3

Objective

To require the root password when changing wallpaper on my system when logged in as myself. Similar behavior to editing your security settings in Preferences where a password is required to unlock the page. Or in Keychain when viewing a password.


Outdated Solutions

  1. com.apple.desktop.plist does not exist anymore. 99% of answers simply repost that protecting this file will solve my problem. This solution seems to have been outdated since 10.9.5 Mavericks. I'm currently on 10.11.6 El Capitan FYI.
  2. Preferences affords no protections to the Desktop & Screensaver panel. You cannot stop anyone from changing the wallpaper there.
  3. desktoppicture.db in ~/Library/Application Support/Dock is the alleged point of interest for protecting wallpapers, yet seems pretty much useless at stopping changes, even when set with read-only protections and owned by root.
  4. The /System/Library/CoreServices/DefaultDesktop.jpg hard link doesn't correspond to the current wallpaper, just the default one.
  5. Nobody seems to have the faintest idea where the link or file entry point to the currently displayed wallpaper is.

Attempts

Locking down the wallpaper requires I stop users from:

  1. Using Use Image As Desktop Picture by right-clicking on images in Safari.
  2. Using Services->Set Desktop Picture in Finder to change the background.
  3. Using Preferences->Desktop & Screensaver to change the background.

I achieved 1 by setting ~/Library/Safari/Safari Desktop Picture to read-only and locking it. This stops any image from Safari from being set as the desktop picture.

That leaves me with either locking down preferences and removing the option to set desktop images via 2 or locking whatever file points to the current desktop image from being modified without a password. Well, because you cannot protect the Desktop & Screensaver pane in Preferences, that option goes out the window.

That leaves me with only one more solution. Finding whatever hard-link or file contains the copy or pointer to the current desktop image and protecting it. However, the problem is I just can't figure out where that is.


Notes

  • You might have to disable Apple's "System Integrity Protection" in order to adjust permissions on some files (desktoppicture.db for instance). That requires booting into recovery mode and disabling it with csrutil disable.

  • After disabling System Integrity Protection, I found I still couldn't change some files. I booted into Single User Mode and used fsck followed by mount -uw / to get past a read only error when adjusting permissions. Using chflags nouchg <file> before chmod 400 <file> allowed me to finally adjust permissions. Although I must say I was able to also adjust permissions in normal usage as long as I first used chflags nouchg <file> on my target before trying to adjust permissions. So single user mode might not have been necessary.


Summary / tl;dr

What file controls the currently displayed desktop wallpaper on macOS, and what steps must be undertaken to require root password for adjusting the wallpaper.

You must log in to answer this question.

Browse other questions tagged .