I'm the only user on a OS X machine and am wondering what the best practice is for setting permissions on my sensitive files. Specifically, are there reasons to prefer one of the following

-rw-------   1 MyName  staff   ... File1 
-rw-rw----   1 MyName  MyName  ... File2
-rw-rw----   1 MyName  admin   ... File3

or perhaps even — what seems the most natural to me — no group at all with

-rw-------   1 MyName  MyName  ... File4

On OS X (10.8.2), the "default" is

-rw-r--r--   1 MyName  staff   ... FileA

but, until I, perhaps mistakenly, "reset permissions", most of my files had

-rw-r-----   1 MyName  MyName  ... FileB 

so one reason I'm asking is that I'm wondering what the consequences of my "reset" are.


Since you're the only user, logic says you have nothing to worry about. Should a remote possibility exist that someone else should have a user on that system, just be careful what privileges you assign. In short, the defaults will work fine.

| improve this answer | |
  • So there's also no reason to worry about inadvertently restricting access either? For example if (out of compulsiveness) I have some files like File4, I and any code that runs as admin will still have access. Correct? – orome Feb 5 '13 at 21:14
  • 1
    My point was just that. Don't tighten permissions if you don't need to, and don't loosen them if you don't need to. And yes, you're correct. – schaiba Feb 5 '13 at 21:18
  • And the fact that "reset permissions" swept through my files and changed whatever I had (much of which was like FileB) to be like FileA really has no consequence -- and might even be a good idea since it would be what the system expects. Correct? – orome Feb 5 '13 at 21:59

It really won't matter if you try to set permissions to MyName:MyName or MyName:staff; the bottom line is anyone with 'staff' access on your machine is going to effectively have sudo access as well (namely, anyone who is an administrator on the machine.)

I personally wouldn't lose any sleep over OSX permissions; a capable sysadmin with 20 minutes of physical access to your computer can fairly quickly and easily compromise any file that is not encrypted; a live Ubuntu CD/USB key means they can completely bypass any permissions you may have set. If you have genuinely sensitive files, I'd create a truecrypt partition to store them in.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.