Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I have a second user account on my machine that is only used for iCloud syncing for my wife's apple id. In order to consolidate photostream photos I'm going to set up a process to pull new photos out of her photostream folder and import them into my iPhoto library.

But first, I have to alter permissions so I can see her photos from my user account. I've managed to set the permissions for the "everyone" user to see the photos from my user account, and that works for existing photos. But when new photos come in, they are set where only her account can see them.

Here is what I'm using. Hopefully someone can tell me what I'm missing. :-)

sudo chmod -R +a "everyone allow read,write,execute,append,readattr,readextattr,readsecurity,writesecurity,file_inherit,directory_inherit" '/Users/Wife/Library/Application Support/iLifeAssetManagement/assets/sub'

Thanks.

share|improve this question

2 Answers 2

I would try to avoid ACL's: they are tricky and often behave unexpectedly.

If I were you, I would try stick to standard UNIX permission, following these guidelines:

  1. Create a user group (say, MeAndWife)
  2. Make sure users Me and Wife are the ones and only members of MeAndWife
  3. Change group ownership of sub directory to MeAndWife by something like chgrp -hR MeAndWife '/Users/Wife/Library/Application Support/iLifeAssetManagement/assets/sub'
  4. Grant the owning group members the same permissions which are granted to the owning user: this may be obtained in several ways, but one that I like is by running find '/Users/Wife/Library/Application Support/iLifeAssetManagement/assets/sub' -group MeAndWife -and -perm -u=r -and -not -perm -g=r -exec chmod -h g+r {} \; [this basically states: Find files/folders with owning group MeAndWife, for which owning user does have read permission, but owning group members do not; and give owning group members read permissions]. Of course you should repeat this step for write and execute permissions (just replace -u=r and -g=r with, respectively, -u=w and -g=w for write, -u=x and -g=x for execute).
  5. Finally, I think that if you want to be able to navigate to the sub directory from your account, then you need to make the full path to your sub directory searchable by everyone. That means, run through chmod o+x '/Users/Wife/Library', chmod o+x '/Users/Wife/Library/Application Support', chmod '/Users/Wife/Library/Application Support/iLifeAssetManagement' and chmod o+x '/Users/Wife/Library/Application Support/iLifeAssetManagement/assets'

That should do the job: new files in sub should inherit group ownership (MeAndWife) and permissions (same as owning user). If you find that that is not the case, you could use launchd in conjuction with a very simple script to fix file permissions periodically (say, hourly).

share|improve this answer

Not sure whether on OSX you are supposed to state explicitly list,search for directories. Strictly speaking, read/write/execute/append do not apply to directories, only to files.


bmike: This seems both wrong and not an answer. Of course permissions affect directories and directories are just a type of files. Can you improve this or should it just be deleted?

@bmike: of course standard UNIX permissions do apply to both files and directories irrespectively. But ACL's do not. Just have a look at man chmod: you will then realize that there are

  • actions for both files and directories (delete, [read]/[write]&[ext]attr, <read>/<write>&security, chown)
  • actions for directories only (list, search, add_&[file]/[subdirectory], delete_child)
  • actions for files only ([read]/[write]/[append], execute), as well as
  • inheritance flag for directories only ([file]/[directory]&[limit]/[only]&_inherit)

So this proves that the answer is not wrong.

Is this an answer, btw? Yes it is, in that it hints that the user is not giving the directory the proper ACE's.

After all, I think that the user's question and bmike's comment point out to the fact that ACL's are tricky and somewhat misunderstood. Personally, I dropped them completely, and reverted to using standard UNIX perms wherever possible.

This leads me to suggesting the user an alternative approach, which is what I will do in a separate answer.

share|improve this answer
    
This seems both wrong and not an answer. Of course permissions affect directories and directories are just a type of files. Can you improve this or should it just be deleted? –  bmike Nov 16 '12 at 15:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.