#Setting permissions on mac os x full
#Setting permissions on mac os x series

This first '0' is not too important for everyday tasks (and we'll ignore it here), but the next three values, '022,' are the permissions mask for the owner, group, and everyone else, respectively.Д«eing a mask, these values do not represent the permissions level, but instead are simply subtracted from the initial full-access permissions level (level 7) to result in the default permissions that are ultimately applied to newly created files and folders. If you open the OS X Terminal and run the command 'umask,' you will see an output of the current mask value that likely looks something like '0022.' The first '0' in this mask represents a special permissions value for something called a SetUID, SetGID, and 'sticky' bit, which offer special modes for running executable files. The system then adjusts this behavior by using the umask as a filter to reduce the default mode values from '7' for the owner, group, and everyone else, to a more desired value for security.

#Setting permissions on mac os x full

When you create a file or folder in OS X, the system initially does not know what permissions it should set, so it attempts to apply full read, write, and execute access (number 7 shown above), for the user, the group, and everyone else. While chmod is useful for changing existing permissions, what sets up the initial and default permissions that the system applies to new files? That is where the umask comes in.

#Setting permissions on mac os x series

In the 'MODE' for the chmod command, these numbers are applied in a series of three consecutive values, with the first value representing the permissions for the user, the second for the group, and the third for all others (everyone), such as the following to make a file called 'test.txt' fully accessible (7) by the owner, read only (4) by the group, and no access (0) by all others: Classically, this is represented by numbers between 0 and 7, which mean the following: In this command, the 'TARGET' is the desired file or folder, and the MODE is one of a number of approaches for setting the permissions for the owner, the group, and everyone else. The chmod command is run in the following way: In Unix systems, a commonly used command-line tool is 'chmod,' which stands for 'Change Mode' and applies permissions settings to targeted files and folders. The permissions for the staff (group) and Everyone entries in a new folder are equivalent to level '4,' which gives them only write access (and executable access, which is not shown in the Finder's permissions list). To understand how the umask works, first consider the standard permissions modes for files and folders in OS X. When you create any file or folder in OS X, it will have a default set of permissions that give it a certain level of access by the owner, the default group (from the account that created it), and then 'everyone else.' This default permissions setup is determined by something called a 'umask,' which applies a special permissions filter to files when they are created. If used correctly, permissions can isolate secure areas such as user home folders, or have areas like system folders that are read-only, so the operating system can be accessed but not easily tampered with.

So why does this happen?Д®very file and folder in OS X has permissions associated with it that allow the system to grant or deny access to specific users and groups. However, while it may seem odd, this behavior seen is, in fact, normal, given both the way that permissions are set up in the user account and how the system applies default permissions to files and folders. It's true that, by default, the contents of accounts in OS X should be kept secure from other users. It's strange that folders I created in my Home folder should be visible to others.' The Sites folder here is fully readable by any account, even though it may not have been intended this way by the owner of the account (click for larger view). She can just open the Finder, go to Macbook/Users/, pick my name and see what's in there.

I obviously expect my files to be hidden for her, but that is not the case. This may be concerning to some people, as outlined recently in an e-mail to me by MacFixIt reader Patrick: 'I am admin on my Mac it runs under OS 10.6.8 Snow Leopard, and I just created a user account for my girlfriend. The home folder in an OS X account is intended to be off limits to all but the owner of the home folder however, if you create a new directory immediately within your home folder, and not in any of the default subdirectories, you will find that other user accounts can peruse the contents of this new directory.