I use keepassXC on mac for my password manager. I use the keyfile feature with it, which requires a keepassxc created keyfile to be read in order for the database to be unlocked (veracrypt utilizes the same feature). What I am trying to accomplish is something mildly similar to my .ssh folder protection permissions on Mac OS. I would like to set permissions and ACL’s of the keepassxc keyfile so that the following rules are applied:

  1. The file cannot be read or written to by any entity unless the following conditions are met:

    a. The Entity trying to read the file is KeepassXC for Mac OS.

    b. The Entity using and running KeepassXC is me (my user) on Mac OS.

  2. The file can not be read or written to by any entity including root, unless the above conditions are met.

Does anyone who understands permissions and ACL’s know how I could accomplish something like this?

  • Anyone out there? – DanRan Jan 3 at 0:11
  • 3
    You can't restrict access by application using ACLs, they only work on users and groups. Sandboxing might be an option, but this needs to be set up by the application itself. Also I wonder whether there are scenarios/use cases where you want to copy the keepassxc to another place manually or just want macOS to backup the file. – nohillside Feb 12 at 19:27

You must log in to answer this question.

Browse other questions tagged .