0

I want to segregate two home folders, /Users/justin and /Users/anotherUser such that one user cannot view the contents of the other.

My first attempt was to change the permissions of group everyone for /Users/justin from "Read only" (default) to "No Access", and similarly for "anotherUser".

after changing permissions of /Users/justin

But "anotherUser" can still read the contents of /Users/justin. I think this is because both users are members of the staff group.

➜  /Users ls -l
total 0
drwxrwxrwt  15 root     wheel   480  2 May 09:51 Shared
drwxr-xr-x+ 14 altuser  staff   448 20 Jun 13:24 altuser
drwxr-x---@ 86 justin   staff  2752 20 Jun 17:56 justin

My understanding is that by default, macOS assigns all users to staff.

How can I segregate the two home folders without removing them from staff? Or is it safe to remove them from staff?

Improve this question
3
  • Please add Terminal output as text by copy/pasting from Terminal, it's much easier to read that way.
    – nohillside ♦
    Jun 20 at 15:47
  • On my Macs, admin users can see a list of the folders inside another user's accounts, but the folders have a 'No entry' sign and cannot be accessed (without modifying the permissions, which, as has been said, can be done by any admin user).
    – benwiggy
    Jun 20 at 16:26
  • Are you removing both users from admin group? If not, they can grant themselves access to any folder that’s not encrypted with a separate key on the file system.
    – bmike ♦
    Jun 20 at 16:27

2 Answers 2

Reset to default
4

By default, almost all the top-level contents of a user folder should already be set this way - they have no group, only owner & everyone. Owner is r/w, everyone is no access.

enter image description here

enter image description here

Just remove the group entirely to restore to defaults.

enter image description here

Of course, as already mentioned - any other admin can undo this. You have no powers as admin that don't also belong to every other admin.

Improve this answer
3

You can remove read access for staff from the home directory by setting it to "No Access" in the Sharing & Permission box (your first screenshot) removing the staff entry (or by running sudo chmod 700 justin altuser in Terminal).

PS: This assumes that neither user is an admin user (because admin users can obviously change it back easily).

Improve this answer
2
  • Thanks. There isn't a "No Access" option for staff group, only read/write, read-only, and "Write only (Drop Box)" (sic). I just removed staff entirely as suggested by Tetsujin. chmod would work too.
    – Justin
    Jun 20 at 17:04
  • @Justin So much for testing an answer before posting it. Indeed, setting it to 0700 removes the staff group in the Info window (but shows everyone as "No Access").
    – nohillside ♦
    Jun 20 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .