3

I want to create a standard (non-administrator) user on my Mac, and ensure that they cannot access my files.

Does the following make sense, and will there be any adverse consequences?

sudo launchctl config user umask 077 (when creating new files and folders, ensure group and others can't see them)

chmod -R go-rwx ~ (for existing files and folders in my home folder: remove read, write and execute permissions for group and others)

In particular, I'm worried about:

  1. Messing up any extended permissions
  2. Whether it's OK to alter permissions on my ~/Library and ~/Applications and ~/Applications (Parallels) and ~/tmp folders
  3. Is there anything outside of my home folder I need to think about protecting?

Is there anything I'm missing, before I try this and potentially brick my system?

I'm actually shocked that what I've described above is not the default configuration for MacOS, as it would prevent different users from seeing each others' files.

Improve this question
4
  • 1
    something happened on your Mac. The default configuration needs no change to isolate accounts. It might be quicker to get your Mac back to standard than try to special case customize a special case non standard setup.
    – bmike ♦
    Commented Aug 2, 2019 at 11:16
  • @bmike MacOS sets a default umask of 0022, which means that the default configuration will result in new folders created in the home folder being assigned the 744 permission. As far as I know, I've not changed the default configuration.
    – Andrew Parks
    Commented Aug 2, 2019 at 12:13
  • The only two group/all readable files are .DS_Store and ~/Public - the rest are denied. Try running ls -laeO@ /Users/*/Desktop as any user - admin or non-admin on a Mac with three users. Then repeat with sudo from an admin account.
    – bmike ♦
    Commented Aug 2, 2019 at 13:40
  • @bmike Thanks yes I agree you're right about the default configuration isolating accounts if no new folders are created in the home folder. My specific problem was that I did create additional folders in my home folder, and those permissions, by default, give other users access.
    – Andrew Parks
    Commented Aug 2, 2019 at 14:11

1 Answer 1

Reset to default
3

macOS by default sets the permission on the standard directories (Documents, Pictures, Music, Library etc) to 0700. If this somehow got changed you can easily run

chmod 0700 ~/{Documents,Pictures,Music,Library,Downloads,Movies}

to fix it. And of course you can use the same command to change the access rights for other directories as needed.

To also protect any dot files etc you can also run

 chmod 0700 ~.

In any case you don't need to specially treat subfolders if the parent folder is already protected.

Improve this answer
4
  • Is this correct: What if I do nothing except for just chmod 0700 ~ Can you say with certainty that then even if all file and directory permissions inside my home folder were 777, all files inside my home folder would be completely unreadable to other users? This might solve the problem far more elegantly, at the slight downside of not being able to use the Public folder for its intended purpose (I don't use it anyway).
    – Andrew Parks
    Commented Aug 2, 2019 at 12:59
  • @AndrewParks That's how Unix permissions work, yes. The only files still accessible are files which are hard-linked (ln foo bar) to a place outside of ~. But by default there ain't any of those.
    – nohillside ♦
    Commented Aug 2, 2019 at 13:10
  • @AndrewParks But if you are looking for special protection you may want to investigate encrypted DMGs or similar, or using ACLs in addition to standard Unix permissions.
    – nohillside ♦
    Commented Aug 2, 2019 at 13:11
  • Perfect, thank you! (I'd upvote, but my rep is too low)
    – Andrew Parks
    Commented Aug 2, 2019 at 13:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .