Limiting permissions on files and folders

Staff only has read permission on the outer home directory.

Folders inside of home (except sites and public) do not have a group set.

When you create a folder, it will inherit the parent folder permissions (and the user who created it).

So, if you create a folder directly inside of Home, it will have the staff group set to read.

Get Info on that folder and delete the group.

Any folder you create inside the other folders (Desktop, Documents, Downloads) will not have a group set as it inherits that from the parent directory.

I have specific questions about the effect of limiting permissions on files and directories in OS X: will there be problems ifI don't give Staff Read permissions to a set of files and directories?

That is how all of a user's files should be set. Did you look at them. Most of the folders are set that way, too, as I described. The net effect of removing the group will be to work exactly the same as the files inside the standard subfolders like Desktop, Documents, Downloads, Music, etc.

As a result, when it created new folders inside the home folder, those new folders inherited the staff read staff read permissions.

Folders created inside of Home will inherit the group with read. Sites and public will have it, but the rest should not.

I don't have anything I've Migrated to check what happens.

The "main" user most likely has "admin" rights. With admin rights, they can read anything on the file system they want regardless of the file permissions you put on the files and directories/folders.

Now whether on not your "main" user knows how to do that, is another thing, but if they are determined to read your files, then file permissions are not going to stop them.

If you want to keep those files secret, then you need to use Applications -> Utilities -> Disk Utility and create an encrypted disk image file (aka a .dmg file), where ONLY you know the encryption key-password. Create a read/write .dmg so that you can add files, modify existing files, and delete files. It will mount on your system as if it was a disk. MAKE SURE you unmount the .dmg when you are not using it, because as long as it is mounted, it will be readable by the "main" user. But unmounted, it will be encrypted with a password only you know.

Admin rights will not bypass an encrypted file.

If you do not know what an encrypted .dmg files is, then start doing some Googling to learn more.

If it were me, and they were that personal or whatever, I create an air gap situation and have them stored on a pair (for security) of external HDDs ... not flash media or cards.

Don't go near file permissions unless you're a UNIX guru.

Put the files on an encrypted disk image. Job done.