2

Recently I bought the MacBook Air M1. I have created two accounts. Laptop will be used by two different persons. Both users have administrative permissions.

I have been wondering if that setup will provide privacy.

  1. Is it possible that another user can easily read the files from the other user?
  2. Does the user have an access to iCloud files?
  3. What about bookmarks and tabs from Safari?

Is there a list of areas that are compromised with usage of root rights?

3
  • It would be helpful if the answers addressed how this info changes with the switch to Apple Silicon. It does at least make it more of a challenge to compromise these things. Commented Aug 4, 2021 at 1:15
  • @MatthewElvey-RNSTTIVERMECTIN How does it do that? For a normal user the machine is very much like an Intel one.
    – mmmmmm
    Commented Aug 4, 2021 at 5:48
  • @MatthewElvey-RNSTTIVERMECTIN The answers apply equally to both Intel and Apple Silicon.
    – Gilby
    Commented Aug 4, 2021 at 6:01

3 Answers 3

4

The purpose of the administrator privilege is to allow full control of the Mac. And part of full control is to have access to very nearly everything.

Access to the other user's files may require a little more than browsing in Finder as many folders have (e.g. ~/Documents) have permissions which allow access only to the owner. But any user with basic knowledge of Terminal commands can overcome such simple obstacles.

Of your specific questions, iCloud is the only one with some protection. iCloud files which are not currently synchronised with the Mac, will not be accessible.

If you are to have two administrators, they must trust each other not to go rummaging through each others private files. And they will need some care and understanding to make sure that performing administrative tasks does not effect the other's use for the computer.

If there is not full trust, I would advise not keeping any personal files on the computer without some additional protection. As examples of protection:

  • Keep private files in a password protected disk image.
  • Keep private files in an encrypted external disk which is always removed when not in use.

But even then, a more skilled administrator would be able to install software to capture files when the other user is using them.

2

No, that setup will not provide any privacy. In order to enforce any isolation between user accounts, they must not be given administrator privileges.

Any user that is an administrator can easily read the files from any other user. They have access to the "sudo" command, that gives "root" privileges in the underlying Unix system. They have the ability to change the login password of other users. This would enable them to log in as the other user, and see their Safari bookmarks or saved tabs, or any other file or information, provided it is not protected by encryption based on a password separate from the login password, such as an encrypted disk image.

If iCloud is already enabled and the computer is a "trusted device" for things like Contacts, Calendars, etc., or iCloud Drive for other apps like Pages or non-Apple apps, then by logging in to the computer as that user, another user could access those iCloud files. Furthermore, they might have access to the user's e-mail if they use Apple Mail or some other e-mail app on the computer that stores the e-mail password. In that case they may be able to log in directly to icloud.com or appleid.apple.com by changing the iCloud/Apple ID password.

Some of this information could be accessed without the other user noticing. In other cases, the user would notice their passwords being changed. It is not possible to find out what a user's login password is, only to change it.

2

This is a very subjective question, since you didn't outline your threat model. Are you worried about a dedicated trained unix expert with time on their hands?

  • giving them an admin account might save them some time, but most good blue team / red team / white hat hackers can escalate privileges on a consumer machine - macOS or Windows or unix.
  • in this scenario, you're not very secure if they can decrypt the drive contents.

Are you worried about a casual "non-expert" that only has the machine for a few hours or is supervised?

  • your risk is much lower, but it would be better to give them a non-admin account

Are you worried about someone deleting files or granting them access to the other user?

  • take away admin from anyone you don't trust

Anyone that can read the data on the system can get to all files to read them with admin password, so you want to deny that and/or use second level encryption if you don't use FileVault to protect all local copies of cloud files, all local files and prevent forensic analysis of all files on the Mac. Any admin credentials are root so you're done if you hand that over to anyone with skill and 5 minutes to get to work.

Good or bad, isn't really useful since the system is designed to allow the administrator to manage the entire OS and all file permission changes. You want different tools to separate data than accounts on macOS.

4
  • 3
    "most good blue team / red team / white hat hackers can escalate privileges on a consumer machine" Citation needed
    – Manchineel
    Commented Aug 4, 2021 at 9:24
  • Are you encouraged or discouraged by my generalization @Manchineel
    – bmike
    Commented Aug 4, 2021 at 10:12
  • I mean, privilege escalation shouldn't be possible on modern macOS, GNU/Linux or Windows, provided that sudo passwords/UAC are enabled and the system is up-to-date. Unless it's a targeted million-dollar attack by a Government or something, and assuming that the administrator follows good security practices, I doubt it will be easy to gain root/system access even on a consumer OS without accessing the filesystem externally, and booting the system from an external drive is not possible by default on modern Macs, barring T2 vulnerabilities on Intel systems and Thunderbolt if the Mac has Bootcamp.
    – Manchineel
    Commented Aug 4, 2021 at 15:58
  • Specifically, critical Thunderbolt 3 CVEs are patched when running macOS but remain exploitable when the Mac is running Windows, or on some Windows PCs if the firmware is unpatched or no fix has been provided by the OEM. All in all, very expensive attacks to pull off. The most feasible ones target the T2 chip of the Mac, but to my understanding the FileVault security model stays uncompromised and in addition new M1 Macs don't even have T2 in the first place.
    – Manchineel
    Commented Aug 4, 2021 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .