0

By default, it seems that all new "Standard" accounts are added to the staff group. Can I create a new account that is not a member of staff and is not a "Sharing Only" account?

I am using Ventura 13.2

2
  • What is the purpose f this user profile? What are you trying to accomplish?
    – Allan
    Mar 6, 2023 at 16:11
  • @Allan By default, it appears that folders created by the admin account are readable and executable by any account in the "staff" group. I would like this account to be able to read and execute only the files that I explicitly allow them to, so I don't want them to be in the staff group.
    – mushroom
    Mar 6, 2023 at 16:20

1 Answer 1

1

I would like this account to be able to read and execute only the files that I explicitly allow them to, so I don't want them to be in the staff group

There are a couple ways to achieve this:

  • set the permissions of the file manually
  • Create another group and set custom permissions based on membership

Set the permissions manually

Using ‘chmod’ and chown, you set custom file permissions for a single file or a group of files . To set the file foo.bar to read, write, execute for the owner; read and execute for both group and others (everyone else), you would issue the following command:

 % chmod 755 foo.bar        

To make it recursive, you'd add a -r flag: chmod -r 755 foo.bar.

Alternatively, you can set the permissions via the GUI by selecting the file and pressing ⌘ CommandI then selecting the permissions for the appropriate user/group. See below.

Get Info Dialog for foo.bar

If you want to change ownership (user and/or group) of the file, you can do this as well:

% chown user:group foo.bar

Create a New Group

Here is where you can gain some flexibility by creating a new group (i.e. sales or support). From here you can remove the "Staff" group and have the file(s) and/or folders (recursively) owned by a different entity. You can even create a group and add a deny privilege (takes precedence over allow) to prevent certain users from accessing the file (i.e. Finance).

By adding users to this group, you can take specify permissions for the file using the commands above, but instead of having the file owned by "Staff", it can be owned by another entity (i.e. Sales). Setting the permission to say 770 will allow full access to the owner and the group's memeber, but nothing to anyone else. For example:

% chown myname:sales foo.bar

% chmod 770 foo.bar

This will give ownership to the user designated by myname, and the sales group with full permissions for both respectively, but for the other group, which includes staff, there will be no rights.

1
  • Thanks for this thorough and thoughtful answer. "From here you can remove the "Staff" group and have the file(s) and/or folders (recursively)", how is this done? I asked this question before apple.stackexchange.com/questions/456659/… Do you know if there is a simple way to specify the group membership at account creation time so the new account is not in staff?
    – mushroom
    Mar 8, 2023 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .