands in Terminal:

ls -led@ /private
xattr -p com.apple.FinderInfo /private

The first command should show something like this (with a different date):

drwxr-xr-x@ 6 root  wheel  204 Sep  3 09:03 /private/
        com.apple.FinderInfo     32

The second should show this:

00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

If either command doesn't show those results, there's your problem. You can restore the proper extended attribute with this command:

sudo xattr -w -x com.apple.FinderInfo '00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00' /private

(all one line)

Hope this helps.

 

[djrod]

Yeah that's supposed to be hidden. You can try

defaults write com.apple.finder AppleShowAllFiles FALSE

and then

killall Finder

in Terminal

Anybody know off the top of their head to turn on the hidden attribute for a directory? I don't know if a permissions repair would do any good or not...

Thanks, but did not work, is still in there

 

[djrod]

Sounds like the extended attribute that tells the Finder to ignore /private has been altered or deleted. You can verify this with the following commands in Terminal:

ls -led@ /private
xattr -p com.apple.FinderInfo /private

The first command should show something like this (with a different date):

drwxr-xr-x@ 6 root  wheel  204 Sep  3 09:03 /private/
        com.apple.FinderInfo     32

The second should show this:

00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

If either command doesn't show those results, there's your problem. You can restore the proper extended attribute with this command:

sudo xattr -w -x com.apple.FinderInfo '00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00' /private

(all one line)

Hope this helps.

Wow, that worked! Thank U very much

 

[ni240sx]

Sounds like the extended attribute that tells the Finder to ignore /private has been altered or deleted. You can verify this with the following commands in Terminal:

ls -led@ /private
xattr -p com.apple.FinderInfo /private

The first command should show something like this (with a different date):

drwxr-xr-x@ 6 root  wheel  204 Sep  3 09:03 /private/
        com.apple.FinderInfo     32

The second should show this:

00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

If either command doesn't show those results, there's your problem. You can restore the proper extended attribute with this command:

sudo xattr -w -x com.apple.FinderInfo '00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00' /private

(all one line)

Hope this helps.

the first command came out as described, but not the second command. so i used the restore command. and got this error message

sudo: /etc/sudoers is mode 0666, should be 0440
Segmentation fault

is there a different method to approach this? thanks.
_____________

UPDATE: after doing some more googling. and i found the solution. just needed the disk utility to repair disk permissions. and i've been able to hide this "private" folder.

 

[Hal Itosis]

For Leopard and higher (presumably),

sudo chflags hidden /private


--<edit>--

You can restore the proper extended attribute with this command:

sudo xattr -w -x com.apple.FinderInfo '00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00' /private

(all one line)

Wow, that worked! Thank U very much

I'm amazed that would work at all, since there is no -x option for xattr.
Attempting to use it should have failed with...

[b]
option -x not recognized
[/b][size="1"]
usage: xattr [-l] file [file ...]
       xattr -p [-l] attr_name file [file ...]
       xattr -w attr_name attr_value file [file ...]
       xattr -d attr_name file [file ...]

The first form lists the names of all xattrs on the given file(s).
The second form (-p) prints the value of the xattr attr_name.
The third form (-w) sets the value of the xattr attr_name to attr_value.
The fourth form (-d) deletes the xattr attr_name.

options:
  -h: print this help
  -l: print long format (attr_name: attr_value)
[/size]

--<edit>--

FWIW, if folks want to experiment with chflags, a hidden item can be made visible again via:

chflags nohidden /path/to/item