Ventura (13.5.2) has NO file security at all

I’ve 3 users:

• Mackie which I only use for installations, updates & upgrades.

• Sono who has all privileges, a separate ext. HD with more than 200 000 files and doing all DAILY TASKS.

• Test which has no privileges but proves macOS file security does NOT work.


The ext. data disk is, of course formatted as “APFS” with “GUID Partition Map”.

When I ask INFO about a file, with whatever user I’m logged in I always receive the same:

THAT user (whether it is Mackie, Sono or Test) is the user and he has write and read permission while all others have only READ permission… which obvious ly is NOT true because anyone can change whatever file. Whether i-s s a text file, a rtf file, a FM-Pro file, etc.

To make it totally absurd and even more paradoxal: Sono who created AND the ext. disk AND each of its files, is randomly confronted (about once a week, which is about once every 100 times) with the “fact” that he does NOT have permission to OPEN one of his own file or, after changing a file, having the possibility to save it!! Message:

YOU DO NOT HAVE PERMISSION TO SAVE FILES TO THIS LOCATION. 

And, "cerise sur le gateau amère": Even if it is on the DESKTOP!

In short: can it be worse?

And… is there a solution to keep at least Sono's files private?

Mac mini, macOS 13.5

Posted on Nov 22, 2023 2:30 AM

Reply
Question marked as Top-ranking reply

Posted on Nov 23, 2023 9:42 AM

The problem is almost entirely solved.

I upgraded to macOS Sonoma hoping what happened to user Test would not come back AND that Sono as real USER wouldn’t experienced those most frustrating false error messages telling him he’s not the owner of his own files… even if this occurs in ±1% of the cases.


In the INFO window of Shakti I made sure I deleted all groups I could. I made sure Sono is the owner (or at least is listed first) and “Everyone” with “NO ACCESS”.

Then I applied it to all encloses items and… it worked. OUFTI (this is French mening “At last it worked, so I’m relieved and let it finally go”).


The first enclosed screenshot was of course not owned by Sono, as it was taken by test and indicated HE, (i.e. test) was the owner of that file.

Should I have added the INFO view when logged in by sono? Here it is:

As you can see sono is mentioned twice.

Q1. Any idea how to get rid of this anomaly? I tried to delete one but it didn’t work (no for the second one and not for the first one).

BUT!!! When I updated the rtfd file of this issue, I got another error:

The document “Ventura has NO file security at all… by default.rtfd” is on a volume that does not support permanent version storage.

Q2. Will this never stops?

Here the INFO about ext. HD Shakti:

By miracle the updates (of file “Ventura has NO file security at all… by default.rtfd”) WERE saved, so I didn’t most anything (to be complete: juste before; the file itself closed without allowing me to make a duplicate).

Similar questions

10 replies
Question marked as Top-ranking reply

Nov 23, 2023 9:42 AM in response to Barney-15E

The problem is almost entirely solved.

I upgraded to macOS Sonoma hoping what happened to user Test would not come back AND that Sono as real USER wouldn’t experienced those most frustrating false error messages telling him he’s not the owner of his own files… even if this occurs in ±1% of the cases.


In the INFO window of Shakti I made sure I deleted all groups I could. I made sure Sono is the owner (or at least is listed first) and “Everyone” with “NO ACCESS”.

Then I applied it to all encloses items and… it worked. OUFTI (this is French mening “At last it worked, so I’m relieved and let it finally go”).


The first enclosed screenshot was of course not owned by Sono, as it was taken by test and indicated HE, (i.e. test) was the owner of that file.

Should I have added the INFO view when logged in by sono? Here it is:

As you can see sono is mentioned twice.

Q1. Any idea how to get rid of this anomaly? I tried to delete one but it didn’t work (no for the second one and not for the first one).

BUT!!! When I updated the rtfd file of this issue, I got another error:

The document “Ventura has NO file security at all… by default.rtfd” is on a volume that does not support permanent version storage.

Q2. Will this never stops?

Here the INFO about ext. HD Shakti:

By miracle the updates (of file “Ventura has NO file security at all… by default.rtfd”) WERE saved, so I didn’t most anything (to be complete: juste before; the file itself closed without allowing me to make a duplicate).

