By default, it seems that all new "Standard" accounts are added to the staff group. Can I create a new account that is not a member of staff and is not a "Sharing Only" account?
I am using Ventura 13.2
I would like this account to be able to read and execute only the files that I explicitly allow them to, so I don't want them to be in the staff group
There are a couple ways to achieve this:
Using ‘chmod’ and
chown, you set custom file permissions for a single file or a group of files . To set the file
foo.bar to read, write, execute for the owner; read and execute for both group and others (everyone else), you would issue the following command:
% chmod 755 foo.bar
To make it recursive, you'd add a
chmod -r 755 foo.bar.
Alternatively, you can set the permissions via the GUI by selecting the file and pressing ⌘ CommandI then selecting the permissions for the appropriate user/group. See below.
If you want to change ownership (user and/or group) of the file, you can do this as well:
% chown user:group foo.bar
Here is where you can gain some flexibility by creating a new group (i.e. sales or support). From here you can remove the "Staff" group and have the file(s) and/or folders (recursively) owned by a different entity. You can even create a group and add a deny privilege (takes precedence over allow) to prevent certain users from accessing the file (i.e. Finance).
By adding users to this group, you can take specify permissions for the file using the commands above, but instead of having the file owned by "Staff", it can be owned by another entity (i.e. Sales). Setting the permission to say 770 will allow full access to the owner and the group's memeber, but nothing to anyone else. For example:
% chown myname:sales foo.bar
% chmod 770 foo.bar
This will give ownership to the user designated by
myname, and the
sales group with full permissions for both respectively, but for the
other group, which includes
staff, there will be no rights.