4

So far as I've been able to determine, group ACLs appear to have no effect at all in macOS 10.13.3.

Given a group "editors" with members "joe" and "jane" who belong to no other groups, and a folder "Revisions" with the following permissions…

drwxr-x---+ 38 mary  reviewers  1292 Jan 26 13:37 Revisions
0: group:editors inherited allow list, add_file, search, delete, add_subdirectory, delete_child, readattr, writeattr, readextattr, writeextattr, readsecurity, writesecurity, chown, file_inherit, directory_inherit

…neither "joe" nor "jane" can access the folder.

It appears, though, that user ACLs work. The following ACL, for example, does allow "joe" access:

drwxr-x---+ 38 mary  reviewers  1292 Jan 26 13:37 Revisions
0: user:joe inherited allow list, add_file, search, delete, add_subdirectory, delete_child, readattr, writeattr, readextattr, writeextattr, readsecurity, writesecurity, chown, file_inherit, directory_inherit

This appears to be true for both local and open directory users, on both local storage, AFP, and SMB shares.

It's such a massive, obvious flaw that I have trouble believing I'm not missing something obvious. Suggestions would be much appreciated.

  • I can't comprehend your problem! Group ACLs work perfectly in HS. Which command did you execute to append ACLs? – klanomath Jan 27 '18 at 6:00
  • Obviously they don't work perfectly for me. I can assign them using chmod or macOS Server and get the same non-result. It's as though any entities belonging to a group don't exist. – Bryan Jan 27 '18 at 23:29
  • Please cd to "Revisions" in Terminal on the server, enter (IFS=/; set -f -- $PWD; for arg; do path="${path%/}/$arg"; paths+=("$path"); done; ls -dlae "${paths[@]}") and post the result here. The output shows all ACLs (and POSIX permissions) of the path to "Revisions". – klanomath Jan 27 '18 at 23:33
  • @klanomath Thanks for the suggestion. The result exceeds the character limit here, but can be found here: dropbox.com/s/4eohny85zmrzuey/Revisions_ACLs.txt?dl=0 – Bryan Feb 3 '18 at 2:42
  • Is "ariel" member of the group "editors"? I may add it to your question - should I change names? – klanomath Feb 3 '18 at 2:58

You must log in to answer this question.

Browse other questions tagged .