In OS X, as a limited user I used Terminal to su - [admin's name] and tried to move some files that were in the administrator's public drop box directory into /usr/bin. Couldn't do it. Permission denied. The Terminal prompt was clearly in the admin's login shell/environment.

Then, I discovered that, from the limited user's login, I could use the menu system to navigate into /usr/bin. I could then move the same files (copies in my directory, not the admin's copies) into /usr/bin as long as I authenticated as admin.

Seems backward. How is it that a limited user could get into the /usr/bin directory with administrative authentication, but the admin--at least a user in the admin's shell--could not?

  • I don't see why you consider it backward if you needed to authenticate as admin. (If you could write to /usr/bin without showing any evidence of authorization, that would be a problem.) When you tried the CLI move (in the first paragraph), which did you get the permission error on -- the drop box directory or /usr/bin? And, are you talking about a dropbox directory on your machine, or a Dropbox server? If the latter, did you authenticate to that server? Sep 26 '14 at 22:12
  • 1. A built-in directory, not the commercial Dropbox server. /users/username/public/drop box . 2. I'm fine, of course, with any requirement for authentication before doing anything with /usr/* . My confusion is that I could copy files into the admin's public drop box directory from the gui with authentication, but I could not do the exact same thing from Terminal, even though I was in the admin's shell and had to authenticate with the admin pw to get there. Why was the Terminal effort based on 'su' more restricted than the gui effort? (How create paragraph in these comments?)
    – Joseph_N
    Sep 27 '14 at 16:43

The issue here is that the GUI is not doing what you think it is doing. Neither the terminal nor the GUI can write to /usr/bin (which usually has owner: root:root and permissions: 0755/drwxr-xr-x) as an "admin". Only the owner of the directory - root - can do that.

However, the GUI has knowledge about what permissions are available and are needed for different operations. It created the concept of "admin" to refer to "someone who can, by entering their own password, become root". So when it prompts you for permission, it actually checks against the admin list and the executes it as root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.