Prevent certain APFS volumes from being deleted in Disk Utility.app

Question

I can open Disk Utility and permanently erase any highlighted, internal APFS disk volume not being used to boot the currently running operating system, just by clicking the delete or - (minus) button, and without getting any prompts for an administrator password.

The same goes even when Disk Utility observes and warns me that the volume contains another installation of macOS and macOS user data and any user can carry out the operation.

Is it possible to lock down these actions for certain APFS volumes?

That is, how can I disable / grey out the delete button for those volumes, so the button can't be pressed? Or, how can I make Disk Utility prompt for an administrator password when performing these operations, either globally or on certain volumes?

Is it possible to achieve one or the other possibly using Terminal, diskutil and/or APFS verbs or otherwise?

Answer 1

The answer is Parental Controls.

Below users axj and rpj both have Standard accounts. However, rpj has parental control turned on, therefore the account is labeled as Managed.

By default under Parental Controls, the Disk Utility is not an allowed App, as shown below.

The same is true for the Terminal application.

This does not prevent user rpj from using the Disk Utility, but user rpj would first have to enter the username and password of the Admin user dma. For example, if user rpj tried to open the Disk Utility application, then the following popups would appear.

If the buttons Always Allow... or Allow Once... are pressed, then the following popup appears.

If the proper username and password are entered, then the Disk Utility application will open. If Always Allow... was pressed, then the Disk Utility will be checked off in Parental Controls, as shown below.

Answer 2

As far as I can ascertain, there's no way you can lock down APFS volumes or customise Disk Utility in this way, but it may help to use the inexpensive third-party tool Mac App Blocker to set a password to open Disk Utility.

If that isn't what you need, another option is to send Apple feedback at https://www.apple.com/feedback/macos.html. It may help if you can persuade others to request the same change. Note that feedback is a one-way process; Apple won't open any dialogue with you about this.