Inside "MyDir/Library/Application Support/Games" is a directory I would like to allow all users to read. I don't, however, want them to be able to read any other directory in MyDir.

What is the best way to accomplish this?

Thanks.

link|improve this question
feedback

1 Answer

There isn't a really good way to do this, because in order to get to that directory, other users will need to be able to get into MyDir, MyDir/Library, etc. That said, there are a couple of ways to sort-of accomplish it:

  1. You could set the permissions on MyDir, MyDir/Library, etc to allow traversal, but not reading. Problems with this approach: other users won't be able to navigate to the folder normally, they'd have to use the Finder's Go to Folder option (or Cmd+Shift+G) and type in the path to it. Also, although they wouldn't be able to see the contents of MyDir, MyDir/Library, etc, they would be able to access the files there if they new (/could guess) the names. Since the contents of Libraries tend to be pretty predictable, this means they'd be able to get at MyDir/Library/Preferences, MyDir/Library/Keychains, etc unless you properly protected those as well. Assuming you wanted to do this, here are the relevant setup commands (warning: these are not easily reversible, please think carefully before executing):

    chmod og= MyDir/* MyDir/Library/* MyDir/Library/Application\ Support/*
    chmod og=x MyDir MyDir/Library MyDir/Library/Application\ Support
    chmod og=rx MyDir/Library/Application\ Support/Games
    
  2. You could actually put the contents somewhere more accessible, and make MyDir/Library/Application Support/Games a symlink to it. Potential problems with this come from programs that don't follow symlinks (especially, installers that might replace it with an actual directory -- you'd have to clean up after that one by hand). Here's an example, using /Users/Shared/Games as the public location:

    mkdir /Users/Shared/Games
    ln -s /Users/Shared/Games MyDir/Library/Application\ Support/Games
    
link|improve this answer
Thanks for the answer. Here's a question about "Go to Folder." If I make "MyDir/Library/Application Support/Games" inaccessible, but give the subfolder Read permission, can one get to that subfolder via "Go to Folder?" I need to specify the subfolder in an applications preferences page, so I only need to point to it once. – Ted Trobaugh Apr 13 '11 at 13:21
p.s. How do I put a line break in a post? – Ted Trobaugh Apr 13 '11 at 13:26
@Ted Trobaugh: Yes, Go to Folder can go "through" folders you don't have read access to, as long as you have x (search/traverse) access. It occurs to me that you could probably also hand out aliases to the folder, although I haven't tested that option. BTW, I don't think there's a way to put a line break in a comment. – Gordon Davisson Apr 13 '11 at 14:08
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.