What is the purpose of directory /var/dirs_cleaner?

Question

I'm using a 2020 MacBook Pro on Monterey 12.3.1, and noticed a new directory, var/dirs_cleaner which is empty, has permissions of read and write by the system.

I've tried to find out on Google, but no information on this is available.

Is this a part of the system, or malware?

Is there anything I should know about this folder, as I've not seen it before.

Answer 1

/var/dirs_cleaner seems to be used by the /usr/libexec/dirs_cleaner tool. Here is what "man dirs_cleaner" shows:

DIRS_CLEANER(8)              System Manager's Manual             DIRS_CLEANER(8)

NAME
     dirs_cleaner – remove contents of directories

SYNOPSIS
     dirs_cleaner path ...

DESCRIPTION
     The dirs_cleaner utility recursively deletes the entire contents of each
     directory argument, while the directories themselves are not deleted. A
     cleaned directory may be re-created in the process of cleaning; if so, it
     gets a new inode number. Recursive traversals do not cross mount points.
     Each directory is identified directly or via a symbolic link.

     The dirs_cleaner utility exits with one of the following values:

     0       Each input directory was successfully cleaned.

     >0      An error occurred.

Apparently this tool works by moving all files and directories into a subfolder of /var/dirs_cleaner, as this example demonstrates:

% mkdir /tmp/foo
% mkdir /tmp/foo/bar
% echo "Hello World" > /tmp/foo/bar/file.txt
% find /tmp/foo -ls
50112491        0 drwxr-xr-x    3 martin           wheel                  96 26 Apr 15:44 /tmp/foo
50112492        0 drwxr-xr-x    3 martin           wheel                  96 26 Apr 15:45 /tmp/foo/bar
50112495        8 -rw-r--r--    1 martin           wheel                  12 26 Apr 15:45 /tmp/foo/bar/file.txt
% 
% sudo /usr/libexec/dirs_cleaner /tmp/foo 

Now /tmp/foo is empty, but /var/dirs_cleaner has a new subdirectory, containing what was previously in /tmp/foo:

% find /tmp/foo -ls                      
50112507        0 drwxr-xr-x    2 martin           wheel                  64 26 Apr 15:45 /tmp/foo
%
% sudo find /var/dirs_cleaner -ls
45884836        0 drwx------    3 root             wheel                  96 26 Apr 15:45 /var/dirs_cleaner
50112491        0 drwxr-xr-x    3 martin           wheel                  96 26 Apr 15:44 /var/dirs_cleaner/fP
50112492        0 drwxr-xr-x    3 martin           wheel                  96 26 Apr 15:45 /var/dirs_cleaner/fP/bar
50112495        8 -rw-r--r--    1 martin           wheel                  12 26 Apr 15:45 /var/dirs_cleaner/fP/bar/file.txt
% sudo cat /var/dirs_cleaner/fP/bar/file.txt
Hello World

It seems that /var/dirs_cleaner itself

• is emptied when you open “About this Mac” and go to the “Storage” tab,
• is emptied when you open the Disk Utility app,
• is not emptied after a reboot.

My guess would be that the utility is used by the macOS tools to free disk space (About this Mac -> Storage -> Manage) but I have not been able to confirm that so far.