1

The macOS gui, as shown in the attached image, provides a way to add users and user groups to the permissions of a file system directory.

There are also lots of examples of how to create groups from the command line, etc (dscl, and so forth). But I don't see anything on how - from the command line - to add user groups to the permissions of a file system directory.

enter image description here

PS: The answers in How to manage users access to shared folders from the command line? covers network shares, but don't show how to do what the Finder does (on an unshared folder).

  • 1
    The linked question isn't quite a duplicate, and its answer doesn't cover creating ACEs equivalent to the Finder's "Read only" and "Read & Write" entries. – Gordon Davisson Sep 27 at 6:01
  • @GordonDavisson The question here could be split into two parts: how to create user account in command line, and how to manage user access to a shared folder. Both of them have been asked and answered on the website already. All I could see is a questioner too lazy to use the search bar. You'd better put your answer into the former thread to collection answers together. – Simba Sep 27 at 7:55
  • 2
    @Simba I don't see anything in the question about either creating user accounts (it mentions that creating group accounts is already covered) or network-shared folders. The question about shared folders does have some similarity, but you generally want inheritable ACEs in a network share, while this question seems to be mostly about doing the equivalent of what the Finder does (on an unshared folder) -- not the same thing. – Gordon Davisson Sep 27 at 8:13
5

Yes, you can do it, but it's a bit complicated. Permissions on macOS are rather complex; the Finder hides most of the complexity, but at the command line it's fully exposed and you have to deal with it.

Really short answer: use chmod +a to add access control entries, ls -le to view them, and man chmod and man ls for details.

Medium-length answer: to add (or remove) Read only access for the group mygroup to the folder at /path/to/folder:

chmod +a "group:mygroup allow list,search,readattr,readextattr,readsecurity" /path/to/folder
chmod -a "group:mygroup allow list,search,readattr,readextattr,readsecurity" /path/to/folder

For a file, Read only access would be:

chmod +a "group:mygroup allow read,readattr,readextattr,readsecurity" /path/to/file.txt

To add Read & Write access:

chmod +a "group:mygroup allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity" /path/to/folder

and for a file:

chmod +a "group:mygroup allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity" /path/to/file.txt

To examine these ACL and check your work:

ls -le /path/to/file.txt

Advanced usage you can call chmod =a# will rewrite the numbered rule instead of add or remove granularly the permissions.

To just remove an entry of the ACL chmod -a# wipes that entire entry like the - control does in the GUI.

Long answer: macOS has two different types of file permissions: standard POSIX (unix-like) permissions, and access control lists (ACLs) consisting of one or more access control entries (ACEs). All files and folders have POSIX permissions, consisting of one user (the owner), one group, and everyone else, and for each of those some combination of read, write, and execute (don't ask) access. They can (but usually don't) have a list of ACEs that allow (or deny, but don't worry about that) access to additional users and/or groups, and have much more detailed control over what access is being allowed (/denied).

The Finder hides the distinction between POSIX permissions and ACEs, but anytime you have more than one user or group, the additional ones are ACEs. So to add access for another group, you need to add an ACE. chmod +a does this. You also need to specify a full list of types of read and/or write (or other) access are being granted. The Finder's idea of "Read only" access corresponds to read,readattr,readextattr,readsecurity, and its "Read & Write" access corresponds to read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity.

  • Imo, the detail supplied by @gordondavisson is excellent; any suggestions for references that make this kind of info easy to understand would be appreciated. As I recall, the O'Reilly books and similar on macOS that I've seen don't go into that much detail. – christopherbalz Sep 28 at 0:49
  • 1
    @christopherbalz Unfortunately, I don't know of any good references on this. A lot of what I know about it came from experimenting with it. – Gordon Davisson Sep 28 at 1:59
  • 1
    @christopherbalz man chmod combined with using ls -le to see which permissions Finder assigns is a good way to start. For ACL in general googling "macOS ACL" will give you some pointers for further research (I didn't find the mother of all references on this though) – nohillside Sep 28 at 8:06
-2

The info you need are already posted on the site.

  • Answers should be more than just links, and also show how the information found behind the links can be used to actually solve the problem the OP describes. – nohillside Sep 28 at 8:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .