How to identify if a direcory is created by System or a root user?

Question

How to identify if a directory is created by Linux system and by user like root. Example: in /etc there is a directory named sys which is created by Linux. And I logged in using root and created the directory sys1. then how can I differentiate them?

Example : var is a system created directory where as test is a user created with user root.

drwxrwxrwx 34 root root 4096 Aug 25 22:52 var
drwxr-xr-x 2 root root 4096 Aug 25 23:19 test

Answer 1

I don't think that there is a concept of "directory created by system". When you're installing your system, installation media often gets job done for you - you see the result(e.g. /etc directory created), but that really is done by user who happened to run script.

Anything created by "system" could be treated as created by root, but there's no way of telling if that was automated or not.

Answer 2

Depending on what you mean by "created by system", you may be able to use the packaging system to determine how a particular directory was created.

For example, on an RPM-based system (e.g. RedHat, Fedora, CentOS etc):

rpm -qf /var

will give something like

filesystem-2.4.100.x86_64

indicating it was installed as part of the filesystem package, whereas

rpm -qf /test

might give

file /test is not owned by any package

indicating that it's not part of the base install (though it may still have been created by a program, rather than a person).

Similarly for Apt-based systems (Debian, Ubuntu etc) you can use

dpkg -S /var

to perform the same check.

Answer 3

There is no difference between files (including directories) created by the system or by a user because in the end it is the same system call. Later on it is impossible to tell who was the owner of the process which created the file or directory. By the way, "the Linux system" is mostly the user root: there is no special user. Furthermore, installing always sets the owner of directories and files, so this would not be visible afterwards.

If you have a package manager you may find whether the directory was created by a package installation, e.g. with the Debian Package Manager:

dpkg -S /var

lists several packages which all would create the directory if not present. However,

dpkg -S /opt

does not list anything, although I can tell you that it was created by the system installer, either during the installation process or when running the post-install script of a certain package.