On OS X, why does `sudo ls` show hidden (dot) files?

Question

With OS X Yosemite, using the following commands, I get the following:

$ touch .a
$ touch b
$ /bin/ls
b
$ /bin/ls -A
.a  b
$ sudo /bin/ls
.a  b

It shows hidden files (that have names starting with a dot) when invoked by root and doesn’t show them (as expected) when running as a normal user. This differs from what ls on Linux (the one coming from coreutils) does.

Why does ls behave this way?

Answer 1

It turns out this feature is not Apple-specific. This is a feature of BSD systems in general.

/* Root is -A automatically. */
if (!getuid())
    f_listdot = 1;

Initially, I was able to trace it back to the sources of 4.4BSD-Lite. It was already present in this FreeBSD commit from 1994 which is importing those sources.

The feature is also present in OpenBSD and can be found in this commit from 1995 that claims to be importing code from NetBSD, so this was already present in NetBSD.

Then one discovers the commit of NetBSD from 1993 that claims to be importing code from 386BSD, and the feature is already there. Furthermore, this commit shows that it was there during the development of 386BSD version 0.0 in 1991 which forked from BSD around 4.3, as far as I can tell.

The comment appeared for the first time during the development of 4.3BSD-Reno in this commit (27 Jun 1989) entitled “first working version of new ls”. The original comment said:

/* root sees all files automatically */

which was changed later that day (I’m not sure the timestamps are entirely correct in this repository, though) to:

/* root is -A automatically */

And only in 1992 the capital letter and the period were added turning the comment into what we have now:

/* Root is -A automatically. */

But the behaviour was present in 2BSD as of 9 May 1979 as seen in this snapshot:

Aflg = getuid() == 0;

I can’t find any actual history from those times, but there is also this snapshot of 1BSD from 1977 without those lines. And without the -A flag actually.

So it seems that the feature was introduced somewhere between November of 1977 (1BSD being developed at that moment) and the release of 2BSD in May 1979.

---

What I also found during this investigation, is the -I flag that was added to FreeBSD in 2005 to override this behaviour and was reworked a little bit later.

Answer 2

Here's a link to the source code. Note /* Root is -A automatically. */. This is a feature in Apple's version of BSD ls.

Answer 3

IIRC, there was a thread about this back in the early days of Usenet (early 80's). The feature was added as a security precaution so that malicious users couldn't easily hide files/directories/executables from the sysadmin/root. The theory was basically "root has access to everything so it should be able to see everything".