2

On Windows, it's not really doable. It is possible on linux with mandatory access control (for example). So you can have a web filter running, but the sudoer wouldn't be able to interfere with it (at least not without lots of effort, potentially rendering the system inoperable). At the same time a sudoer can modify virtually everything else.

What options would I have on OS X to do this?

Improve this question
2
  • This post may be helpful: apple.stackexchange.com/questions/313373/…
    – Allan
    Commented Jul 27, 2018 at 0:49
  • I’ve edited out the part where you don’t even have a Mac - this will make it harder for you to judge which answer works and also makes this more of a theoretical question than something practical, but it’s a great question and perhaps some day you’ll get macOS to play with and can answer even better than we will. It’s pretty broad, but an overview answer might help a lot of people.
    – bmike ♦
    Commented Jul 28, 2018 at 20:08

1 Answer 1

Reset to default
1

I can’t see any way you could accomplish this without rewriting the OS and security models.

  • The accessing a specific folder will be trivially handled when you encrypt the contents of a folder or file and don’t share the key to unlock the data on APFS. Since you can’t keep the root user from reading a file or folder, and admin user can become root (that’s the definition of Admin user on macOS) therefore anything one admin user can set, another can undo.
  • The prevention of the ability of any admin user to send SIGKILL (or any other interesting IPC commands) to any running process will be problematic technically without modifying the OS itself.

The best you can do is try to rely on Gatekeeper and preventing sudo from your admin user per this very excellent question:

I can’t see a case where you wouldn’t just make the user not an admin and carve out a way they can do whatever admin things you want them to do by granting additional access and just not granting admin status to the users you don’t trust.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .