Why does "ls -a" hide some existing directory from the root user?

Solution 1:

Zsolt, please try these three steps:

1. cd /
2. exec bash
3. /usr/bin/find /you/are/here -ls

It's probably time for fsck... :-(

But before that, you could try (after backing up anything inside somedir):
cd /you/are/here && mkdir somedir.
cd /you/are/here && ln somedir newdir (as root).

Also check mount | egrep -e 'somedir|you|are|here' for any oddities.

Solution 2:

At the time I write this, you haven't ruled out the effects something in $LS_OPTIONS. GNU ls has a some file ignoring options, and ls -I foo -a still ignores foo. But the rest of my answer assumes you get the same results without $LS_OPTIONS.

The total 4 line is not, in fact, surprising. This is the total number of blocks used by . and ... If . is empty and .. is small and on a filesystem whose block size is equal to 4 ls blocks (which is common: GNU ls defaults to 1kB blocks, and ext[234] often uses to 4kB blocks), then the expected total is 0 + 1 * 4 = 4.

There is something unusual, but not unheard of, going on with the filesystem that /you/are/here is on. When you ask for the contents of /you/are/here (with opendir() and readdir(3)), the filesystem responds only with . and ..; yet when you assume that /you/are/here/somedir exists, you are told that it does. This is surprising but possible behavior.

A possible but highly unlikely explanation is a demon (as in Maxwell's demon, not as in daemon program) who moves somedir into place just when you access it and moves it out of the way when you list the directory. Thus the peculiarity you observe could be caused by an ordinary program that just happens to make the right guesses, it doesn't indicate anything wrong with the operating system.

In fact, the operating system probably is behaving in a peculiar way. A common culprit is an automounting system. The way an automounting system works is typically something like this:

• A directory, say /you/are/here, is set up as a location for mount points. A special-purpose filesystem (possibly called autofs) is mounted there.

• When you try to access an entry in /you/are/here, say /you/are/here/somedir, the filesystem driver tries to mount the somedir filesystem. For example, it might look for a line like somedir = /dev/foo or somedir = server:/loca/tion in its configuration file and mount the indicated device or NFS location as /you/are/here/somedir.

• When you list the directory /you/are/here, you see a subdirectory for each filesystem that is currently mounted.

• When you stop using /you/are/here/somedir, perhaps after a delay, the automounter unmounts somedir. So somedir no longer appears in the listing of /you/are/here.