29

On MacOS. I want to make it so that any new files/folders that get created within a specific folder have the same permissions (not group, that's already taken care of) as those of the parent directory.

On Linux, I would normally use setfacl, but it looks like chmod on MacOS might be able to do what I'm looking for. I've read through the man page for chmod but I still can't figure out how to properly format the command to get what I want.

Improve this question
0

5 Answers 5

Reset to default
40

First, a bit of background to explain what's going on: Files in OS X can have two quite different kinds of permission settings applied to them: POSIX and ACLs.

Files always (well, almost always) have POSIX permissions applied, consisting of an owner, group, and others (with some combination of read, write, and execute for each of those). There is no way to control inheritance of POSIX permissions: new items are always owned by whatever user created them, the group assignment is inherited from the folder they're in, and the access is determined by the umask (which is pretty much always: owner gets full access, group and others read only + execute for folders). So POSIX permissions won't work for what you're trying to do.

Files can also have an access control list (ACL) applied. This is a list of access control entries (ACEs), each of which applies to a user or group, specifies types of access (in great detail), whether they're being allowed or denied, and whether the ACE should also be copied to items created inside the folder. That last bit is the part that makes this useful for you; you need to create an ACE on the folder that specifies the group you want, the types of access you want, and full inheritance.

chmod on OS X can manipulate ACEs with the +a, -a, etc permissions options. If I understand what you want, you'd use this (with your group name and folder path substituted) to create the ACE:

chmod +a "group:examplegroup allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" /path/to/folder

Note: the inheritance is not "live", i.e:

  • it doesn't apply to items created before you assigned the ACE
  • it doesn't apply to items created somewhere else and then moved into the folder.

You can apply it to existing contents by using -R (i.e: chmod -R +a ...). I don't know of a way (except Apple's server admin tools) to force inheritance to items moved into the folder.

Improve this answer
5
  • Thanks for the great explanation. I just tried it out though and it still just created a new file with user read/write, everybody else read permissions. The parent folder (outdoors) is set to 775 permissions with my user (jhicks) as the owner and _www as the group. I've added myself to the _www group. drwxrwxr-x+ 13 jhicks _www 442B Nov 16 09:47 outdoors I ran your command as follows: chmod +a "group:_www allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" outdoors
    – Jeremy Hicks
    Nov 16, 2011 at 16:51
  • 2
    ls -l only shows POSIX permissions (although the "+" after the permissions indicates that there's an ACL present). Use ls -le to show ACLs as well.
    – Gordon Davisson
    Nov 16, 2011 at 18:30
  • If the groupname has a space in it, you can use : as the delimiter. For example, "group:my group with a space:allow"
    – Doug Richardson
    Oct 12, 2012 at 22:18
  • Followed the chmod +a ... command, then I created an abc.txt in the folder. Switched to another user and edit with TextEdit, the file is indicated as Locked and is not editable.
    – ohho
    Oct 10, 2013 at 10:47
  • I've been doing some playing with this I think that you force inheritance with +ai
    – Robin
    May 27, 2014 at 13:07
6

Try adding -R to @gordon's command, like so:

chmod -R +a "group:_www allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" outdoors

The -R option will (as noted here):

Recurse: Change the mode of file hierarchies rooted in the files instead of just the files themselves.

Changing the file hierarchies seems to be what you're looking for (for new files, directories, etc.).

You can also check out this Apple.SE post, which covers a situation somewhat similar to yours (except relating to a shared directory), which required a sudo tacked onto the front.

Improve this answer
6

This (-R) is not what most people seek to do; most of the time they would prefer to change the ACL on the topmost directory and do something magical to force all contained objects to inherit flags according to the ACL they specified on the root of that sub-tree. This is much more elegant as the ACLs on the objects will sort these inherited ACEs according to policy.

And yes, I had to write a python script to do this, I didn't find anything appropriate either.

Improve this answer
1
  • 2
    Do you care to share (e.g. on a gist? If you don’t mind, I think that was a nice gesture.
    – myhd
    Oct 18, 2012 at 10:03
1

On a Mac try using PathFinder, it makes it easy to set ACL and POSIX. If you're hosting WordPress on a Mac Server you'll also need to set define('FS_METHOD', 'direct'); in the wp-config.php so that installing plugins and upgrading won't ask you for FTP details.

So basically you keep the default POSIX permissions, and add the user _www (not group) to ACL, then click Propagate Permission in the ACL window.

Improve this answer
1

chmod +ai, i = inherit acl rules

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .