Admin of Mac Book Pro -- Terminal Application -- You have custom access

Question

Level 1

4 points

Admin of Mac Book Pro -- Terminal Application -- You have custom access

I have a brand-new, seal just broken, Mac Book Pro, running Sonoma 14.5. Logged in as Admin, I went to set up user accounts and restrict permissions to applications. I navigated to the Terminal application first to eliminate access for everyone except the system and admins. Rather than stating that I have read and write permissions, Terminal advises that "You have custom access." When I go to add the Admin user, I am restricted and advised via prompt, "The operation can't be completed because you don't have the necessary permission." To be clear--this machine is one hour old and I am the only user at the moment, logged into the only account that has admin permissions. When I go to restrict "everyone" from access to Terminal, I receive the same prompt.

There are many problems here but first and foremost -- who set custom permissions on this machine before it was opened? And who is in control of the permissions on the machine that I bought and own?

When I called support at Apple, the permissions problem becomes even more worrisome. Support claims that this is the default feature in Sonoma and that users cannot be restricted from accessing Terminal. According to support, the Admin password provides the only necessary protections preventing any user of the device from running damaging scripts from the command prompt.

I was told to look for third party apps to regain control of this machine. Has anyone else encountered this?

Posted on Sep 16, 2024 12:20 PM

Reply

Answer 1

Top-ranking reply

Grant Bennet-Alder

Level 10

145,275 points

Sep 16, 2024 2:27 PM in response to ASHESMACS

You have not lost control of your machine.

what you are trying to do -- modify Applications -- is expressly prohibited.

The system and all the Applications in the /Applications folder are stored on a separate, crypto-locked virtual system Volume, and are not writeable using ordinary means. Any changes that occur, however they occur, will halt the system and put up an error message and keep you from proceeding

So if you push on it hard enough, you WILL break it.

The mechanism you are pursuing is dead to you.

Take a look at the basket of restriction features offered under the Screen Time settings, which already include the ability to restrict access to Terminal and many others.

Get started with Screen Time on your Mac - Apple Support

.

Reply

Answer 2

Sep 16, 2024 6:28 PM in response to ASHESMACS

You are not understanding the current workings of recent versions of macOS where Apple has implemented a lot of new security & privacy features which has resulted in many areas within macOS file system to be off limits even to an admin/root user.

Here is an Apple article which explains a little bit about the new drive layout beginning with macOS 10.15 and being even more restricted with macOS 11.x+:

Signed system volume security - Apple Support

The "custom access" you are seeing from the default configuration of macOS is macOS itself having given "custom access" to certain areas. As @Grant has mentioned, the only way to manage applications is by using the "ScreenTime" feature. Your question was answered. Check out the options to control & restrict apps through ScreenTime. If you don't like this option, then I think you are using the wrong OS.

The "root" user on macOS no longer has full God Mode powers.

Reply

Answer 3

Sep 17, 2024 2:31 PM in response to ASHESMACS

MacOS is based on unix, but it's NOT unix.

Before you write us all off as loony tunes, I suggest you set up a test account for your dog, and use the settings in Screen Time to disable access to Terminal for that Account.

if you still get access to scripts AFTER precluding it, then we can talk more about how this OUGHT to work.

Reply

Answer 4

Sep 16, 2024 5:35 PM in response to ASHESMACS

Permissions of an Application are stored in the directory entry for that Application.

The entire Volume where that information is stored -- all of it -- is dead to you.

Reply

Answer 5

Sep 16, 2024 12:33 PM in response to ASHESMACS

you are not likely to have success changing individual access in each application by hand, and it is far too tedious.

to restrict access to Applications, for non-admin Users, you use the settings/prefs found in Screen Time.

Get started with Screen Time on your Mac - Apple Support

Reply

Answer 6

ASHESMACS Author

Level 1

4 points

Sep 16, 2024 12:52 PM in response to Grant Bennet-Alder

Hey Grant: I can endure the tedium for the security. I'm not interested in adjusting access to all of the applications but the command line needs restriction, wouldn't you agree? As stated--admin user locked out of brand new machine. Have you seen this before?

Thanks for taking the time.

Reply

Answer 7

ASHESMACS Author

Level 1

4 points

Sep 16, 2024 5:32 PM in response to ASHESMACS

Hey Grant: Odd. Im not trying to alter an application. At all. I think I made that clear. What I am trying to do is restrict who can access it. That's common stuff and the features are right there in the GUI for a reason. The problem that I have is that I have been locked out of those features. Are you saying that Administrators don't have the ability to designate "everyone" or specific users as "no access" to the Terminal? That's not the case but I'm trying to understand if that's what you're saying IS the case.

For reference-- this machine is right out of the box.

And we've gone back and forth once or twice now and still lack of clarity.

YES or NO: "You have custom access" to adjust permissions for the Administrator account is the standard for a newly shipped Mac Book Pro running Sonoma 14.5.

Thanks again!

Reply

Answer 8

ASHESMACS Author

Level 1

4 points

Sep 16, 2024 5:50 PM in response to Grant Bennet-Alder

Ok. So we’re not at a level of comfort where answering yes or no questions is happening. I get it.

Can the root user on a Mac Book Pro designate users and assign permissions for use of the Terminal?

That is to say—can the root user select a user profile of a child and designate that profile “no access” to Terminal?

Reply

Answer 9

ASHESMACS Author

Level 1

4 points

Sep 17, 2024 1:58 PM in response to Grant Bennet-Alder

I don't think i have lost control of the machine to someone else...yet. I think that i don't have the ability to exclude others from running scripts on my machine. A nuance with considerable significance. In any event, I think others may benefit from knowing this is out there. Be well.

Reply

Answer 10

ASHESMACS Author

Level 1

4 points

Sep 17, 2024 2:07 PM in response to HWTech

With all respect, there is not greater security in prohibiting an admin from setting "no access" as a permission to the command line. That is the opposite of security--it's a gaping hole in security. It's a little humorous to read others assert that when you purchase a MBP you haven't purchased a stand-alone console that is your to administer, but you have in fact purchased the rights to use a VM that is administered by Apple system (and i suppose whoever else has actual admin privileges).

Be well, fellas, and thanks again for chiming in here.

Reply

Admin of Mac Book Pro -- Terminal Application -- You have custom access

Similar questions