Is there any way to block access to some particular file or folder in MacOS X, so that it can be protected by password?
Add a comment
|
4 Answers
Not directly - you have to use an app that accesses the file (e.g. a secure note in 1password or a program like gpg or your own app that encrypts/decrypts a file ) or put the file on an encrypted file system (create using Disk Utility or TrueCrypt etc.) See this question for some ways of encrypting.
-
Thanks. Quite interesting idea with encrypted DMG image. And what do you mean by using an app that accesses the file?– BartoNazApr 28, 2012 at 23:17
-
And just thinking about other possible options: Is it possible to make something like autorun file or another way to notificate my running program about opening some particular folder or file, so that it will not open directly but will be validated by this running program first?– BartoNazApr 28, 2012 at 23:21
-
@BartoNaz not for the second as the low level file open will open the file and then your program will be notified.– mmmmmmApr 28, 2012 at 23:44
-
Till now the best solution which I have found is to use
hdiutilorDiskUtilityto create password encrypted sparse disk with contents of a folder. Then it will behave in many senses as a regular folder but will be definitely protected.– BartoNazApr 30, 2012 at 18:10
Yes and no.
If you want a file to be unreadable by a user without administrator privileges, you can Get Info for that file in the Finder. On the bottom of the information pane, there is a Sharing and Permissions section; setting everyone's settings to "No access" will prevent users of the OS from reading the file under normal circumstances.
That said,
anyone with administrator privileges on that system can change the settings back to allowing read access to any user, and
If someone boots from a different boot disk (including the recovery partition in Lion), they can mount the regular filesystem and instruct it to disregard permissions, enabling anyone to read the file.
So it's not super-secure at all, but it is enough to keep nosy regular users without an abundance of technical sophistication out of a file.
Using Terminal you can type the following commands to ensure root only access to the file or folder
chown root /yourfile
chmod 700 /yourfile
This ensures that the file is protected by password. (the root password)
You could do the same with any user. In the following command the "example_user" will have read and right access while nobody else will
chown example_user /yourfile
chmod 700 /yourfile
-
1Your solution is the command-line version of mine, and suffers from the same security flaws. The file is protected by password -- except when it isn't. Boot from a different boot disk (trivially simple under Lion) and mount the main disk checking "Ignore ownership on this volume" and there's no password protecting the file.– Daniel ♦Apr 29, 2012 at 4:57
-
@ DanielLawson In regards to root access it is not quite the same as your answer. As for file protection Apple does not provide true file protection. No OS does. I appreciate your post.– E1SuaveApr 29, 2012 at 5:31
-
@DanielLawson I certainly don't have an issue with being corrected but this is not the first time you seem to take issue with a comment or question I have posted. How might I be more constructive in my posts?– E1SuaveApr 29, 2012 at 5:39
-
I was thinking about this solution also. I created a separate user account with dedicated password and changed the owner of a folder to this user. But the problem is for not in security. That is not so important for me. I care more about usability. When you have folder which has different owner, you can't access it until you login in that account, right? So you can't just have a dialog box where you put your password, and get full access.– BartoNazApr 29, 2012 at 8:14
-
@E1Suave I had to look this up, because I didn't notice a connection. Are you referring to your meta post? If so these are two completely separate things. In this case here, you have a good answer, but it has a security hole the OP should be aware of, so I commented. No advice; that just happens sometimes. In the case of the meta posts, my only advice is that you haven't been here two weeks yet; please participate, but see how things work for a while before suggesting we impose a new requirement on all posts that would either be technically infeasible or draconian to actually implement.– Daniel ♦Apr 29, 2012 at 12:48
You can make the file SIP-protected with
xattr -w com.apple.rootless (file)
That prevents any change until you reverse it with -d instead of -w
But it is still readable unless you first use chmod 000 (file)
Doing it on a directory protects the whole directory.
Another way is to active Apache, put the file in /Library/Webserver/Documents, make it accessible only to user https, and protect it with .htpasswd