Nov 23, 2023 10:39 AM in response to DLWorldCitizen

I haven't figured out the symbols, completely, but I think the silhouette in a circle is an actual user account with POSIX (basic unix) permissions.

The plain silhouette user I believe is an Access Control List permission set for a single user.

Copy/paste this into Terminal, leave a space, and drag Shakti into the Teriminal window (it will fill out the path). Hit return.

ls -ale 

The first line of the output (. at end) should be the permissions for that folder.

Below you should see an entry similar to this:

0: user sono allow list,add_file,search,add_subdirectory,readattr,writeattr,readextattr,writeextattr,readsecurity

That means that the user "Sono" was given access through an ACL and is not the POSIX owner.

If you set up access from the File Sharing pane, you will set an ACL, not give POSIX permissions. You can only set POSIX permissions in Get Info or the command line with chmod.

Nov 23, 2023 5:32 AM in response to DLWorldCitizen

If that is the same permissions as all folders/files, all users can read since all users are member of the staff group.

You should remove the group for the user’s folder on the external.


The permissions you see on what you call the drive are merely the permissions of the top-level directory on the drive. Inside that drive should be user-owned folders with no group and everyone no access. You will likely need to propagate those permissions down the hierarchy with “Apply to enclosed” from the ellipsis button since many files were likely created with permissions disabled.


The screenshot you posted was not owned by Sono. If you describe a problem but post I different file, we can’t help.

Nov 24, 2023 8:31 AM in response to DLWorldCitizen

I'm sorry, but I have no idea what's happened to your system. I recommend the following:


1) Boot into Recovery Mode

2) Erase the hard drive

3) Reinstall the operating system


Since your system was so scrambled to begin with, I don't recommend trying to restore from backup. That will only restore whatever problems you were having before.


Instead, when you install the operating system, setup a single user, call it "Sono" if that's what you like. That will be your user. It will be an Administrator user that can install any apps that you really need.


(However, I strongly encourage you to give serious consideration to any apps that requires your password to install. You are giving that app, and whomever wrote it, full control over your system and all of your data. When I say "full control", I mean absolute. In most cases, they are honest and you can trust them with your privacy. But that doesn't mean they don't make mistakes. Avoid installing this kind of software if you can.)


You will need to manually restore any documents from external drives or backups. Since you are the administrator user, you will have full access to any other users' files. When you manually copy them over using the Finder, they will be reassigned to the "Sono" user and everything will work correctly.


You can continue to use an external drive if you need additional storage. Make sure that it is setup to Ignore ownership. That is the setting you want. If you are concerned about privacy, all you need to do is encrypt the external drive. Encryption is what gives you privacy. Changing permissions gives you problems.


Don't bother with any more long posts or complaints. They aren't going to help you. If you follow my suggestion, it will fix all of the problems and everything will work as designed. It may take some time to get your files copied back over and reorganized. You will have to re-download all of your e-mail, for example. But in the end, everything will work correctly.

Nov 23, 2023 11:53 PM in response to etresoft

for etresoft: Thank you for your time and concerns. Let me reassure you: my organisation is extremely simple and SOLID.

So:

I have one internal SSD with ALL applications and SYSTEM stuff. and ONE “System Admin user”, called “Mackie”, whose only purpose is when need to ADD a new application or update/upgrade the system.

I have one external SSD with ALL data files and ONE USER called “Sono” who formatted that disk. And which more than 200 000 files (two hundredth thousands, that’s, I think, “200,000” for US Americans) and many thousand of folders all bearing a clear, unambiguous name. I only use LIST view, and each folder, depending on its use, is shown sorted by 7 COLOR LABELS, MOD. DATE and/or ITS NAME.

In other words, I’m using Sono ±99,97% of the time.


As for another vaste list of reasons I don’t use Time Machine but have several other external devices where I put backups on.

The only reason to have a TEST user was to find out about the inconsistency of the default file security which I now know, has its reason.

The fact that (1) BY DEFAULT all disks are NOT private and (2) do NOT have an owner and (3) that you have to MANUALLY indicate which is the owner, (4) to propagate it to its content and (5) to give NO ACCESS to everyone else, is, in my view, a severe security leak. But hey: who am I?

Thus, dear, etresoft, don’t worry, as I DO NOT want to share files amongst users, as I have no need for it.


I know my way of working if different from most users, and I take full responsibility of it.

