When configuring an application, you can often use /dev/null as config file if you want the application to read an empty file. But, if the application reads a list of files from a directory, you cannot use this trick. You would need to give it an empty directory to read.

I was wondering: does Linux have a default empty directory that can be used for such purposes? I know OpenSSH used /var/empty for a while, and I can of course create an empty dir myself, but maybe the FHS has specified a standard directory for this?

  • 8
    On my system, /var/empty is not empty, but contains a folder called sshd, so you probably don't want to use that. – knub Dec 7 '16 at 11:30
  • 12
    Just a point: The special aspect of /dev/null isn't so much for reading as for writing. Data written to /dev/null just disappears. So, a directory equivalent would be a place where mv yourfile /dev/empty would result in deleting your file. – Wildcard Dec 7 '16 at 21:03
  • 4
    @Wildcard I presume you mean mv yourfile /dev/empty/. If you do mv yourfile /dev/empty, you're trying to replace the special directory. – Rhymoid Dec 7 '16 at 22:24
  • 6
    @Jules No, it isn't. You can't initialise anything with /dev/null and dd because dd will get an EOF before it's even written a single byte. I think you're thinking of /dev/zero, which is often used to fill something with or generate a specific number of zeros. – Micheal Johnson Dec 8 '16 at 17:16
  • 2
    @MichealJohnson you're right, my mistake, I'd confused /dev/null with /dev/zero. – Jules Dec 8 '16 at 17:52
up vote 62 down vote accepted

The FHS provides no "standard" empty directory.

It is common for Linux systems to provide a directory /var/empty, but this directory is not defined in FHS and may not actually be empty. Instead, certain daemons will create their own empty directories in here. For instance, openssh uses the empty directory /var/empty/sshd for privilege separation.

If your need for an empty directory is transient, you can create an empty directory yourself, as a subdirectory of /run or /tmp. If you're doing this outside the program, you can use mktemp -d for this, or use the mkdtemp(3) C function inside your program. Though if you always need the empty directory to be present, consider creating one under /var/empty as openssh does.

For this use case, creating a directory under /tmp is probably the best fit, though in practice it doesn't matter very much where you put it.

  • 4
    I would not recommend creating subdirectories under /var/empty, since any programs that use it (like OpenSSH in its default config) may expect it to be actually empty. (The /var/empty/sshd thing appears to be a weird RedHat-ism; Debian uses /var/run/sshd instead.) – Ilmari Karonen Dec 8 '16 at 12:35
  • 3
    @IlmariKaronen The bit of code you've linked doesn't support your assertion that OpenSSH expects /var/empty to be empty. Is there somewhere else one might look for this? – Michael Hampton Dec 8 '16 at 15:56
  • 2
    @IlmariKaronen Hm, that document is out of date. It refers to /var/empty but the code actually uses /var/empty/sshd. Try again. :) – Michael Hampton Dec 8 '16 at 17:58
  • 1
    @IlmariKaronen Hmm. Now I think you're right, after actually looking at the source which does the chroot() call. I find it amazing that there would be such an obviously stupid flaw in openssh, that Red Hat would have to maintain a downstream correction for. – Michael Hampton Dec 9 '16 at 16:16
  • 2
    I don't see how it's a "stupid flaw" -- having a guaranteed empty root-owned directory at a standard location, for use as a chroot jail, seems like a perfectly good idea to me. Of course, RedHat had to go and ruin it for everybody, by creating subdirectories under it. As a result, my recommendation for portable code would be not to use /var/empty for anything, since you can't be sure of its semantics on any given system. Creating your own empty directory e.g. under /var/run, like Debian does, seems more sensible. – Ilmari Karonen Dec 9 '16 at 16:43

You can use mktemp -d to create a new empty temporary directory with secure permissions, by default in /tmp/. The utility will output the new directory's path on STDOUT, so it is useful in the shell.

It's more portable than a systemd unit file anyway.

  • Yes, you could, but that's impractical if that directory has to be specified in a configuration file. You would want a permanent dir for that. – roelvanmeer Dec 8 '16 at 20:12

This Unix question has some suggestions for creating a "blackhole" directory, including a nullfs FUSE filesystem.

  • 1
    I do not know why the mktemp / mkdtemp answer is upvoted so heavily when this is the perfect answer. nullfs is the equivalent of /dev/null. – chx Dec 10 '16 at 5:49

For services systemd provides the option PrivateTmp to create private /tmp and /var/tmp directories that are not shared by processes outside of the namespace for that service and which should be empty (initially).

[Service]
ExecStart=...
PrivateTmp=yes 
  • 7
    The program might create other temporary files, so you can't assume /tmp will be empty merely because it's been namespaced. – Michael Hampton Dec 7 '16 at 16:18

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.