From radmind
# 10.4-desktop-negative
# Spotlight database directory. Every writable mounted volume gets one.
d ./.Spotlight-V100 0600 0 80
# Obvious, no? Every volume has its own .Trashes folder
d ./.Trashes 1333 0 80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Used by the File System events framework.
d ./.fseventsd 0700 99 99
# database of frequently-accessed small files
a ./.hotfiles.btree 0600 0 0 1111523163 65630 RQBDAUdqJnkTxJsKZZYxUz9veiQ=
# Used by Carbon applications
d ./.vol 0555 0 0
# Cached information
d ./Library/Caches 1777 0 80
# Console logs, crash reports, etc.
d ./Library/Logs 0775 0 80
# Available network interface information
f ./Library/Preferences/SystemConfiguration/NetworkInterfaces.plist 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# Machine's rendezvous name, AppleTalk name, DHCP settings, etc.
# Remove this item if you're running a lab.
f ./Library/Preferences/SystemConfiguration/preferences.plist 0644 0 80 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# Network share browsing
d ./Network 0755 0 0
# Cached information (kernel cache, fonts)
d ./System/Library/Caches 0755 0 0
# Extensions caching. Remove the files after installing new kexts.
f ./System/Library/Extensions.kextcache 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./System/Library/Extensions.mkext 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# User home directories. Don't delete them. Use the User Management scripts
# if you need to manage user profiles in a lab.
d ./Users 1775 0 80
# Shared User space, required by some applications
d ./Users/Shared 0775 0 80
# Other volumes mounted here.
d ./Volumes 1777 0 80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# automount volumes from fstab or netinfo. If you mount NFS shares, you'll
# probably need to add ./private/automount to your negative.
d ./automount 0755 0 80
# If coring is enabled, here's where cores go.
d ./cores 1775 0 80 AAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
# Mac OS X uses a devfs and fdesc filesystem to handle /dev and /dev/fd
d ./dev 0555 0 0
# Created by /etc/rc on boot
f ./mach.sym 0444 0 80 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# cupsd(8) components. Comment out if managing a lab.
f ./private/etc/cups/certs/0 0440 0 80 1122301379 32 W4eA+rgISk8sh5okWWnZnkt6VBE=
d ./private/etc/cups/ppd 0755 0 26
f ./private/etc/cups/printers.conf 0600 0 26 1111362301 2751 gokL/omR4IyPaOsFG/geqRDX6KM=
# managed by cupsd(8)
f ./private/etc/printcap 0644 0 0 1121953780 143 zMWyr8b2agfzVBQrIAayMkMfh5M=
# Used by netbooting
d ./private/tftpboot 0755 0 0
# temporary files, managed by system
d ./private/tmp 1777 0 0
# at(1) queues
d ./private/var/at/jobs 0755 1 0
d ./private/var/at/spool 0755 1 0
# crontabs
d ./private/var/cron/tabs 0755 0 0
# Apple caches
f ./private/var/db/BootCache.playlist 0600 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/db/CodeEquivalenceDatabase 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/db/RemoteManagement/caches 0755 1 1
d ./private/var/db/Spotlight-V100 0600 0 0
f ./private/var/db/SystemEntropyCache 0600 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/db/TokenCache 0711 0 0
# DHCP leases
d ./private/var/db/dhcpclient/leases 0700 0 0
# apparently Apple records the time it took to reach the loginwindow from boot
f ./private/var/db/loginwindow.boottime 0644 0 0 1111523219 10 rUMgoS75n+VDUxo9RkTrGejeuTM=
# NetInfo contains local user account information. The hash folder has
# files containing MD5 hashes of the user passwords. Remove or comment
# out the next two lines if you're running a lab.
d ./private/var/db/netinfo/local.nidb 0700 0 0
d ./private/var/db/shadow/hash 0700 0 0
# managed by rpc.statd(8)
f ./private/var/db/statd.status 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# used by vsdbutil (no manpage yet)
f ./private/var/db/volinfo.database 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# launchd(8), Apple's replacement for init and StartupItems
d ./private/var/launchd 0755 0 0
# Logging facilities. syslogd doesn't create them if they're missing.
d ./private/var/log 0755 0 0
d ./private/var/log/cups 0755 0 0
f ./private/var/log/cups/access_log 0644 0 26 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/cups/error_log 0644 0 26 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/log/fax 0755 0 0
f ./private/var/log/ftp.log 0644 0 0 1098606428 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/log/httpd 0755 0 0
f ./private/var/log/install.log 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/ipfw.log 0640 0 80 1098606428 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/lastlog 0640 0 80 1111695092 14056 IYdy7EsLIl+fOmX89xDLlCElJRk=
f ./private/var/log/lpr.log 0644 0 0 1098606428 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/mail.log 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/netinfo.log 0644 0 0 1098606428 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
d ./private/var/log/ppp 0755 0 0
d ./private/var/log/sa 0755 0 0
d ./private/var/log/samba 0755 0 0
f ./private/var/log/secure.log 0600 0 80 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/system.log 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
f ./private/var/log/windowserver.log 0640 0 80 1111693676 2276 1Dw1n/DznTLoa6TH9qZQm+K/1t0=
f ./private/var/log/wtmp 0644 0 80 1111695092 720 qdyP/5LrB7f0J2qFV0YTBL25tB4=
# used by the postfix mail transfer agent
d ./private/var/mail 0775 0 6
# radmind client data
d ./private/var/radmind/client 0755 0 0
# where pid information is stored for running processes
d ./private/var/run 0775 0 1
# slpd(1). Could probably be in base.
f ./private/var/slp.regfile 0644 0 0 1099338074 0 2jmj7l5rSw0yVb/vlWAYkK/YBwk=
# CUPS print spooling
d ./private/var/spool/cups 0710 0 26
d ./private/var/spool/cups/tmp 1770 0 26
# Faxes
d ./private/var/spool/fax 0750 0 0
# Mail and postfix spool folders
d ./private/var/spool/mqueue 0750 0 0
d ./private/var/spool/postfix 0755 0 0
# Maybe for SMB printing?
d ./private/var/spool/samba 0775 0 0
# Temporary items, managed by the system.
d ./private/var/tmp 1777 0 0
# Virtual memory
d ./private/var/vm 0755 0 0
# Xgrid client job control
d ./private/var/xgrid/agent 0755 86 0
d ./private/var/xgrid/agent/cookies 0755 86 0
d ./private/var/xgrid/controller 0755 85 0
d ./private/var/xgrid/controller/blobs 0755 85 0