Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This just baffles me. Why does the root directory contain a reference to a parent directory?

bob@bob:/$ ls -a
.     build  home            lib32       mnt   .rpmdb   sys  vmlinuz
..    cdrom  initrd.img      lib64       opt   sbin     tmp  vmlinuz.old
bin   dev    initrd.img.old  lost+found  proc  selinux  usr
boot  etc    lib             media       root  srv      var

I understand how directories are managed in the filesystem - each directory has n+2 pointers to itself. One for each immediate subdirectory, one for its parent, and one for itself.

But what is /'s parent?

share|improve this question

3 Answers 3

up vote 44 down vote accepted

/.. points to /:

$ ls -id /
2 /
$ ls -id /..
2 /..

Both have the same inode number, which happens to be 2 on this system. (The exact value doesn't matter.)

It's done for consistency. This way, there doesn't have to be code in the kernel to check where it currently is when it processes a .. in a path. You can say cd .. forever, and never go deeper than the root.

share|improve this answer
11  
@George I believe exploits that take advantage of relative paths use that; you don't have to guess the current folder, you just do ../../../../../../../../../../../../../../../../etc/passwd –  Michael Mrozek Jan 12 '11 at 3:36
12  
What difference would that make with simply using /etc/passwd ? –  jlliagre Jan 12 '11 at 7:46
5  
@jlliagre: There are programs that check whether a file is under the current directory by testing whether it begins with /. Between ../ (not necessarily at the beginning!) and symbolic links, it's very hard to do, especially considering the attacker may be moving directories under the program's nose. –  Gilles Jan 12 '11 at 8:08
3  
I see, they should at least use canonicalize_file_name or realpath. –  jlliagre Jan 12 '11 at 14:37
2  
@musiphil: It's a good thing. Michael was just pointing out that it's a feature that can be exploited for bad ends, if code isn't written to cope with the exploit. If we got rid of all features that can be exploited, computers would be very dull things. –  Warren Young Dec 3 '12 at 3:50

I agreed with @Warren Young but that /.. get used in rescue mode, when system boot in rescue then Media become actual root i.e / and The rescue environment will now attempt to find your Linux installation and mount it under the directory /mnt/sysimage. to get back from /mnt/sysimage/ which is actual root partition of your OS, that .. been used.

Please correct me if I'm wrong..

share|improve this answer

It's there because it's a guarantee made by Unix: every directory contains two entries, . which refers to itself, and .. which refers to the parent.

The root directory of the current namespace is special, in that .. points to the same thing as ., but not so special to break the guarantee made by the OS to programs. When those contracts are broken, things go wrong and everyone points fingers.

The root directory that you see might, in the filesystem on disk, actually have a different parent directory. The view of the filesystems provided in the mounted namespace is what enforces the .. = . rule for /. So if you're in a chroot() jail, you will see /.. = / even though someone outside the jail looking at /path/to/jail/.. will see /path/to instead.

share|improve this answer
    
How many programs depend on the "contract" that / has .. that points to itself? I think it could have been equally (or more) acceptable for / NOT to have ... –  musiphil Dec 3 '12 at 3:13
    
Does anyone have a source which confirms this theory? –  Julian Hollmann Aug 29 at 8:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.