I'm the only user on a OS X machine and am wondering what the best practice is for setting permissions on my sensitive files. Specifically, are there reasons to prefer one of the following

-rw-------   1 MyName  staff   ... File1 
-rw-rw----   1 MyName  MyName  ... File2
-rw-rw----   1 MyName  admin   ... File3

or perhaps even — what seems the most natural to me — no group at all with

-rw-------   1 MyName  MyName  ... File4

On OS X (10.8.2), the "default" is

-rw-r--r--   1 MyName  staff   ... FileA

but, until I, perhaps mistakenly, "reset permissions", most of my files had

-rw-r-----   1 MyName  MyName  ... FileB 

so one reason I'm asking is that I'm wondering what the consequences of my "reset" are.

2 Answers 2


Since you're the only user, logic says you have nothing to worry about. Should a remote possibility exist that someone else should have a user on that system, just be careful what privileges you assign. In short, the defaults will work fine.

  • So there's also no reason to worry about inadvertently restricting access either? For example if (out of compulsiveness) I have some files like File4, I and any code that runs as admin will still have access. Correct?
    – orome
    Commented Feb 5, 2013 at 21:14
  • 1
    My point was just that. Don't tighten permissions if you don't need to, and don't loosen them if you don't need to. And yes, you're correct.
    – schaiba
    Commented Feb 5, 2013 at 21:18
  • And the fact that "reset permissions" swept through my files and changed whatever I had (much of which was like FileB) to be like FileA really has no consequence -- and might even be a good idea since it would be what the system expects. Correct?
    – orome
    Commented Feb 5, 2013 at 21:59

It really won't matter if you try to set permissions to MyName:MyName or MyName:staff; the bottom line is anyone with 'staff' access on your machine is going to effectively have sudo access as well (namely, anyone who is an administrator on the machine.)

I personally wouldn't lose any sleep over OSX permissions; a capable sysadmin with 20 minutes of physical access to your computer can fairly quickly and easily compromise any file that is not encrypted; a live Ubuntu CD/USB key means they can completely bypass any permissions you may have set. If you have genuinely sensitive files, I'd create a truecrypt partition to store them in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .