1

I have read somewhere macOS is rootless. That means we can put some restrictions so far that even root can't access to some system folders.

I would like to apply this restriction to my Desktop folder.

I want to be sure root won't access to this folder and I want to be sure root won't be able to write into user TCC database too.

I would like that the only way for root to access my Desktop folder is to reboot the Mac in recovery mode, disable SIP and add rules into TCC database.

Do you think mac os is designed to do something like that?

2
  • 2
    “Rootless” is not what you think it is. See this excellent answer for a full explanation. If you want to properly prevent access, you need to encrypt things. You can create a password encrypted DMG preventing anyone from accessing the data.
    – Allan
    Commented Aug 22, 2023 at 10:53
  • We really need to know: are you the only user of your Mac? Or are there other users, with other accounts?
    – benwiggy
    Commented Aug 23, 2023 at 18:28

1 Answer 1

1

Admin users can always use sudo/su to get access to any user data, rootless doesn't help you here.

If you want to prevent access by others, use an encrypted DMG. But even those need to be mounted to be useable, and any admin user can access your mounted devices.

So, as long as you share your Mac with other people and some of those have Admin rights, you can't prevent them from accessing your data while you use the computer. OTOH, if you are the only user anyway, you don't need additional protection from root.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .