Re: File Sharing (again - sorry, Pd)

Simon Higgs <devnull@xxxxxxxxxxxxxxxxxxx> wrote:

Martin S Taylor <mst@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

What's the state of the art on this? I've spent an afternoon tinkering with
Batchmod, permissions, File Sharing, Groups and
lord-I-don't-know-what-and-all....

This has just appeared on Mac OSX Hints...

<http://www.macosxhints.com/article.php?story=20090219133314985>

Thanks for the link, and it referenced a GUI application for
manipulating ACLs (Sandbox), but unfortunately its user interface is
rather primitive and it only lets you see and modify ACLs for folders,
not files.

Unfortunately the use of inherited ACLs isn't a perfect solution. I
already tried that a week ago and found that several applications didn't
play nice.

The specific problem is that some applications save new documents by
creating them in a temporary folder, then move them into the folder
specified by the user.

A file moved into a folder doesn't inherit the ACL from the folder. You
have to copy the file into the folder (or create it there) to inherit
the ACL.

This means that documents saved by some applications won't have the ACL,
unless you go through some extra steps to make sure it is added. The
affected documents can only be modified by the person who created them.

I've just tried it again with a few word processors and text editors,
and made the following observations:

1. Documents created in the folder with a very simple method like
'touch' inherit the group and ACL from the folder.

2. Moving a file into the folder (with Finder or 'mv') doesn't add the
ACL.

3. Copying or duplicating a file into the folder (with Finder or 'cp')
does add the ACL (if it didn't already have the ACL).

4. BBEdit and Microsoft Word v.X: OK. New documents saved in the folder
have an ACL, and the same group as the folder. Edited documents preserve
their existing ACL and group.

5. TextEdit: newly saved documents don't have an ACL, but the ACL is
preserved when editing an existing document (using "Save", not "Save
As"). Anything created or edited by TextEdit has the default group for
the user rather than the group of the folder.

6. Pages '09: behaves like TextEdit when creating or editing ".pages"
documents (in the default single file compressed format - I haven't
tried the package format). For exporting other document types (Word, RTF
or Text), Pages '09 behaves like BBEdit.

Assuming other applications behave similarly to the patterns of either
BBEdit or TextEdit, this means that you need to be aware of which
applications don't correctly set up the ACLs.

When you create a new document with one of those applications, save it
somewhere else and use Finder to COPY it into the ACL-tagged folder,
which will add the ACL. (You could also use Finder to duplicate a file
already in that folder, then delete the original.)

Once a file has the ACL it should keep it, unless you do a "Save As"
with one of the miscreant applications.

Further testing is needed with more complex applications like iTunes and
iPhoto to see how they behave. Each type of file created by an
application might behave differently, depending on whether the
application uses a temporary folder when saving that type of file.

--
David Empson
dempson@xxxxxxxxxxxxx
.

Relevant Pages

  • Trouble with XCACLS.VBS and denying Execute access
    ... Full Control (This Folder, Subfolders and Files) ... If I change the permissions to look like those above through the GUI, ... The first line REPLACES the ACL for the current user with the Full Cont ...
    (microsoft.public.security)
  • Re: Add or modify ACL on folder after using FSMT
    ... User_a can have an access to this folder after user_a login the Win2k3. ... you may use subinacl to replace the ACL. ... type subinacl /help at the command line. ...
    (microsoft.public.windows.server.migration)
  • Re: Default Permissions
    ... When you look using the advanced view you see all ACEs in the ACL ... folder, ... carry no permissions on the contained files. ...
    (microsoft.public.security)
  • Re: Trouble with XCACLS.VBS and denying Execute access
    ... the GUI ACL editior has been used to remove a grant set on \test1 ... > result is not the same as it is if done through the Win2K Security GUI. ... Full Control (This Folder, Subfolders and Files) ...
    (microsoft.public.security)
  • ACL troubles
    ... I have ACL attributes set on it for group:foo to allow all of these: ... command line, or make a new folder with Finder. ... But, if I create a new file and save it with one of these applications, ... That would cause the problem of the ACL not inheriting. ...
    (comp.sys.mac.system)
Loading