And please, dont’t ask me why. It’s just far too complicated (and extremely long) to justify.


BUT, and now comes the delicate part, do not tell me that IT IS NORMAL that Sono as the OWNER of the whole disk and CREATOR af each and very file irregularly receive errors (which I call LIES, how would YOU call them?) telling him HE IS NOT THE OWNER or telling him the VOLUME DOES NOT SUPPORT PERMANENT VERSION STORAGE, which is disregarded some seconds (or minutes) later!

Since I’m using Sonoma, I receive other strange error messages… upon each start up:

• The application Finder can't be opened.

• The application “Firefox.app” can’t be opened.

Doesn’t this make you wonder if they ever tested it?!??

(I’ve lost the “The application Finder can't be opened” error message)

I was spammed several times each and every day, by messages telling me an update will be performed later that day… which never occurred despite the fact I didn’t shut down for more that a week, you may understand why I finally wanted to do it manually.

[having endured the worst system degradation starting in ±2018 (where I kept El Capitan for another bunch of extremely good reasons) up to March 2023, by NOT upgrading, I nowadays don’t wait too long before upgrading]


So let’s close this issue, unless you know why macOS becomes less and less consistant?

(I’ve now the INSIDE MACINTOSH era, where EVERYTHING WAS CONSISTENT, EASY AND USERFRIENDLY. It degraded around mid-2010 and I can give some hard examples)

Have a nice day…

Nov 23, 2023 10:49 AM in response to DLWorldCitizen

I'm not sure what you are trying to accomplish here. As far as file system security and permissions go, not much has changed over the past couple of decades. If you think upgrading to Sonoma may have helped something, then you are really confused.


You seem to have two contradictory issues. You want to share files between users but also restrict access? And you want to do it using an external volume? Sometimes? And you have enabled ownership on the external volume. I don't know if you originally had it setup that way or if you recently changed it according to Barney-15E's suggestion.


Regardless, I can assure that that everything works fine. You need to take a step back and evaluate what you are doing and what you are trying to accomplish. The bottom line is that the permissions system is design to restrict access, not facilitate it. Having multiple logins is only going to make your life more difficult. It will keep files separate, but it will not help you share them. Those are opposing goals.


You can use an external volume to share files. By default, it doesn't have any permissions at all. But you've changed that, thereby making it like any other volume.


My recommendation is to keep everything at default settings. That means one user account. All problems solved. If you want to keep two sides of your life separate, you can use folders for that. Folders in Finder. Folders in Mail. Folders in Notes. Folders everywhere! Works like a charm.


If you need additional storage, use an external drive. Keep it encrypted to keep your data safe and secure. But keep permissions disabled because that's a royal hassle.

Nov 23, 2023 3:36 AM in response to Barney-15E

At first I thought: "YES THAT'S IT", because the check box (at the end of the INFO panel was indeed crossed). But when I uncrossed it. Nothing changed. I logged in into TEST and he still could do all changes.


But, as paradoxal as it can be, SONO, the owner of a simple text file couldn't make any changes in an open text file. He needed to make a copy and save it on the desktop.

He get’s: You don’t own the file “…rtfd” and don’t have permission to write to it.

I.e. the word upside down (but this time worse). + the situation has become WORSE.

Sono created the ext. HD “Shakti”, so why is is marked System?

AND, BELIEVE IT OR NOT: THE ONWER OF THIS VERY TEXT FILE HAS BECOME “TEST”!!!!!!!!!!!!!!!!!!!!!!!!

The more I try to solve it the worse it gets!!!

! ! ! H E L P ! ! !

Nov 23, 2023 11:47 PM in response to Barney-15E

for Barney-15E: I’m not familiar with Terminal and think it should only be used by very experimented users WHICH I AM NOT.

It’s already enormous difficult making an REBOOT or AUTOMATIC SHUTDOWN.

Note1: i’ve no idea what is a “POSIX owner”. And I already told, I only have 3 users mackie, sono and test (see further).

Note2: The last time I had to use ACL’s was before 1997. It was when everybody was connected to 1 single Digital mainframe via… terminal.

Note3: aren’t you confounding with another issue?

Note4: The issues I’m encouter should be reported to APPLE and I do not intent to complicate my work with cryptic manipulations, î’ve no knowledge about.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Ventura (13.5.2) has NO file security at all

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.