1

(This is just experimenting for educational purposes.)

I'm the admin of the computer and I have SIP disabled. I wish to imitate iOS restrictions on macOS by prohibiting access (to one other specific user account, not me) to all directories except for 'Downloads' of their equivalent 'Users' folder.

Yes, the apps they launch can freely read/write from/to 'Library' and other system-related files as they normally would, but the user just never gets to access those directories (pretty much like iOS minus the sandboxed app-data)

When using Finder (or any other file browser) they can only access their Downloads folder.

Managing their system (installing/uninstalling apps etc.) is of lesser importance as I, the admin, can do it for them when asked.

I think I can implement this by applying a 'No Access' rule to their user account for all directories, which attaches a red flag icon to the folder and does not allow one to access it when clicked.

Instead of going through every single folder to do this with cmd+I, can I do this with Terminal for all directories minus 'Downloads'?

Improve this question
10
  • You'll have to disable permissions for the current user. Using Terminal with the chmod command. It would mean doing something like chmod u-rw Documents Music Pictures Movies <any-folder>. The u-rwx tells the command to remove read/write/execute access to the directory only for the user. To add back any specific permission for the user, you would use chmod u+... where ... is among r w x. Does it help ? More on permissions and groups
    – Jeffrey Mvutu Mabilama
    Commented Dec 25, 2020 at 16:54
  • Thanks for your response. Ok, so I just opened Terminal from my admin account, and the user account I'm talking about is: testuser01. What is the exact command(s) I need to type, in order to achieve what I asked for in the OP?
    – alaska_penguin_9898
    Commented Dec 25, 2020 at 17:02
  • man chmod might be helpful here.
    – nohillside ♦
    Commented Dec 25, 2020 at 17:11
  • Do you mean you also want to forbid read access to default directories outside of the user's folder (for instance denying reading /System) ? That might prove impossible (unless it causes glitches to the whole system). Also, what about folders created after the initial configuration by 3rd party programs, such as hidden folders (like ~/.dropbox for instance) ? changing their permissions would require work after the initial config. Is that also part of what you want ? (otherwise the user could still Cmd+Maj+. to show hidden stuffs.
    – Jeffrey Mvutu Mabilama
    Commented Dec 25, 2020 at 17:37
  • 1
    @sfxedit Initially inspired by a relative who asked me if I could bring a completely minimalist/iOS feel to their Mac, by utilizing Launchpad/Dock as the only way to launch apps (a la iPhone home screen) and then when browsing for files, the Finder only shows the Downloads folder. (exactly like on iOS) Simple Finder could kinda achieve that but it takes away several other useful features that the regular Finder offers. Again, as stated it's all theoretical/experimental.
    – alaska_penguin_9898
    Commented Dec 25, 2020 at 19:45

1 Answer 1

Reset to default
1

Any access on macOS is running with the credentials of the user owning a process, so you can't prohibit user access to e.g. ~/Documents or ~/Library while still allowing applications started by the same user from accessing content stored there. I've never tried but removing user access from ~/Library most likely will even prevent the user from logging in (in a probably unpleasant way).

This is vastly different from sandboxing on iOS where each app basically has it's own sandboxed space within the filesystem (which ensures that app A can't access data of app B unless both are coded specifically to support this) and where app-specific preferences etc are stored within the sandbox itself.

Improve this answer
4
  • I see, so basically if I need to read/write in it (through normal app usage etc.), that automatically means I can browse and have access to it through a file browser. I cannot imitate iOS reading/writing to files/directories that one cannot browse/look into (whether sandboxed or not)?
    – alaska_penguin_9898
    Commented Dec 25, 2020 at 19:32
  • @alaska_penguin_9898 You can't imitate iOS sandboxing. You can prevent users from accessing certain folders but then it applies to any kind of access.
    – nohillside ♦
    Commented Dec 25, 2020 at 19:47
  • Thank you, that was very informative. Off the top of your head, can you think of any other solution, (other than the file permissions approach that I thought of)? Simple Finder could achive that to a certain extent, but even that feature was discontinued as of macOS Catalina iirc.
    – alaska_penguin_9898
    Commented Dec 30, 2020 at 12:53
  • @alaska_penguin_9898 Even Simple Finder can‘t stop you from accessing whatever you want via the applications you are allowed to run.
    – nohillside ♦
    Commented Dec 30, 2020 at 13:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .