Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Our product is an Audio Units that needs to be installed in /Library/Audio/Plug-Ins/Components/

In order to allow automatic updates, we need to create the Audio-Unit bundle (ourapp.component) with the lowest possible permissions.

  • What should we set as the owner/group permissions?

  • We can set the group to 'staff', but what about the owner?

share|improve this question
1  
Tip, there's a stackexchange for Apple related questions apple.stackexchange.com –  JohannesM Apr 2 '12 at 15:03
    
@JohannesM: Tip, OS X questions are welcome on Super User too. –  Tom Wijsman Apr 2 '12 at 21:21
    
@Tom Wijsman: thought the had better chances there with this related question. Still learning how this works out here :) –  JohannesM Apr 3 '12 at 10:22
    
@JohannesM: No problem, welcome to Super User. Depends on the user, depends on the question. This question is regarding Unix permissions and so is kind of OS-independent, strictly one could say that this has nothing to do with Apple and really strictly one could think this belongs to unix.stackexchange.com. But unless the FAQ explicitly prohibits a certain scope we generally don't migrate unless it would really benefit the question. This was covered in a recent blog post... :) –  Tom Wijsman Apr 3 '12 at 10:27
add comment

1 Answer

up vote 1 down vote accepted
+50

Based on your Stack Overflow question

Though your installer may have run as admin (for a number of reasons, including where the AU is located in the file system, etc.), your AU may not have the permissions to perform the method above. On the other hand, you can have your AU operate where it has appropriate permissions.

If you want every user to be able to automatically update it without adminitrator permissions, I propose:

Reasonable permissions seem 774, where you grant every user the ability to automatically update it (read, write, execute) and others can only read it. Because the user and group have the same permissions, it doesn't mather what user is set. This will most likely be the user that installed the files, which is either as user or an administrator account. As for the group, staff would indeed make sense.

So, to summarize:

drwxrwxr-- 1 root staff   1970 Jan 01 00:00 Audio Unit

If there is no executable code, you could use 764:

drw-rw-r-- 1 root staff   1970 Jan 01 00:00 Audio Unit

Based on my security considerations

I don't see what credible sources are needed for, you either grant users the right to automatically update or you don't, there is no in between. Just think thoroughly about both possibilties, and then you get to the point you think is right. I don't really like the above approach so will outline a more secure approach here. For security considerations, you could only let the administrator update the bundle, here is why:

  1. User messes around with stuff in the folder.

  2. Other user uses or executes it and loses valuable time or his/her files.

  3. The administrator (and/or developer) is to blame.

So, in this case I would suggest 764 instead, summarized:

drwxr-xr-- 1 root staff   1970 Jan 01 00:00 Audio Unit

If there is no executable code, you could use 744:

drw-r--r-- 1 root staff   1970 Jan 01 00:00 Audio Unit
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.