MacOS – Found a socket called “chaos_control” in the home directory, what is it

filemacosvi

I did an ls in my home directory and along with my normal folders it listed a file called chaos_control. It does not show up in Finder even when I show hidden files.

I ran file chaos_control and it returned that the file is a socket. What does this mean and should I be worried? I did not notice it before today. It is not related to the productivity app "Chaos Control" I found on Google; I have never had that installed on my system.

If I run open -e chaos_control I get this error:

enter image description here

mdls returns chaos_control: could not find chaos_control.

ls -l returns this:

srwxr-xr-x 1 chris staff 0 Jan 24 2016 chaos_control

Opening the file in vim yields "chaos_control" [Permission Denied], even with sudo.

Running lsof on this socket does nothing, no processes are using it.

Best Answer

If you look at the output from "ls -l" you see that the first letter is an "s". This means that the file is not really a physical file on disk, but is instead a "socket link".

A "socket link" is not the socket itself, but as the name suggest merely a link. It is used when two processes running on your computer want to communicate. In order to "find each other" they use the socket link in the file system. Both programs open that and they can exchange messages.

You cannot use the "open" command to open a socket link, as it is not really a disk file and it doesn't make any sense to open it in for example TextEdit.app. Similarly opening it with "vim" does not make any sense either.

Having a socket link is in itself not a "bad thing", if this is your worry. It doesn't really take up much space on disk - and it's only a link, not a socket in itself. So if you close the communicating processes (or for example reboot the Mac) - the socket will automatically be closed.

Any (non-sandboxed) program could potentially create a socket link named chaos_control. So it is not possible conclusively to say which program created it by looking at the file name.

As it has been created a year and a half ago, it is plausible that you did some action that caused this file to be created. For example when using a new program that you aren't using anymore.

You can just delete the socket link (use the "rm" command) and it is gone. However there's no real risk or disadvantage in having it around except that it shows up in folder listings.

Related Question