Mac OS X Security Configuration - Office of Information Technology
Mac OS X Security Configuration - Office of Information Technology
Mac OS X Security Configuration - Office of Information Technology
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
P<strong>OS</strong>IX Permissions OverviewP<strong>OS</strong>IX permissions let you control access to files and folders. Every file or folder hasread, write, and execute permissions defined for three categories <strong>of</strong> users (Owner,Group, and Everyone). You can assign four types <strong>of</strong> standard P<strong>OS</strong>IX permissions:Read&Write, Read Only, Write Only, None.For more information, see “Setting P<strong>OS</strong>IX Permissions” on page 124.ACL Permissions OverviewAn ACL provides an extended set <strong>of</strong> permissions for a file or folder and enables you toset multiple users and groups as owners.An ACL is a list <strong>of</strong> access control entries (ACEs), each specifying the permissions to begranted or denied to a group or user and how these permissions are propagatedthroughout a folder hierarchy.In addition, ACLs are compatible with Windows Server 2003, Windows Server 2008,Windows XP, and Windows Vista, giving you added flexibility in a multiplatformenvironment.ACLs allow you to be more specific than P<strong>OS</strong>IX when granting permissions. Forexample, rather than giving a user full write permission, you can restrict the user to thecreation <strong>of</strong> folders but not files.If a file or folder has no ACEs defined for it, <strong>Mac</strong> <strong>OS</strong> X applies standard P<strong>OS</strong>IXpermissions. If a file or folder has ACEs defined for it, <strong>Mac</strong> <strong>OS</strong> X starts with the first ACEin the ACL and works its way down the list until the requested permission is satisfied ordenied.After evaluating ACEs, <strong>Mac</strong> <strong>OS</strong> X evaluates standard P<strong>OS</strong>IX permissions defined for thefile or folder. Then, based on the evaluation <strong>of</strong> ACL and standard P<strong>OS</strong>IX permissions,<strong>Mac</strong> <strong>OS</strong> X determines what type <strong>of</strong> access a user has to a shared file or folder.For more information, see “Setting ACL Permissions” on page 127.Using Disk Utility to Repair Disk PermissionsInstalling s<strong>of</strong>tware sometimes causes file permissions to become incorrectly set.Incorrect file permissions can create security vulnerabilities. You can use Disk Utility torepair P<strong>OS</strong>IX permissions and minimal ACL permissions.Most s<strong>of</strong>tware you install in <strong>Mac</strong> <strong>OS</strong> X is installed from package (.pkg) files. Each timesomething is installed from a package file, a Bill <strong>of</strong> Materials (.bom) file is created andthe installer database is updated. Each Bill <strong>of</strong> Materials file contains a list <strong>of</strong> filesinstalled by that package, along with the correct permissions for each file.38 Chapter 2 Installing <strong>Mac</strong> <strong>OS</strong> X
Change language