1

Recently I have encountered an Apple binary running on my system via Little Snitch which has an asterisk in the file path. This is not the first time I've encountered this but it is the first time I took screenshots.

My question is,

What does an asterisk denote in a file path in the following context - ..examplefolder/*/examplefolder

For the example below, there is no '*' or "com.apple.MobileUpdate.." folder or file in /private/var/db/ in finder, and when I do sudo ls -l it shows all the files in the db folder but on the line before the output it says

ls: DifferentialPrivacy: Operation not permitted

and then at the bottom says

ls: fts_read: Operation not permitted

I don't get either of those two messages when I sudo ls -l other folders.

When I click the little arrow in a circle where it shows the file path in little snitch, it does nothing.

As you can see, the binary is unsigned which is the reason I was trying to track it down in the file system. It is unusual for a binary which I would assume is an Apple binary, to be unsigned.

The binary connects to xp.apple.com which is not unexpected, but the servers so far have not been Apple servers (they dont start with 17.) but that's also not unexpected.

I included all the additional information so that if no one knows the answer, some might be able to speculate.

little snitch output of asterisk file path

terminal output of sudo ls -l

Improve this question

3 Answers 3

Reset to default
2

Turns out the asterisk is used to indicate a temporary file or a file that no longer exists. I guess in this case, where the asterisk appears in the path is where the folders in the path cease to exist currently. The following is the exact response I got when I reached out to Objective Development (developer of little snitch)

The asterisk symbol indicates a process with a temporary path. For this reason, the verification of the code signature fails (the binary file no longer exists in the original path.)

Improve this answer
1

What does an asterisk denote in a file path in the following context

.examplefolder/*/examplefolder

Asterisks in the path can mean one of two things:

  • Single (*). Simple recursive match of zero or more characters used in both pathnames and file names.
  • Double (**). Recursive match of zero or more characters used with pathnames only.

Going back to your example, the asterisk in the path just means “whatever names/paths between the two examplefolders“.

Improve this answer
4
  • ** only works in zsh.
    – nohillside ♦
    Commented Dec 13, 2023 at 7:10
  • works with ksh and bash 5
    – fd0
    Commented Dec 13, 2023 at 7:16
  • 1
    The context of this isn't a shell command line, it's the output of an application (Little Snitch in this case) that should be showing the path to an actual file. Why would a wildcard be there?
    – Barmar
    Commented Dec 13, 2023 at 16:35
  • I understand the use of the asterisk as a wildcard in the command line, I didn't know about the double asterisk though, so thank you for that Allan. However, as Barmar mentioned, it's not being used as a wildcard in this context. At least, It doesn't make sense that it would be a wildcard in this context. Usually that section of little snitch would show the enclosing folder of the binary, which is a property that shouldn't contain a wildcard.
    – dmg15
    Commented Dec 15, 2023 at 1:15
0

Suppose the following files exist:

/top/AA/BB
/top/AA/CC/BB
/top/AA/DD/BB

Then, /top/AA/*/BB will match all of them, because X//Y and X/Y are the same—to the shell.  If it is in a config file for some app (or log file from), then it could have a different meaning assigned by the developers of that app.

Improve this answer
3
  • This is true if the assumption is that the asterisk is a wildcard used to represent one or more folders in a path (like it does to the shell). My understanding of how it’s being used in this case, is that it denotes the point in the path where the temporary files and folders no longer exist. So to use your example /top/AA/*/BB, the path /top/AA still exists on the system but /top/AA/BB has been deleted. Also, it would follow that /top/AA/*/BB could only represent the first file in the list you provided.
    – dmg15
    Commented Mar 19 at 15:17
  • Also, i never actually asked what the asterisk meant in the context of the shell but i understand that it might have provided some insight to detail its use within that context. My query was about its use in the context of log files created by the system and within little snitch.
    – dmg15
    Commented Mar 19 at 15:24
  • Ah, log files also. Edited.
    – WGroleau
    Commented Mar 19 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .