Is there any way to block access to some particular file or folder in MacOS X, so that it can be protected by password?

4 Answers 4


Not directly - you have to use an app that accesses the file (e.g. a secure note in 1password or a program like gpg or your own app that encrypts/decrypts a file ) or put the file on an encrypted file system (create using Disk Utility or TrueCrypt etc.) See this question for some ways of encrypting.

  • Thanks. Quite interesting idea with encrypted DMG image. And what do you mean by using an app that accesses the file?
    – BartoNaz
    Commented Apr 28, 2012 at 23:17
  • And just thinking about other possible options: Is it possible to make something like autorun file or another way to notificate my running program about opening some particular folder or file, so that it will not open directly but will be validated by this running program first?
    – BartoNaz
    Commented Apr 28, 2012 at 23:21
  • @BartoNaz not for the second as the low level file open will open the file and then your program will be notified.
    – mmmmmm
    Commented Apr 28, 2012 at 23:44
  • Till now the best solution which I have found is to use hdiutil or DiskUtility to create password encrypted sparse disk with contents of a folder. Then it will behave in many senses as a regular folder but will be definitely protected.
    – BartoNaz
    Commented Apr 30, 2012 at 18:10

Yes and no.

If you want a file to be unreadable by a user without administrator privileges, you can Get Info for that file in the Finder. On the bottom of the information pane, there is a Sharing and Permissions section; setting everyone's settings to "No access" will prevent users of the OS from reading the file under normal circumstances.

That said,

  1. anyone with administrator privileges on that system can change the settings back to allowing read access to any user, and

  2. If someone boots from a different boot disk (including the recovery partition in Lion), they can mount the regular filesystem and instruct it to disregard permissions, enabling anyone to read the file.

So it's not super-secure at all, but it is enough to keep nosy regular users without an abundance of technical sophistication out of a file.


Using Terminal you can type the following commands to ensure root only access to the file or folder

chown root /yourfile
chmod 700 /yourfile

This ensures that the file is protected by password. (the root password)

You could do the same with any user. In the following command the "example_user" will have read and right access while nobody else will

chown example_user /yourfile
chmod 700 /yourfile
  • 1
    Your solution is the command-line version of mine, and suffers from the same security flaws. The file is protected by password -- except when it isn't. Boot from a different boot disk (trivially simple under Lion) and mount the main disk checking "Ignore ownership on this volume" and there's no password protecting the file.
    – Daniel
    Commented Apr 29, 2012 at 4:57
  • @ DanielLawson In regards to root access it is not quite the same as your answer. As for file protection Apple does not provide true file protection. No OS does. I appreciate your post.
    – E1Suave
    Commented Apr 29, 2012 at 5:31
  • @DanielLawson I certainly don't have an issue with being corrected but this is not the first time you seem to take issue with a comment or question I have posted. How might I be more constructive in my posts?
    – E1Suave
    Commented Apr 29, 2012 at 5:39
  • I was thinking about this solution also. I created a separate user account with dedicated password and changed the owner of a folder to this user. But the problem is for not in security. That is not so important for me. I care more about usability. When you have folder which has different owner, you can't access it until you login in that account, right? So you can't just have a dialog box where you put your password, and get full access.
    – BartoNaz
    Commented Apr 29, 2012 at 8:14
  • @E1Suave I had to look this up, because I didn't notice a connection. Are you referring to your meta post? If so these are two completely separate things. In this case here, you have a good answer, but it has a security hole the OP should be aware of, so I commented. No advice; that just happens sometimes. In the case of the meta posts, my only advice is that you haven't been here two weeks yet; please participate, but see how things work for a while before suggesting we impose a new requirement on all posts that would either be technically infeasible or draconian to actually implement.
    – Daniel
    Commented Apr 29, 2012 at 12:48

You can make the file SIP-protected with

xattr -w com.apple.rootless (file)

That prevents any change until you reverse it with -d instead of -w

But it is still readable unless you first use chmod 000 (file)

Doing it on a directory protects the whole directory.

Another way is to active Apache, put the file in /Library/Webserver/Documents, make it accessible only to user https, and protect it with .htpasswd

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .