2

Background

I have 3 Macs at home, all running MacOS 13 Ventura. All of these Macs are running on relatively new computers but the systems have been passed on via Migration Assistant/Time Machine backups since the beginning of the ~2010s (OSX Snow Leopard & Lion).

I recently discovered the user permissions on these Macs probably are wrong (i.e they are not the default permissions). I'm not sure why that is, but it may be that I changed things due to ignorance far back in the past, or migrations, etc, may have altered things.

Rationale: I'm concerned for security & functional reasons even though I am currently unaware of direct issues with these Macs due to my permissions.

NB: I did recently have File Sharing problems in Ventura 13 which was previously mentioned in this question, but was a SMB bug now resolved with Ventura 13.3 (source).

Question

Should I, and if so, how can I restore or apply Apple default user permissions, without having to erase my systems and recreate them from scratch? (Assuming that this is a good idea?)

SIP is activated, and as mentioned I am running the latest MacOS version as of February, 2023 – therefore many old Ask Different answers may not apply.

Additional info

On one of my Macs, I created a new administrator user (named test) to see what the default permissions are for common Home folders. WARNING: I can't guarantee that these are correct for an entirely fresh system, this is just what I happen to see on a new user on a non-factory restored Mac – please do not attempt to replicate:

  • Mac #1
    • test (New test user):
      • ~ (Home folder test)
        • test (me): Read & Write
        • staff: Read only
        • everyone: No Access
      • ~/Desktop, ~/Documents, ~/Downloads, ~/Library:
        • test (me): Read & Write
        • everyone: No Access
      • ~/Library:
        • test (me): Read & Write
        • everyone: No Access
      • ~/Public:
        • test (me): Read & Write
        • staff: Read only
        • everyone: Read only
      • Macintosh HD/Applications
        • system: Read & Write
        • admin: Read & Write
        • everyone: Read only
        • NOTE: These Applications groups look strange to me. Since they are shared by all users on the computer it's possible that they aren't the default Apple permissions. My other Mac does instead of system: Read & Write and admin: Read & Write, have user (me): Read & Write and staff: Read only.


Following are settings on my actively in-use accounts on my Macs.

Noteworthy: in some folders I see peculiar users called: com.apple.sharepoint.group.1 com.apple.sharepoint.group.2, com.apple.sharepoint.group.3, and Fetching… (a spinning wait cursor and contents that don't load) – these have "Custom" permissions!

  • Mac #1

    • user (Old user):
      • ~ (Home folder user)
        • user (me): Read & Write
        • staff: Read only
        • everyone: Read only (No Access on test)
      • ~/Desktop, ~/Documents, ~/Downloads
        • user (me): Read & Write
        • everyone: Read only (No Access on test)
      • ~/Library:
        • user (me): Read & Write
        • everyone: No Access
      • ~/Public:
        • user (me): Read & Write
        • staff: Does not exist at all (staff: Read only on test)
        • everyone: Read only
      • Macintosh HD/Applications
        • system: Read & Write
        • admin: Read & Write
        • everyone: Read only

  • Mac #2

    • user (Old user):
      • ~ (Home folder user)
        • user (me): Read & Write
        • staff: Read only
        • everyone: Read only (No Access on test)
      • ~/Desktop, ~/Documents, ~/Downloads
        • user (me): Read & Write
        • staff: Read only (staff does not exist here on test)
        • everyone: Read only (No Access on test)
      • ~/Library:
        • user (me): Read & Write
        • everyone: No Access
      • ~/Public:
        • com.apple.sharepoint.group.1: Custom (I don't know what this is!)
        • user (me): Read & Write
        • staff: Does not exist at all (staff: Read only on test)
        • everyone: No Access (Read only on test)
      • Macintosh HD/Applications
        • system: Read & Write
        • admin: Read & Write
        • everyone: Read only

  • Mac #3

    • user (Old user):
      • ~ (Home folder user)
        • com.apple.sharepoint.group.2: Custom (I don't know what this is!)
        • Fetching…: Custom (I don't know what this is. Doesn't load properly – shows a spinning wait cursor!)
        • user (me): Read & Write
        • staff: Does not exist at all (staff: Read only on test)
        • everyone: No Access
      • ~/Desktop, ~/Documents, ~/Downloads
        • user (me): Read & Write
        • everyone: Read only (No Access on test)
      • ~/Library:
        • user (me): Read & Write
        • everyone: No Access
      • ~/Public:
        • user (me): Read & Write
        • staff: Does not exist at all (staff: Read only on test)
        • everyone: Read only
      • Macintosh HD/Applications
        • user (me): Read & Write (Does not exist on test. system: Read only exists instead)
        • staff: Read only (Does not exist on test. admin: Read only exists instead)
        • everyone: Read only

Edit: More Additional info

Some additional information after the original post.

