0

I need to prevent a Mac user from deleting some files, so my idea is disable the user to sudo to the root user. I tested it in Terminal, it's OK there:

dst49700:salt ttest$ ls -al /etc/salt/111 
-rw-------  1 root  wheel  0 Apr 20 16:54 /etc/salt/111
dst49700:salt ttest$ rm /etc/salt/111 
override rw-------  root/wheel for /etc/salt/111? y
rm: /etc/salt/111: Permission denied

The staff group's user ttest can not delete this file.

But it's very strange: when I tested it in Finder, I dragged it to the Trash, I needed to enter a password and after that, the file had been moved to Trash.

Why can I move it to Trash without permission? Nobody can delete it, except root, can somebody help me or tell me a better idea to prevent a user from deleting a file?

Improve this question
2
  • Your ttest user is also member of the admin group or the account wouldn't be able to delete the file.
    – klanomath
    Apr 20, 2017 at 16:46
  • File removal is influenced by the ownership and the permissions on the directory/folder containing the file. Please add this to the question (and your tests).
    – nohillside ♦
    Apr 20, 2017 at 17:00

1 Answer 1

Reset to default
1

You did need permission — Finder asked you for your password and you provided it. That gave Finder permission to use root access to delete the file, because the staff group are in sudoers.

Improve this answer
2
  • But I don't see any entries in sudoers about group permission，there's '%admin ALL = (ALL) ALL' in it by default and I remove it，added 'dkmolko ALL = (ALL) ALL'，how I disable group permission from sudoers？
    – DKmolko
    Apr 20, 2017 at 9:57
  • AFAIK sudoers isn't involved in file deletion in Finder. Either the current user is allowed to delete the file, or an admin account/password is required.
    – nohillside ♦
    Apr 20, 2017 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .