Question

when we execute ls -l command to list files in directories, Does the /etc/passwd file get accessed. Please explain ?? if yes How can I verify it ??

Answer 1

Yes. /etc/passwd is used to map user IDs to usernames. We can turn this off by using -n, which will show us the numeric user IDs and group IDs (uids, gids):

$ ls -l
total 0
-rw-rw-r-- 1 thomas thomas 0 Sep 30 10:54 bar

$ ls -n
total 0
-rw-rw-r-- 1 1000 1000 0 Sep 30 10:54 bar

Ultimate proof:

$ strace ls -l 2>&1 | grep /etc/passwd
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 4

$ strace ls -n 2>&1 | grep /etc/passwd
# no output