0

In Unix, any user with sudo access can act as any other user using sudo su. This invalidates any imagined privacy of local files for all other users of the same Mac. Is there any (preferably OS-level) way to work around this and give users of a multi-user Mac privacy from a potentially snooping administrator?

Edit: In my further testing it seems at least Keychain is blocked for the administrator using sudo su. Using security I could see the metadata -- i.e. what websites there were passwords for and titles of secure notes -- but not the contents themselves. And even if I as administrator reset the account password, the login keychain still used the old password. Also of interest, opening GUI apps using open will try to open them for the actual user(in their GUI context, and only if it exists), not in the GUI context of the administrator.

Edit2: To get into the right frame of mind, imagine a family with one Mac. The kids have been learning about root access and are asking how they can be sure Mom & Dad can't snoop on their files. How do Mom & Dad avoid buying one Mac per kid?

Improve this question
8
  • Are you sure about that? I have never actually considered it before.
    – voices
    Oct 6, 2015 at 13:43
  • 1
    tjt263: Just tested it after talking about it in a security class in college. Standard Unix stuff.
    – Erik Vesteraas
    Oct 6, 2015 at 13:49
  • Hmm, that does have some rather serious implications.
    – voices
    Oct 6, 2015 at 13:53
  • I don't actually know the answer but you might like to investigate /etc/sudoers.tmp & visudo. Don't forget to check info & man. You may need root access.
    – voices
    Oct 6, 2015 at 14:08
  • 2
    There is no way. They are root at that point. What you can do, if you're the administrator, is only enable sudo for specific actions for specific users instead of giving them full sudo access.
    – Andrew Larsson
    Oct 6, 2015 at 15:09

1 Answer 1

Reset to default
2

Basically all files stored locally are accessible by an admin user (or any user who can run a root shell). This also includes locally stored/cached files held in Dropbox, Google Drive, iCloud etc.

If a user wants to prevent an admin looking at his/her file, he/her should create an encrypted DMG using Disk Utility, should not store its password in the Keychain and should take extra care to always unmount the DMG whenever he/she walks away from the computer.

Improve this answer
3
  • Not a very user friendly solution, but the best one I have found so far. Though, why not store the password in the keychain? As mentioned I have not managed to read the actual passwords as an admin user(without the keychain password), and it makes things at least a little better.
    – Erik Vesteraas
    Oct 6, 2015 at 16:59
  • 1
    Security and user friendliness are usually at opposite ends of a spectrum. e.g. Windows has a good security model but to make it easy to use the defaults are set to be not that secure
    – mmmmmm
    Oct 6, 2015 at 17:11
  • Not using Keychain may be overly paranoid, agreed :-)
    – nohillside ♦
    Oct 6, 2015 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .