Sharing & Permissions: who is "(unknown)" ???

Question

Sharing & Permissions: who is "(unknown)" ???

While trying, unsuccessfully, to have Spotlight search certain drives, I checked the Sharing & Permissions, and discovered that, in addition to "admin", "me", and "everyone", there is someone / something with the name "(unknown)", with permission to "Read & Write".

Furthermore, when I unlock and try to change the permissions, the change does not stick. Nor can I remove this entity; the "-" does not stick, either. Yet, I have full admin privileges.

This entity does not show up on all drives, just some. Yes, I have used Disk Utility to repair permissions; DU claims all is fine.

But I am not happy giving access to (unknown).

Posted on Apr 7, 2008 8:34 AM

Reply

Answer 1

V.K.

Level 9

56,192 points

Apr 7, 2008 8:56 AM in response to Peter Wadsack

this usually happens when a file was created by a user not currently present on your computer. Maybe you deleted a user or the file was created on another computer.

when this happens the permissions to the "unknown" user usually become ACLs which are sometimes tricky to remove from the "get info" panel.

they can be summarily removed by a terminal command but first i want to make sure it's safe to do so.

How are the drives in question mounted? Is any of them a bootable drive? a network share?

Reply

Answer 2

Apr 8, 2008 2:57 PM in response to V.K.

You seem to be headed where I thought the problem might lie.

This MacPro has 2 physical hard drives, one of which was moved from a PowerMac. However, the drives were both wiped clean. The drives are partitioned into 3 and 5 partitions, resp. The contents were restored from a NAS, containing the relevant dmgs. The boot partitions are ok. One partition on the smaller drive, and 3 on the larger, show "(unknown)". And yes, in this moving process a user was deleted.

So how come DiskUtility didn't clean up the ACLs?

Reply

Answer 3

V.K.

Level 9

56,192 points

Apr 8, 2008 3:06 PM in response to Peter Wadsack

disk utility only takes care of permissions on systems files and applications which are in its receipts database. It doesn't touch user files (it wouldn't know what to do with them).

Since none of the partitions involved are bootable it's safe to kill all ACLs on them.

to do that run the following command in terminal for each affected partition:

*sudo chmod -R -N /Volumes/"partitionname"*

substitute the name of the partition in question for "partitionname" in the above (keep the quotation marks).

Once you enter the command, you'll be asked for your admin password which you won't see. That's normal.

Reply

Answer 4

Apr 8, 2008 3:11 PM in response to V.K.

V.K. wrote:
Since none of the partitions involved are bootable it's safe to kill all ACLs on them.

and presumably, restore them correctly via, eg, Command-I for the disk, and then "apply to subfolders" ...

Thanks for the CLI code.

Reply

Answer 5

V.K.

Level 9

56,192 points

Apr 8, 2008 3:29 PM in response to Peter Wadsack

you can use "apply to enclosed items" option in the get info window but be very careful with it. It propagates permissions and ownership settings but also ACLs which might not be visible in the "get info" window. This is a major oversight in my opinion and a lot of people unknowingly get caught by using that button on system folders. In particular, never use it on system created folders in your home directory such as the home directory itself or the Documents folder. By doing so you'll propagate the "deny delete" ACE on that folder to everything inside which means you'll have to authenticate every time you want to move or delete something.

To see if a partition has any ACLs or other hidden things like sticky bits or extended attributes run this in terminal

*ls -aldeO@ /Volumes/"partitionname"*

post the results.

Message was edited by: V.K.

Reply

Answer 6

Apr 9, 2008 1:39 PM in response to V.K.

Well, I went ahead and tried it on one of the "partition"s:

-1-
computer:~ user$ ls -aldeO@ /Volumes/"partition"
drwxrwxr-x 34 user user - 1224 Apr 2 16:16 /Volumes/"partition"

-2-
computer:~ user$ sudo chmod -R -N /Volumes/"partition"

-3-
computer:~ user$ ls -aldeO@R /Volumes/"partition"
drwxrwxr-x 34 user user - 1224 Apr 2 16:16 /Volumes/"partition"

and Command-I still shows that for this "partition" there is an (unknown) user with Read & Write.

Reply

Answer 7

V.K.

Level 9

56,192 points

Apr 9, 2008 5:36 PM in response to Peter Wadsack

this is very strange. In fact your first command shows that there were no ACLs on the drive itself to begin with. and yet you say it still shows unknown in the "get info" panel. Apart from something silly like restarting Finder, i can only think of trying to change the ownership of everything on the drive.

Run

sudo chown -R `id -un`:`id -gn` /Volumes/"partitionname"

and see if this makes any difference.

BTw, the partitions we are doing it on are formatted Mac OS extended journaled, right? None of this would have any effect on FAT32 formatted drives.

Reply

Answer 8

Apr 10, 2008 9:50 AM in response to V.K.

Very strange, indeed, V.K.

computer:~ user$ sudo chown -R `id -un`:`id -gn` /Volumes/"partition"
Password:
computer:~ user$ ls -aldeO@R /Volumes/"partition"
drwxrwx--- 34 user user - 1224 Apr 2 16:16 /Volumes/"partition"

that cleared the last three, but to no avail, in that Command-I on "partition" still shows (unknown) user with Read & Write.

And yes, all the disks are GUID partitioned, and all the partitions are Mac OS Extended (Journaled).

Reply

Answer 9

V.K.

Level 9

56,192 points

Apr 10, 2008 10:02 AM in response to Peter Wadsack

Peter Wadsack wrote:
Very strange, indeed, V.K.

computer:~ user$ sudo chown -R `id -un`:`id -gn` /Volumes/"partition"
Password:
computer:~ user$ ls -aldeO@R /Volumes/"partition"

you don't need R in this command. simply *ls -aldeO@ /Volumes/"partition"* will do. However, it doesn't affect anything.

drwxrwx--- 34 user user - 1224 Apr 2 16:16 /Volumes/"partition"

that cleared the last three, but to no avail, in that Command-I on "partition" still shows (unknown) user with Read & Write.

hmm, i don't know what's going on here. The only thing i see is that your gid is the same as your username. This is some remnant of Tiger to leopard upgrade.
(in leopard your group should be "staff") but it shouldn't affect things. Just in case, run

id

in terminal and post the results.

Reply

Answer 10

Apr 10, 2008 10:28 AM in response to Peter Wadsack

computer:~ user$ ls -aldeO@R /Volumes/"partition"
drwxrwx--- 34 user user - 1224 Apr 2 16:16 /Volumes/"partition"

That second entry (in bold and underlined above), is not a user, it is a group. As V.K. mentioned, in Tiger every user was a member of the private group, with the same name as the user. In Leopard Apple went back to the UNIX standard of users being members of the staff group. If you did an upgrade install however you are still a member of the old private group, and the Finder doesn't understand that any more and so displays the private group as unknown.

The only odd thing, in terms of permissions on the partition, is that the private group has write permissions. Generally I think it should have only read permissions.

If everything is working to your satisfaction don't worry about it.
Francine

Francine
Schwieder

Reply

Answer 11

V.K.

Level 9

56,192 points

Apr 10, 2008 10:48 AM in response to Francine Schwieder

thanks, Francine. I didn't realize that leopard Finder wouldn't understand the private group at all and display it as "unknown".

Reply

Answer 12

Tony T1

Level 6

10,247 points

Apr 10, 2008 11:02 AM in response to V.K.

Try: http://docs.info.apple.com/article.html?artnum=307128

Reply

Answer 13

V.K.

Level 9

56,192 points

Apr 10, 2008 11:19 AM in response to Tony T1

the proposed solution looks kind of strange to me. Also, I don't think it's needed here because the OP is not seeing the Finder crashes and "_unknown" group in his case. At least the underscore was never mentioned in his posts.

The proper way to fix this would be to add the user to the staff group, change his gid to 20 and rerun the command changing the group ownership on everything. However, I agree with Francine, if everything is working, there is no reason to mess with it.

Reply

Answer 14

Apr 10, 2008 2:03 PM in response to V.K.

V.K. wrote:
the OP is not seeing the Finder crashes and "_unknown" group in his case.

correct. the info window on the partitions shows the user "(unknown)".

as to the id suggestion:

+computer:~ user$ id+
+uid=501(user) gid=501(user) groups=501(user),98(_lpadmin),80(admin)+

which apparently is the result of the move from Tiger.

As to the suggestion of leaving things as they are, if there are no problems ...

I find it very disconcerting to have this mysterious "(unknown)" user on my system, with full Read & Write privileges, and with no ability on my part to change those privileges, nor to remove the user. If one were attacking a system, having such a user seems to me to be a big foot through the door!

As to problems, this all started when I was trying to determine [and so far, I have not] why Spotlight is not indexing some of the partitions or certain folders on another. Running +sudo mdutil -as+ shows indexing enabled where it isn't happening. But that's off topic.

I just looked at the info windows for all 8 partitions. *_1 is on drive 1, *_2 on drive 2. The three on drive 1 are ultimately going to be cloned to drive 2. This is just the Sharing & Permissions.

boot_1:
You can only read _+*What? I'm the admin user!!*+_
system R&W
admin RO
everyone RO

second_1
You can read and write
system R&W
admin R&W
everyone RO

third_1
You can read and write
admin R&W
user (Me) R&W
(unknown) R&W
everyone WO

boot_2
you have custom access
system R&W
admin RO
everyone RO

second_2
You can read and write
user (Me) R&W
(unknown) R&W
everyone RO

third_2
You can read and write
user (Me) R&W
(unknown) R&W
everyone RO

fourth_2
You can read and write
user (Me) R&W
(unknown) R&W
everyone no access

fifth_2
You can read and write
user (Me) R&W
(unknown) R&W
everyone RO

Looks like a mess to me. Thanks for looking at this!

Reply

Answer 15

V.K.

Level 9

56,192 points

Apr 10, 2008 2:42 PM in response to Peter Wadsack

Peter,
I take it boot_1 and boot_2 are boot partitions? It certainly strikes me as wrong that the admin group has read only rights to them. the default is R+W, I believe.

You can change that if you wish.

that can be done by the following command:

*sudo chmod 775 /Volumes/boot_1 /Volumes/boot_2*

Now, if you REALLY can't stand having the unknown user around, try this.

1. make sure you have a bootable or TM backup of your startup volume. If things go south, you'll need it.

2. add yourself to the staff group. To do this run

*sudo dscl . -append /groups/staff GroupMembership yourusername*

Put your username in the above.

run

id

again to make sure you are now a member of staff.

DO NOT PROCEED if you get errors of any kind.

3. Switch your gid to 20 (staff).

To do this, open system preferences->accounts, unlock the lock, right-click on your username and select "Advanced options...".

In advance options set your group ID to 20 and quit system preferences.

Run id again to make sure the change took affect.

4. change the group on your home directory by running

*sudo chown -R `id -un`:staff ~*

5. Cross your fingers and restart.

If everything is working, change the group ownership on your drives with "unknown".

*sudo chown -R `id -un`:staff /Volumes/third_1*

and so on.

Good luck!

Message was edited by: V.K.

Reply