The macOS gui, as shown in the attached image, provides a way to add users and user groups to the permissions of a file system directory.

There are also lots of examples of how to create groups from the command line, etc (dscl, and so forth). But I don't see anything on how - from the command line - to add user groups to the permissions of a file system directory.

enter image description here

PS: The answers in How to manage users access to shared folders from the command line? covers network shares, but don't show how to do what the Finder does (on an unshared folder).

  • 1
    The linked question isn't quite a duplicate, and its answer doesn't cover creating ACEs equivalent to the Finder's "Read only" and "Read & Write" entries. Sep 27, 2019 at 6:01
  • @GordonDavisson The question here could be split into two parts: how to create user account in command line, and how to manage user access to a shared folder. Both of them have been asked and answered on the website already. All I could see is a questioner too lazy to use the search bar. You'd better put your answer into the former thread to collection answers together.
    – Simba
    Sep 27, 2019 at 7:55
  • 2
    @Simba I don't see anything in the question about either creating user accounts (it mentions that creating group accounts is already covered) or network-shared folders. The question about shared folders does have some similarity, but you generally want inheritable ACEs in a network share, while this question seems to be mostly about doing the equivalent of what the Finder does (on an unshared folder) -- not the same thing. Sep 27, 2019 at 8:13

1 Answer 1


Yes, you can do it, but it's a bit complicated. Permissions on macOS are rather complex; the Finder hides most of the complexity, but at the command line it's fully exposed and you have to deal with it.

Really short answer: use chmod +a to add access control entries, ls -le to view them, and man chmod and man ls for details.

Longer answer, the practical details: to add (or remove) Read only access for the group mygroup to the folder at /path/to/folder:

chmod +a "group:mygroup allow list,search,readattr,readextattr,readsecurity" /path/to/folder
chmod -a "group:mygroup allow list,search,readattr,readextattr,readsecurity" /path/to/folder

For a file, Read only access would be:

chmod +a "group:mygroup allow read,readattr,readextattr,readsecurity" /path/to/file.txt

To add Read & Write access:

chmod +a "group:mygroup allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity" /path/to/folder

and for a file:

chmod +a "group:mygroup allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity" /path/to/file.txt

To examine these ACLs and check your work:

ls -le /path/to/file.txt

Advanced usage: you can use chmod =a# to rewrite the numbered rule instead of adding or removing entries.

To just remove an entry of the ACL, you can use chmod -a# followed by the entry number (you can see the numbers in the ls -le output). This wipes that entire entry like the "-" control does in the GUI.

Longer answer, the theory: macOS has two different types of file permissions: standard POSIX (unix-like) permissions, and access control lists (ACLs) consisting of one or more access control entries (ACEs). All files and folders have POSIX permissions, consisting of one user (the owner), one group, and everyone else, and for each of those some combination of read, write, and execute (don't ask) access. They can (but usually don't) have a list of ACEs that allow (or deny, but don't worry about that) access to additional users and/or groups, and have much more detailed control over what access is being allowed (/denied).

The Finder hides the distinction between POSIX permissions and ACEs, but anytime you have more than one user or group, the additional ones are ACEs. So to add access for another group, you need to add an ACE. chmod +a does this. You also need to specify a full list of types of read and/or write (or other) access are being granted. The Finder's idea of "Read only" access corresponds to read,readattr,readextattr,readsecurity, and its "Read & Write" access corresponds to read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity.

  • Imo, the detail supplied by @gordondavisson is excellent; any suggestions for references that make this kind of info easy to understand would be appreciated. As I recall, the O'Reilly books and similar on macOS that I've seen don't go into that much detail. Sep 28, 2019 at 0:49
  • 1
    @christopherbalz Unfortunately, I don't know of any good references on this. A lot of what I know about it came from experimenting with it. Sep 28, 2019 at 1:59
  • 1
    @christopherbalz man chmod combined with using ls -le to see which permissions Finder assigns is a good way to start. For ACL in general googling "macOS ACL" will give you some pointers for further research (I didn't find the mother of all references on this though)
    – nohillside
    Sep 28, 2019 at 8:06
  • This seems to work very well, except for items inside /System/Applications -- asked about a workaround in this new question: apple.stackexchange.com/questions/442881/…
    – brahn
    Jun 23, 2022 at 19:24
  • +1 : I like the concept of have different-lengthed answers into one. Suggestions : make the shortest answer a TL; DR; combine the medium (containing examples) and the long (containing more explanations) answers in a main one. ;)
    – Thinkr
    May 22, 2023 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .