2

I've got a couple of external HDDs and I've noticed the permissions on them are differ, which has got me wondering how a few things work.

On the hard drive that seems to be normal, it has the following permissions on machine 1 (as seen in the info panel):

myuser1 (Me) - Read & Write
staff        - Read & Write
everyone     - Read only

Now when connecting it to my second computer, the user I'm logged in as still has write permissions. When viewing the permissions again I see:

myuser2 (Me) - Read & Write
staff        - Read & Write
everyone     - Read only

1) I the reason that this second computer has R&W permissions because myuser2 is also a member of staff?

2) If so how is the staff group on one machine determined to be logically the same as a group named staff on another machine? I.e. security wise, how is this secure?

How are users and groups referenced in the file's permissions, in a way that is "secure", yet somehow works across 2 completely separate machines? Is it done by name? uid? gid (for groups)? Either way, as these aren't UUIDs, how can this be classed as secure? One could simply ensure a user is created has the same uid as is required to view a file that they're not supposed to see, and they'll have access!

  • You had a bunch of questions in your text, this site works much better if there is only one question per post. I've removed the additional things you've asked, please ask them in new questions if required. – nohillside Feb 2 '16 at 13:39
  • Sorry I'm not too happy about that. All the questions are all extremely related. Should anyone be struggling with understanding the same things, it would all be helpful and related information. – Sencha Feb 2 '16 at 13:44
  • 1
    @patrix And while there were many "questions", they were all extremely related to understanding a single concept. I've enjoyed many very long and comprehensive answers on this site. Sometimes comprehensive answers require comprehensive questions. Perhaps it would help to simply remove my helpful numbered points on each of the question areas, and instead allow someone to read my confusions and then answer with a single response. Plus it took me time to condense my problems into those questions. Please can you re-think your edit? – Sencha Feb 2 '16 at 13:47
  • @Sencha you can restore your original question by yourself. After reading the original question I advise to condense all seven questions to one or two – klanomath Feb 2 '16 at 13:55
  • 1
    Even better, somebody else already did. Also, can you check (in Disk Utility) whether ownership checks are enabled for the external drive at all? – nohillside Feb 2 '16 at 18:03
5

First some important commands to know:

ls -laO shows a lot:

drwxrwxr-x+ 19 myuser1  staff   714  2 Feb 10:31 My Passport

ls -elaO includes ACLs:

drwxrwxr-x+ 19 myuser1  staff   714  2 Feb 10:31 My Passport
  0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit

The following command shows all members of a group (the example group here is staff):

members () { dscl . -list /Users | while read user; do printf "$user "; dsmemberutil checkmembership -U "$user" -G "$*"; done | grep "is a member" | cut -d " " -f 1; }; members staff

The following command shows the UID, the GID and the group memberships of user_name

id user_name

Please check your various users/groups with the last two commands to get an overview.


Standard permissions in the file system are applied by using UID and GID instead of names. So

drwxrwxr-x+ 19 myuser1  staff   714  2 Feb 10:31 My Passport

should be read as (assuming myuser1's UID=501):

drwxrwxr-x+ 19 UID=501  GID=20   714  2 Feb 10:31 My Passport
 |  |  |
 |  |  |Others (Members of GID=12 (Everyone)?) can read and execute
 |  |Members of GID=20 can read, write and execute
 |UID=501 can read, write and execute (owner)

Attaching My Passport to another Mac (Mac2) - the UID/GID won't be changed - will reveal the following:

  • In case myuser2's UID=501 and GID=20 (GID=20 (staff) is a standard group on every Mac and every (standard or admin) user created with the System Preferences is member of it)

    drwxrwxr-x+ 19 UID=501  GID=20   714  2 Feb 10:31 My Passport
    

    which retranslates to:

    drwxrwxr-x+ 19 myuser2  staff  714  2 Feb 10:31 My Passport
    

    and myuser2 on Mac2 has the same rights as myuser1 on Mac1

  • In case myuser2's UID=502 and myuser3's UID=501 and both are member of staff:

    drwxrwxr-x+ 19 myuser3  staff  714  2 Feb 10:31 My Passport
    

    myuser2 as member of staff isn't owner anymore but can still rwx.

  • In case myuser2's UID=502 and is member of staff and myuser3 with UID=501 has been deleted:

    drwxrwxr-x+ 19 (unknown user)  staff  714  2 Feb 10:31 My Passport
    

    myuser2 as member of staff isn't owner anymore but can still rwx.

  • In case myuser2's UID=503 and is not member of staff and UID=501 is deleted

    drwxrwxr-x+ 19 (unknown user)  staff  714  2 Feb 10:31 My Passport
    

    myuser2 as others (member of everyone?) can rx.


So to answer your questions: the reason why myuser2 on Mac2 has the same rights as myuser1 on Mac1 are the same UID and GID/group memberships of both on their respective host. Staff is a default group on every Mac.

In your current environment (single machines/admin rights for the main user(s)) using external drives is not "secure/save" - only using permissions to determine access. And it was never meant to be.

In an organizational unit (the common user of a workstation is no admin) with a centralized user management (OD etc.) you may use applied mount points and special groups do deal with external drives:

Special owner and a new group for the drive/mountpoint:

drwxrwx--- 19 UID=501  GID=512   714  2 Feb 10:31 My Passport

or

drwxrwx--- 19 UID=501  GID=512   714  2 Feb 10:31 My Passport/share_folder

and all non-admin users which require access to the external drive(s) are member of GID=512 ("External Drive Users")


Still, when the external drive is lost, anyone may have access to it. To make it secure you have to encrypt the content of the external disks.

  • In the standard unix permission model there is only one ownerand one group classification. Everyone is synonymous with Others, meaning that the user neither is the owner nor belongs the the file's group classification. – fd0 Feb 2 '16 at 17:45
  • @fd0 In this unix model, can you clarify if this group classification is always the same group as the owner's group, or can they be different? – Sencha Feb 3 '16 at 7:59
  • @klanomath Thanks so much for this detailed answer. I'm working my way through it now! – Sencha Feb 3 '16 at 8:11
1

You asking for a lot of information re the Unix security model which I suspect is too much for one answer here.

The piece of informatiom you are after are User ids (UID) and group ids (GID) This a numeric values corresponding to user and group names.

You can see what they are by id <username> e.g. on my computer

~/D/c/TV $ id mark
uid=502(mark) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),399(com.apple.access_ssh),33(_appstore),100(_lpoperator),204(_developer),395(com.apple.access_ftp),398(com.apple.access_screensharing)

This shows that my user id is 502 my main group is staff*20( and lists the other groups I am in.

Across machines the user and group are equal is they have the same number which is the answer to 2. You are sort of correct it is not that secure but in a managed network the logins will be centrally controlled so only authorised users can connect like this.

As for 3) the volume is mounted to a directory on the client computer and the permissions shown are for that link. So like a symbolic link the info on the name you use to access the other thing can differ from the permission on the source.

For 4) each file/directory is owned by a user, and has permissions for a group and also for all users

  • Thanks for the info. When you say "and has permissions for a group", can you please clarify if that "group" you talk about is always the group of the owner user, or can you set a different group? – Sencha Feb 3 '16 at 8:10
  • Also @Mark, regarding your answer to (3), how can I properly check the permissions of the source volume, if accessing it via the /Volumes/My Passport mount point isn't correct? – Sencha Feb 3 '16 at 8:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .