What are 'Wheel' and Everyone' accounts?

Wheel is a system-level group; it can be safely removed from the access list for any item you've created. Everyone refers to all accounts on the system which aren't in any other entry of the list.

(31545)

everyone means just that - every possible user on your computer. Your home folder itself should have read permissions for everyone. That's normal so that other users can get into your public and sites folders which are accessible to everyone by default. However, your other folders in your home directory like your Documents or Desktop folders (or anything else you create yourself) should have no access for anybody but you.

wheel is a special administrative group which normally contains only the "root" user. the fact that using the ACL reset button changed group ownership on your homefolder to wheel is a bug.

To change them to what they ought to be run the following command in terminal

*sudo chown -R `id -un`:`id -gn` ~*

just copy and paste the above. you'll have to enter you admin password which you won't see. that's normal.

The Terminal command changes the owner of everything in your home folder to your account, and isn't applicable to this specific situation. Delete the wheel entry from each list, or set it to the same setting as Everyone if it can't be removed.

(31554)

don't ever use the "apply to enclosed" items button to change permissions on any of the system created folders including your home folder, your Desktop folder etc. That's what probably got your in trouble in the first place. Those folders have some invisible ACLs and you don't want to propagate them to enclosed folders.

It's strange that the command had no effect. It should have. let's check what your group id is. It could have been reset to 0 by the ACL reset process. That would make your default group wheel.

Run the following in terminal and post the result. It will list your current primary group.

*id -gn*

Message was edited by: V.K.

BTW, there is no harm in having wheel have access to your home folder. as I said, only root is the member and it has full access to everything anyway. However, your permissions ought to be set correctly anyway.

Does this make the most sense?

Yes. You may need to set the home folder itself to Read Only.

(31556)

if you just done it again, you need to reset the ACLs again.
the home folder has a 'deny delete" ACL and you just propagated it to everything inside. Now to delete anything you'll need to enter your admin password.
as i said, don't use 'apply to enclosed items" on system created folders.

if the command just gave your username back, it means that you upgraded to leopard from Tiger and inherited Tiger group structure. leopard uses a different one but you probably shouldn't mess with it now.

interesting. I wonder how you managed to loose those "deny delete" ACLs on your home folder.

As to whether or not it will cause problems... Those ACls weren't there prior to leopard and were put in to make sure users didn't delete their vital folders by accident. However, this was done rather badly because this particular ACE is invisible from Finder and people clicking the "apply to enclosed items" button unwittingly propagate it with unpleasant results.

It's up to you if you want those ACLs or not. The system will function perfectly well without them but there will remain a chance that you can accidentally delete your desktop or documents folder for example.

To restore the ACLs follow these instructions:

run the following commands (they are in bold) in terminal to set things right.

*chmod -R -N ~*

this removes all ACLs from files in your home directory.

The following two commands put the necessary ACLs back where they belong.

*chmod +a "everyone deny delete" ~/ ~/Desktop ~/Documents ~/Downloads ~/Library ~/Movies ~/Music ~/Pictures ~/Public ~/Sites*


*chmod +a "`id -un` allow list,add file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr, writeextattr,readsecurity,writesecurity,chown,file_inherit,directoryinherit" ~/Public/Drop\ Box*

I think the easiest way to add a folder to sharing is by going to its "get info panel" and checking the box "Shared folder".

It's ok to use "apply to enclosed items' on any folders you made yourself. Just don't use it on system created ones. they sometimes have those hidden ACLs, sticky bits and flags. You usually don't want to propagate those.

you are welcome!