0

I need to prevent a Mac user from deleting some files, so my idea is disable the user to sudo to the root user. I tested it in Terminal, it's OK there:

dst49700:salt ttest$ ls -al /etc/salt/111 
-rw-------  1 root  wheel  0 Apr 20 16:54 /etc/salt/111
dst49700:salt ttest$ rm /etc/salt/111 
override rw-------  root/wheel for /etc/salt/111? y
rm: /etc/salt/111: Permission denied

The staff group's user ttest can not delete this file.

But it's very strange: when I tested it in Finder, I dragged it to the Trash, I needed to enter a password and after that, the file had been moved to Trash.

Why can I move it to Trash without permission? Nobody can delete it, except root, can somebody help me or tell me a better idea to prevent a user from deleting a file?

  • Your ttest user is also member of the admin group or the account wouldn't be able to delete the file. – klanomath Apr 20 '17 at 16:46
  • File removal is influenced by the ownership and the permissions on the directory/folder containing the file. Please add this to the question (and your tests). – nohillside Apr 20 '17 at 17:00
1

You did need permission — Finder asked you for your password and you provided it. That gave Finder permission to use root access to delete the file, because the staff group are in sudoers.

  • But I don't see any entries in sudoers about group permission,there's '%admin ALL = (ALL) ALL' in it by default and I remove it,added 'dkmolko ALL = (ALL) ALL',how I disable group permission from sudoers? – DKmolko Apr 20 '17 at 9:57
  • AFAIK sudoers isn't involved in file deletion in Finder. Either the current user is allowed to delete the file, or an admin account/password is required. – nohillside Apr 20 '17 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .