This is what happens - but why?

liuxiang@MacBookPro: ~/casecode/sh $ ls -l sa 
-rwx---rwx  1 root  admin  55 10 21 00:07 sa
liuxiang@MacBookPro: ~/casecode/sh $ cat sa
cat: sa: Permission denied
liuxiang@MacBookPro: ~/casecode/sh $ date >> sa
-bash: sa: Permission denied
liuxiang@MacBookPro: ~/casecode/sh $ ./sa
-bash: ./sa: Permission denied
  • What's the output of 'id'? – Emil Sit Oct 21 '09 at 16:41
  • 1
    What does ls -e show? (shows the ACL) – mmmmmm Oct 21 '09 at 19:57

As with most other UNIX-like operating systems, Macintosh lets you control access to a file with POSIX permissions. However, starting with Mac OS/X 10.4 (Tiger), the Macintosh file and operating system lets you (optionally) set an Access Control List. Access control lists give an administrator far more control than the regular POSIX permissions (ACLs are mostly used in work environments).

As an aside note, Windows has supported ACLs since Windows NT; and certain versions of Linux do as well. Also, there's a great article about Access Control Lists in Macintosh on Ars Technica.

Anyway, according to the Mac OS X Server v10.6 - User Management guide (see page 28), if there is one or more ACL rules set for the file and one of those ACL rules apply to you, then the ACL rules take precedence over the regular POSIX permissions.

In your case, your file is owned by the "root" user (the "superuser"), and belongs to the "admin" group (only users marked as "Administrators" in the Accounts pane of System Preferences belong to this group). The POSIX permissions on your file are set to allow root to read, write and execute the file; denies all access for the "admin" group, and allow other users to read, write and execute it. As you demonstrated, you should be allowed to do whatever you want to this file! Don't worry though; you're not going crazy (which is always reassuring to know ^_^)... it appears that an ACL rule is getting in the way and overriding the file's POSIX permissions.

This is why Mark asked:

What does ls -e show?

... ls -e shows the Access Control List rules for that file. Apparently, if you happen to have Macintosh Server, there's a nice panel to let you manage all the rules. (There's also a limited one in the regular Finder's "Get Info" dialog... find the file in the Finder and hit Command+i to "Get Info" for it... expanding the "Sharing and Permissions" pane at the bottom of the window will show you some of the ACL rules... you will have to unlock this pane to change the permissions though).

If the Finder way doesn't work, you will have to try ls -e. Hopefully the ACL rules that it prints out won't be too complicated. There's a handy ACL reference in the Security Overview paper in the Macintosh Dev Center though. Feel free to reply to this post if you need additional help.

In your case, even if you know the ACL rules, you won't be able to do much about it... only the owner (or the superuser, which in your case is the owner as well) can change it; and only people who are part of the "admin" group (which you say that you don't belong to) can act on behalf of the superuser. However, if you want to try, you (or someone that is an administrator) can change to the directory containing the file and run one or more of the following commands:

sudo chmod +a "liuxiang allow read" sa # to enable reading

sudo chmod +a "liuxiang allow write" sa # to enable writing

sudo chmod +a "liuxiang allow execute" sa # to enable executing it

... (or something similar) to fix it (it will prompt you for the password of the person who's running the command).

I hope that helps!


Look here: Command to unlock "Locked" files on OS X

Maybe that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy