# Spotlight database directory. Every writable mounted volume gets one.
d /.Spotlight-V100                   	0600     0    80

# Obvious, no? Every volume has its own .Trashes folder
d /.Trashes                           	1333     0    80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

# database of frequently-accessed small files
a /.hotfiles.btree                     0600     0     0 1111523163   65630 RQBDAUdqJnkTxJsKZZYxUz9veiQ=

# volfs mount point, used by Carbon applications
d /.vol                               	0555     0     0

# Cached information
d /Library/Caches                     	1777     0    80

# ColorSync Display Profiles
d /Library/ColorSync/Profiles/Displays 0775     0    80

# Console logs, crash reports, etc.
d /Library/Logs                        0775     0    80

# Global preferences, energy saver settings, login timeouts, etc.
# Remove or comment out if you're managing a lab.
#f /Library/Preferences/.GlobalPreferences.plist        0644     0    80 1123612723     0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# Available network interface information
f /Library/Preferences/SystemConfiguration/NetworkInterfaces.plist 0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# Additional SystemConfiguration settings. Should be commented out for
# a more fully managed environment, like a lab.
#f /Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist     0644     0    80 1072504750    1245 7W+4djjIZRBJlrUsVSTJw5yqBNg=
#f /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist 0644     0    80 1125594056    6623 n9W/Jthauzh/RV1laotcA/Tq6r0=
#f /Library/Preferences/SystemConfiguration/com.apple.nat.plist 0644     0    80 1069909129     909 SrYrmXU/e4XidaiU74MajA+jtho=

# Machine's rendezvous name, AppleTalk name, DHCP settings, etc.
#f /Library/Preferences/SystemConfiguration/preferences.plist 0644     0    80 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# audio settings, like volume and balance
#f /Library/Preferences/com.apple.audio.DeviceSettings.plist    0644     0    80 1125436293    2109 cdfG/Cgo1JJ+jdOCJErkAqoRJfg= 

# loginwindow settings. Should be managed in a lab, although it breaks
# tripwire because use of the loginwindow modifies it.
#f /Library/Preferences/com.apple.loginwindow.plist     0644     0    80 1125439218      90 9EVFNVmVvgTkZyIJ6o+IndqD2l8=

# Network share browsing
d /Network                            	0755     0     0

# Cached information (kernel cache, fonts)
d /System/Library/Caches              	0755     0     0

# Extensions caching. Remove the files after installing new kexts.
f /System/Library/Extensions.kextcache 0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /System/Library/Extensions.mkext     0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# User home directories. Don't delete them. Use the User Management scripts
# if you need to manage user profiles in a lab.
d /Users                              	1775     0    80

# Shared User space, required by some applications
d /Users/Shared                        0775     0    80

# Other volumes mounted here.
d /Volumes                            	1777     0    80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

# automount volumes from fstab or netinfo. If you mount NFS shares, you'll
# probably need to add /private/automount to your negative.
d /automount                          	0755     0    80

# If coring is enabled, here's where cores go.
d /cores                              	1775     0    80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

# Mac OS X uses a devfs and fdesc filesystem to handle /dev and /dev/fd
d /dev                                	0555     0     0

# Created by /etc/rc on boot
f /mach.sym                            0444     0    80 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# cupsd(8) components. Comment out if managing a lab.
#f /private/etc/cups/certs/0                    0440     0    80 1122301379      32 W4eA+rgISk8sh5okWWnZnkt6VBE=
#d /private/etc/cups/ppd                        0755     0    26
#f /private/etc/cups/printers.conf              0600     0    26 1111362301    2751 gokL/omR4IyPaOsFG/geqRDX6KM=

# dump(8) date records
f /private/etc/dumpdates               0644     0     0 1124886610       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# managed by cupsd(8).
f /private/etc/printcap                0644     0     0 1121953780     143 zMWyr8b2agfzVBQrIAayMkMfh5M=

# Used by netbooting
d /private/tftpboot                   	0755     0     0

# temporary files, managed by system
d /private/tmp                        	1777     0     0

# at(1) queues
d /private/var/at/jobs                	0755     1     0
d /private/var/at/spool               	0755     1     0

# NetInfo DB backups, done nightly by /etc/periodic/daily/500.daily
d /private/var/backups                 0700     0     0

# crontabs
#d /private/var/cron/tabs              	0755     0     0

# Apple caches
f /private/var/db/BootCache.playlist   0600     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/db/CodeEquivalenceDatabase 0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# Spotlight databases for non-local volumes
d /private/var/db/Spotlight-V100       0600     0     0

# more caches
f /private/var/db/SystemEntropyCache   0600     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d /private/var/db/TokenCache          	0711     0     0

# crashdump(8)
d /private/var/db/crashdump            0755     0     0

# DHCP leases
d /private/var/db/dhcpclient/leases   	0700     0     0

# determines progress bar speed during boot. See WaitingForLoginWindow(8)
f /private/var/db/loginwindow.boottime 0644     0     0 1111523219      10 rUMgoS75n+VDUxo9RkTrGejeuTM=

# NetInfo contains local user account information. The hash folder has
# files containing MD5 hashes of the user passwords. Remove or comment
# out the next two lines if you're running a lab.
#d /private/var/db/netinfo/local.nidb  	0700     0     0
#d /private/var/db/shadow/hash         	0700     0     0

# managed by rpc.statd(8)
f /private/var/db/statd.status         0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# managed by vsdbutil (no manpage yet)
f /private/var/db/volinfo.database     0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# launchd(8), Apple's replacement for init and StartupItems
d /private/var/launchd                 0755     0     0

# Logging facilities. syslogd doesn't create them if they're missing.
d /private/var/log                    	0755     0     0
d /private/var/log/cups               	0755     0     0
f /private/var/log/cups/access_log     0644     0    26 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/log/cups/error_log      0644     0    26 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d /private/var/log/fax                	0755     0     0
f /private/var/log/ftp.log            	0644     0     0 1098606428       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d /private/var/log/httpd              	0755     0     0
f /private/var/log/install.log         0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/log/ipfw.log           	0640     0    80 1098606428       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/log/lastlog             0640     0    80 1111695092   14056 IYdy7EsLIl+fOmX89xDLlCElJRk=
f /private/var/log/lpr.log            	0644     0     0 1098606428       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/log/mail.log            0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/log/netinfo.log        	0644     0     0 1098606428       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d /private/var/log/ppp                	0755     0     0
d /private/var/log/sa                 	0755     0     0
d /private/var/log/samba              	0755     0     0
f /private/var/log/secure.log          0600     0    80 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/log/system.log          0640     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f /private/var/log/windowserver.log    0640     0    80 1111693676    2276 1Dw1n/DznTLoa6TH9qZQm+K/1t0=
f /private/var/log/wtmp                0644     0    80 1111695092     720 qdyP/5LrB7f0J2qFV0YTBL25tB4=

# used by the postfix mail transfer agent
d /private/var/mail                   	0775     0     6

# radmind client data
d /private/opt/local/var/radmind/client         	0755     0     0

# where pid information is stored for running processes
d /private/var/run                    	0775     0     1

# slpd(1). Could probably be in base.
f /private/var/slp.regfile             0644     0     0 1099338074       0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=

# CUPS print spooling
d /private/var/spool/cups             	0710     0    26
d /private/var/spool/cups/tmp         	1770     0    26

# Faxes
d /private/var/spool/fax              	0750     0     0

# Mail and postfix spool folders
d /private/var/spool/mqueue           	0750     0     0
d /private/var/spool/postfix          	0755     0     0

# Maybe for SMB printing?
d /private/var/spool/samba            	0775     0     0

# Temporary items, managed by the system.
d /private/var/tmp                    	1777     0     0

# Virtual memory
d /private/var/vm                     	0755     0     0

# Xgrid client job control
d /private/var/xgrid/agent            	0755    86     0
d /private/var/xgrid/agent/cookies    	0755    86     0
d /private/var/xgrid/controller       	0755    85     0
d /private/var/xgrid/controller/blobs 	0755    85     0