On "Mac #3" above, when attempting to share my Home (~) folder specifically (System Settings > Sharing > File Sharing > ℹ️ > Shared Folders), I see the following:

  • Unknown User: Custom
  • Unknown User: Custom
  • Unknown User: Custom
  • Unknown User: Custom
  • My user (me): Read & Write
  • Everyone: No Access

Related to the "Unknown Users" is probably the endlessly spinning wait cursor for the "Get Info" permissions on the Home (~) folder [my user is truncated from the screenshot, but it has Read & Write, and Everyone has No Access]:

enter image description here

If I try to share the ~/Downloads folder specifically, I instead see this in File Sharing:

  • Downloads: Custom
  • Discord Data: Custom ("Discord Data" is a folder in Downloads)
  • Downloads: Custom
  • Downloads: Custom
  • My user (me): Read & Write
  • Everyone: No Access

And the Get Info permissions below [my user is truncated from the screenshot, but it has Read & Write, and Everyone has No Access]:

enter image description here

Improve this question
11
  • 1
    This statement stands out as most important (IMO): the user permissions on these Macs probably are wrong. "Probably wrong?" How did you determine they are "wrong" to begin with? Second most, the disclaimer you make, I can't guarantee that these are correct for... is very concerning! If you want to change permissions across several Mac computers and you're not certain if there's actually a bona fide problem, you could err here and break things quite epically. Have you tried running Disk Utility First Aid, first?
    – Allan
    Feb 21 at 17:06
  • @Allan Not following your logic. They are probably wrong because they likely do not conform to what defaults are, which is a reasonable suspicion. I did not say that they are wrong. Guidance on what to do is what I'm seeking from Ask Different. I inserted a disclaimer because I do not want other users to replicate my settings, the purpose of which is the opposite of creating concern.
    – P A N
    Feb 21 at 17:14
  • @Allan I am aware that changing things without bona fide problem is problematic, however, there is a File Sharing issue as described. I've run Disk Utility First Aid, and it did not mention anything about system permission errors.
    – P A N
    Feb 21 at 17:14
  • That "file sharing issue" is likely not related to permissions. The "spinning wheel" is called a wait cursor. If you're getting this, it means that something isn't responding. If it were a permission issue, you'd be able to see the file, but not write to it (with Read Only access, for example). This is definately an XY Problem
    – Allan
    Feb 21 at 17:41
  • @Allan It may be an "XY Problem", but why is it "definitely" an XY Problem and not an actual issue e.g. wrt permission security? Put differently: if you look at the user permissions I've described – do they look feasibly correct to you? That must be the case, because if they are visibly incorrect/unsafe/likely to cause issues, etc, then I think it is misleading for you to suggest to otherwise. I would appreciate technical clarity on this issue before questioning the issue on philosophical basis.
    – P A N
    Feb 21 at 17:49

1 Answer 1

Reset to default
0

This answer is pointers, not a detailed solution, to resetting permissions.

Howard Oakley (Electic Light Company) has, at least twice, discussed the mysteries of resetting home folder permissions:

Some years old, but essential reading: Something odd you can’t fix? Sierra re-introduces repairing permissions

More recent: Repairing Home folder permissions: a mystery

Why 'mystery'? Because this is not properly documented by Apple and uses commands not mentioned in any man page.

Try using diskutil resetUserPermissions which will give your brief usage instructions. Also the Recovery mode command repairHomePermissions. Both are undocumented and there is some uncertainly regarding exactly what they change!

I have not used either of these and, if you do, make sure you have a backup and recovery plan in case of disaster.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .