9

I just realized that my home folder (/HD/Users/Bob) has Everyone 'ReadOnly' permissions set at its root level.

If I browse this folder from another account, I can view the folders, but I'm not allowed to open the standard OS X folders (Desktop, Documents, Music, Movies, etc...). However, I have created a few folders on the root level of my home folder, and those ARE accessible to this other user. They can open folders, and open some of the documents with ReadOnly access.

Is anyone else seeing this? Is this a standard configuration, or is my Mac screwed up? This seems like a security hole to allow users to access files of other users on the system.

I'm running a fairly clean build of Yosemite 10.10.1 - this was installed about a month ago. I restored my old files from a hard drive. They were not restored via Time Machine

2

This is the standard permissions configuration. The root of your home folder is global read, but standard OS X folders within such as Desktop and Documents should be global no access. Feel free to set the permissions of other folders which you create in the root of your home folder to match the permissions on the standard folders.

If you wish new folders to, by default, be global no access, change the permissions on the root of your home folder, propagate the permissions recursively and set up ACLs to inherit permissions for new folders, however I am unsure as to any effects this may have.

  • 1
    That's so interesting.. any idea why it is like that? it seems like a strange setup. – slidmac07 Jan 1 '15 at 19:19
  • So before I posted here, I changed the access at the root level, and propagated it down. It definitely screwed up my computer, and I would advise people to NOT change the ACLs here. After restoring from a backup, I decided to move any non-apple directories into Apple specific folders – slidmac07 Jan 1 '15 at 19:58
  • @slidmac07 Unless you are absolutely sure that you know what you're doing, recursively changing/propagating permissions can be dangerous, as you found out. – douggro Jan 1 '15 at 20:45
  • The reason for making your home folder readable by everyone is so that everyone can see your Public folder. What good is a Public folder that isn't public? – ganbustein Jan 1 '15 at 22:46
  • @ganbustein Whilst this is probably true and was the first thing I thought of (along with the now defunct Web Sharing of ~/Sites) as a potential reason, it feels a bit naive to think that this is the sole reason for making the entire home root global read when ACLs/etc could have done a much less inordinate job. – grg Jan 1 '15 at 23:21
5

If you wish new folders at the top level of your home folder to by default be non-readable by anyone but you, add the following two ACLs to your home folder. DO NOT PROPAGATE PERMISSIONS. The first ACL makes all new folders unreadable, unwritable, and unsearchable by everyone. The second ACL makes an exception for you. Be sure to enter them in this order, so the second entry can push itself to the front.

chown +a "group:everyone deny list,add_file,search,add_subdirectory,delete_child,directory_inherit,limit_inherit,only_inherit" ~
chown +a# 0 "user:$USER allow list,add_file,search,add_subdirectory,delete_child,directory_inherit,limit_inherit,only_inherit" ~

But truth be told, it's easier to just fix up the permissions on any subfolders you create directly under your home folder. I mean, it's not like you're going to do that often, right?

And besides, who's to say you want these new folders readable only by you? What if you want a folder that is group-readable for some group but not world readable? These inherited ACLs are just going to get in your way then.

Creating a top-of-home-folder folder should be a rare event. Ad hoc solutions are best for rare events.

  • 1
    However, some of have come to MacOS from UNIX and/or Linux, where creating a top of home folder folder, or file for that matter, is a common event. These default Mac permissions screw us up, if we continue to work as if we are on a normal UNIX system. – Krazy Glew Feb 11 '16 at 21:10
0

Wow I was quite shocked when I realized this.

Another solution is to lock the home directory for everyone else:

chmod 700 ~

  • Which, as already stated a year earlier, makes a liar out of the name ~/Public – WGroleau Jun 21 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .