Permissions of new files

Running Leopard Server AFP shares need to know is there a way to force new files copied to AFP shares to get the folders permissions applied automatically currently I have to propagate other wise user B cannot open content created and copied to server by user a

The short story, you should use ACLs to setup permissions the way you choose.
Any new files/folders will inherit permissions from their parent.
A few resources:
Starting on page 17 of this manual
http://manuals.info.apple.com/enUS/FileServerAdminv10.6.pdf
Pay attention to ACLs and inheritance.
And more
http://docs.info.apple.com/article.html?path=ServerAdmin/10.5/en/c1fs4.html
http://www.bresink.com/osx/193281/Docs-en/ACL.html
And of course, search the discussion forums for: ACL, Inherit, permissions, etc.
Jeff

Similar Messages

Read-only access permissions for new files/folders?

System:
Clean Install on new intel Xserve
10.4.8 Server w/ Open Directory
Windows clients can read/write completely fine...
Clients connecting using AFP (whether Standard or Kerberos authentication) can access files, but when new files/folders are created on the server, they register as full permissions for the user who created them, but not for the rest of the group.
The share(s) in question are set using POSIX from WGM: Full access for owner/group/everyone (changed it to this thinking it would help, but it does not). Of course, no one can make changes to a newly-created/deposited files/folders, which is just plain silly.
I can chmod the permissions recursively from a script (which fixes the problem, of course) on a regular basis so that its not (as much of) an issue, but there is still a 5-minute lag for the script to kick in, since we don't want to bombard the server with chmod requests every minute....which is unnecessary in the first place!
I have plenty of other setups which are identical but have no such issue...
Any reason why POSIX permissions on the share are being ignored from every user account?
Thanks,
k

"That's default posix behaviour no matter what access permissions you set on the sharepoint."
I'm afraid this is dead wrong. What matters most is how you set permissions on the share, not if you've chosen to inherit vs. using POSIX. POSIX is still used in inherit functions, though you can use ACL's to override them. In this case, ACL's are not being used on those shares (though we tried it).
After all, why would Apple (let alone anyone else) even offer the ability to change POSIX permissions on a share if it didn't have any effect? That would be somewhat contradictory in nature.
Like I said before, I have several other installations which are identically setup that have no such issues.
As for Windows, it is also not set to inherit permissions; we're setting those explicitly. And they work fine.
Any other ideas?
Thanks,
k

Home Directory Permissions on New Files/Folders

Problem: When a user creates a file or folder in the root of their home folder (ie. not in their Documents or other default folder) it is given "read" access to the "others" POSIX permission. So, anyone browsing the "users" folder on the network can view those files or folders. I would like to change this behavior so that when a user creates a file or folder, it is only read/write for the user and nothing for everyone else.

umask is not really the correct thing to do in this case, as this resets the permissions for every file the user creates. Afaik, the umask setting has to be installed on every machine via the launchd-user.conf file (to contain simply: umask 002) (or whatever is appropriate for your facility), as umask is a property of the process, not the connection.
What might work better for your problem is make the homedirs world and group non-readable. That way the user creates files within their homedirs and anywhere below, but everyone else can't read them regardless of the files' permissions because the directory itself is unreadable.

Set default permissions for new files?

We have a small LAN where different users often need to open and resave each others' files. No server, just a bunch of client computers on ethernet sharing an internet router.
Each time a user creates a file, that file's permissions default to read only for anyone but that user. How can I set up the default permissions so that any newly-created files default to Read & Write for "groups" and "others".
I anticipate I will have to make this change for each user on each workstation.
Any help would be greatly appreciated.
Thanks

If you want users to share files then have them place the file in the /Users/Shared/ folder. Files placed in that folder can be accessed by any user.
Why reward points?(Quoted from Discussions Terms of Use.)
The reward system helps to increase community participation. When a community member gives you (or another member) a reward for providing helpful advice or a solution to their question, your accumulated points will increase your status level within the community.
Members may reward you with 5 points if they deem that your reply is helpful and 10 points if you post a solution to their issue. Likewise, when you mark a reply as Helpful or Solved in your own created topic, you will be awarding the respondent with the same point values.

How do you get a new file in a shared folder to inherit permissions

I have a shared folder that I share with a co-worker and having trouble with the permissions for new files/folders.
When he creates a new file or new folder, the permissions for that file/folder are set as read only for myself. The parent shared folder is set at "Read/Write" for both of us.
Is it possible to control the permissions for new files/folders?

Actually, that property used to go in the entry for that sharepoint in the "NetInfo" database, and really only worked properly when 'afpuse_parentowner' was also set. The .plist file controls the behaviour of the afp server as a whole, not that of individual share points.
I'm not sure what the "DirectoryService" equivalent is - a lot of the things have similar names but differ in "case", but some things are completely different or absent.
Unfortunately, I'm not equipped to test these things myself but changes can be made using 'dscl', or possibly by editing the flat files directly in a manner similar to what is described here:
http://www.macgeekery.com/hacks/software/netinfo_dead

Permissions in a folder are not applied to new files added by users over shared network

New files added to a shared folder do not inherit the permissions of the folder but rather retain the permissions of the user. Because the purpose of the folder on the network is to allow multiple users access to all the files (read and write), these new files cannot be accessed and editd by others.Is there a way to have the new files automatically inherit the folder permissons? I am aware of the "Apply to enclosed items " drop-down in the Get Info window but this is not practical given the number of new files that are produced and filed.
THanks,
JD

If it's the folder is on the boot drive then the only way to accomplish this is with a combination of groups and ACL's as far as I know. There may be other ways but this is the one I know.
You say the folder is on the network but is on the boot disk, how are you setting this up and are the users accessing this all from Mac's? And they all have accounts on this Mac?
In a nutshell you would setup a group that all the users needing to access the folder belong to and then setup the ACL on the fodder so that all member's of that group will have full permission to whatever is in the folder.
So first in Users&Groups create a group for this and add all the users who need access.
The do to the folder and change its group to the group you created and change its mode to 775 (or 770 if you don't want anyone else having even read access on the folder)
Then enter this
sudo chmod -R +a "GroupNameCreated allow delete,chown,list,search,add_file,\
add_subdirectory,delete_child,file_inherit,directory_inherit" folderToChange
Now the weird thing is if you look at files in the folder they will appear to have the normal Unix mode of 644 but anyone in the group will have read, write and delete permission on the items in the folder.
I suggest you play with this on a test folder and seeing if it meets your needs before changing the working folder.
Also this will not change anything already in the folder it only applies to newly created files/folders
regards

All new files have 644 (group read only) permissions!?

Why do all new files created through AFP have rw-r--r-- (644) permissions? I haven't figured out any way to change it so the group can read and write the new files, without manually chmoding them to something useful.
OS X Server 10.3 and 10.4 didn't have this problem, nor did any other server OS I've ever used. Is this a feature? Is there something obvious I'm missing!?
The server sure doesn't seem very useful when only the person who created the file can edit it...seems to defeat the purpose of a file server, no?
Please help!

Are you using ACLs on that volume so files can inherit priviledges from the folder you put them in?
In Tiger you could choose betwen using POSIX inherited priviledges and ACLs.
In Leopard ACLs are on by default but you have to set/enforce them in Server Admin.
But I hav to admit I'm a bit bewildered about "inherit" setting in Leopard Server Admin.

File Sharing Permissions Problem When NEW Files Created

My wife & I have a home office network setup for our business, and are having trouble with shared files over the network. We're both on Macs, and all of our client files reside on an internal hard drive in my Mac Pro. I've set her up as a "Sharing Only" user on my computer (which matches the username & password of her account on her iMac), and have properly setup file sharing in both the System Preferences, and in the directory itself that we want shared. I've also applied the permissions to all files & folders below the main folder, and she can view, open and save whatever she needs and it works great.
*Here's where the problem comes in...* If either of us create a NEW file or folder, the other person doesn't have WRITE access to it (we can browse and open it fine). The second I go to update a file she created, it won't let me over-write it, and I have to go into the permissions for that specific file and give myself Read/Write access. I've experimented with "Groups", and assigned both of us a special group, and applied that group access to that directory, but it doesn't make any difference when a NEW file or folder is created - it doesn't copy the parent directory permissions to itself, it makes one of us the owner, and nobody else has access.
Is there any way around this? We're both constantly creating new files, and it really hampers our workflow to have to keep re-applying file permissions every time one of us creates something new. Ideally, any new files created within that main client folder would automatically have the same permissions as the parent directory. Any help would be greatly appreciated! Thanks!!

Here's how to do this with Access Control Lists.
1) Go to System Preferences -> Accounts. Unlock the padlock. Click the + button. Make a new group. Call this group "sharing" for the purposes of this exercise. Add the users you want to the group.
2) Make a new empty folder in /Users/Shared. Call it "sharefolder".
3) Log in to an admin account and paste all three of these lines at once into Terminal:
sudo chmod +a "sharing allow delete,chown,list,search,add_file,\
addsubdirectory,delete_child,file_inherit,directoryinherit" \
/Users/Shared/sharefolder
4) From now on, any files you create or copy to the sharefolder or to any of its subfolders will inherit read+write permission for all users in the group. If you have any existing files that you want to move into the sharefolder, a simple move by drag & drop won't cause the permissions to propagate. you need to hold down the option key while dragging them in. This will copy them over, ensuring that the ACL permission is properly inherited.
One other caveat: Files created by a small number of OS X apps won't inherit the permissions properly if saved directly into the ACL folder hierarchy. TextEdit is one such app. Save TextEdit files in a temporary location first, and then copy them in. Then they will have the correct permissions.

News files shared on Windows 8.1 PRO 64b PC are not visible by XP SP3 32bits

HEllo all,
I am sharing a directory with subdirectories on a PC running Win 8.1 (workgroup type) .
In subdirectories there are some videos files. I add regulary some files, but all my other PC running Win XP don't see the new files.
(of course F5 doesn't work)
I put a guest account in the share and security properties with read/write autorizations , then i put Everyone account with the same autorizations.
I used the ICACLS the grant inheritance to Everyone for the directory , and didn"t work too .
To make my new files to be visible by the other PC , i have to put the Share off, and share again the directory ...
And so on ...
Please can you help me ??

Hi,
Do Only PCs running Win XP have the issue? When you give guest account in the share and security properties with read/write autorizations and Everyone account with the same autorizations, please check if the new files inherit the permsisions.
You could check if Include inheritable permissions from this object's parent check box is selected.
Inherited Permissions
http://technet.microsoft.com/en-us/library/cc726071.aspx
Best Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

New files and folders on a Linux client mounting a Windows 2012 Server for NFS share do not inherit Owner and Group when SetGID bit set

Problem statement
When I mount a Windows NFS service file share using UUUA and set the Owner and Group, and set the SetGID bit on the parent folder in a hierarchy. New Files and folders inside and underneath the parent folder do not inherit the Owner and Group permissions
of the parent.
I am given to understand from this Microsoft KnowledgeBase article (http://support.microsoft.com/kb/951716/en-gb) the problem is due to the Windows implmentation of NFS Services not supporting the Solaris SystemV or BSD grpid "Semantics"
However the article says the same functionality can acheived by using ACE Inheritance in conjunction with changing the Registry setting for "KeepInheritance" to enable Inheritance propagation of the Permissions by the Windows NFS Services.
1. The Precise location of the "KeepInheritance" DWORD key appears to have "moved" in Windows Server 2012 from a Services path to a Software path, is this documented somewhere? And after enabling it, (or creating it in the previous
location) the feature seems non-functional. Is there a method to file a Bug with Microsoft for this Feature?
2. All of the references on demonstrating how to set an ACE to achieve the same result "currently" either lead to broken links on Microsoft technical websites, or are not explicit they are vague or circumreferential. There are no plain Examples.
Can an Example be provided?
3. Is UUUA compatible with the method of setting ACE to acheive this result, or must the Linux client mount be "Mapped" using an Authentication source. And could that be with the new Flat File passwd and group files in c:\windows\system32\drivers\etc
and is there an Example available.
Scenario:
Windows Server 2012 Standard
File Server (Role)
+- Server for NFS (Role) << -- installed
General --
Folder path: F:\Shares\raid-6-array
Remote path: fs4:/raid-6-array
Protocol: NFS
Authentication --
No server authentication
+- No server authentication (AUTH_SYS)
++- Enable unmapped user access
+++- Allow unmapped user access by UID/GID
Share Permissions --
Name: linux_nfs_client.host.edu
Permissions: Read/Write
Root Access: Allowed
Encoding: ANSI
NTFS Permissions --
Type: Allow
Principal: BUILTIN\Administrators
Access: Full Control
Applies to: This folder only
Type: Allow
Principal: NT AUTHORITY\SYSTEM
Access: Full Control
Applies to: This folder only
-- John Willis, Facebook: John-Willis, Skype: john.willis7416

I'm making some "major" progress on this problem.
1. Apparently the "semantics" issue to honor SGID or grpid in NFS on the server side or the client side has been debated for some time. It also existed as of 2009 between Solaris nfs server and Linux nfs clients. The Linux community defaulted to declaring
it a "Server" side issue to avoid "Race" conditions between simultaneous access users and the local file system daemons. The client would have to "check" for the SGID and reformulate its CREATE request to specify the Secondary group it would have to "notice"
by which time it could have changed on the server. SUN declined to fix it.. even though there were reports it did not behave the same between nfs3 vs nfs4 daemons.. which might be because nfs4 servers have local ACL or ACE entries to process.. and a new local/nfs
"inheritance" scheme to worry about honoring.. that could place it in conflict with remote access.. and push the responsibility "outwards" to the nfs client.. introducing a race condition, necessitating "locking" semantics.
This article covers that discovery and no resolution - http://thr3ads.net/zfs-discuss/2009/10/569334-CR6894234-improved-sgid-directory-compatibility-with-non-Solaris-NFS-clients
2. A much Older Microsoft Knowledge Based article had explicit examples of using Windows ACEs and Inheritance to "mitigate" the issue.. basically the nfs client "cannot" update an ACE to make it "Inheritable" [-but-] a Windows side Admin or Windows User
[-can-] update or promote an existing ACE to "Inheritable"
Here are the pertinent statements -
"In Windows Services for UNIX 2.3, you can use the KeepInheritance registry value to set inheritable ACEs and to make sure that these ACEs apply to newly created files and folders on NFS shares."
"Note About the Permissions That Are Set by NFS Clients
The KeepInheritance option only applies ACEs that have inheritance enabled. Any permissions that are set by an NFS client will
only apply to that file or folder, so the resulting ACEs created by an NFS client will
not have inheritance set."
"So
If you want a folder's permissions to be inherited to new subfolders and files, you must set its permissions from the Windows NFS server because the permissions that are set by NFS clients only apply to the folder itself."
http://support.microsoft.com/default.aspx?scid=kb;en-us;321049
3. I have set up a Windows 2008r2 NFS server and mounted it with a Redhat Enteprise Linux 5 release 10 x86_64 server [Oct 31, 2013] and so far this does appear to be the case.
4. In order to mount and then switch user to a non-root user to create subdirectories and files, I had to mount the NFS share (after enabling Anonymous AUTH_SYS mapping) this is not a good thing, but it was because I have been using UUUA - Unmapped Unix
User Access Mapping, which makes no attempt to "map" a Unix UID/GID set by the NFS client to a Windows User account.
To verify the Inheritance of additional ACEs on new subdirectories and files created by a non-root Unix user, on the Windows NFS server I used the right click properties, security tab context menu, then Advanced to list all the ACEs and looked at the far
Column reflecting if it applied to [This folder only, or This folder and Subdirectories, or This folder and subdirectories and files]
5. All new Subdirectories and files createdby the non-root user had a [Non-Inheritance] ACE created for them.
6. I turned a [Non-Inheritance] ACE into an [Inheritance] ACE by selecting it then clicking [Edit] and using the Drop down to select [This folder, subdirs and files] then I went back to the NFS client and created more subdirs and files. Then back to the
Windows NFS server and checked the new subdirs and folders and they did Inherit the Windows NFS server ACE! - However the UID/GID of the subdirs and folders remained unchanged, they did not reflect the new "Effective" ownership or group membership.
7. I "believe" because I was using UUUA and working "behind" the UID/GID presentation layer for the NFS client, it did not update that presentation layer. It might do that "if" I were using a Mapping mechanism and mapped UID/GID to Windows User SIDs and
Group SIDs. Windows 2008r2 no longer has a "simple" Mapping server, it does not accept flat text files and requires a Schema extension to Active Directory just to MAP a windows account to a UID/GID.. a lot of overhead. Windows Server 2012 accepts flat text
files like /etc/passwd and /etc/group to perform this function and is next on my list of things to see if that will update the UID/GID based on the Windows ACE entries. Since the Local ACE take precedence "over" Inherited ACEs there could be a problem. The
Inheritance appears to be intended [only] to retain Administrative rights over user created subdirs and files by adding an additional ACE at the time of creation.
8. I did verify from the NFS client side in Linux that "Even though" the UID/GID seem to reflect the local non-root user should not have the ability to traverse or create new files, the "phantom" NFS Server ACEs are in place and do permit the function..
reconciling the "view" with "reality" appears problematic, unless the User Mapping will update "effective" rights and ownership in the "view"
-- John Willis, Facebook: John-Willis, Skype: john.willis7416

Pages 5.1 is unable to save a new file

If I start a new Pages (5.1) document, I cannot save it. Also, if I duplicate a Pages document that I can open and continue to work on, I cannot save this duplicate document either. It does not matter what folder I select, new or existing. I get the error dialog " 'filename.pages' couldn't be moved because you don't have permission to access 'folder name'." To view or change permissions, select the item in the Finder and choose File > Get Info. I checked in the Finder and I have read/write permisson to any/all folders in question. This happens to all folders, including Documents. But I can continue to work on any existing Pages file and save the changes.
If I bring up Finder and make a copy of an existing Pages document that I can work with in the same folder and try to open the copy via Pages, I get the error dialog " 'filename' can't be opened" with no further explanation.
Haven't got any file system issues I know of other than this Pages error in normal computer use. I am on Mavericks 10.9.2.
Any ideas?
Thanks.

Apple pushed Page 5.1 (1769) upgrade this morning. I tried that and, just like magic, the permissions issue simply dissapeared. Now Pages can create new files and save them as well as do any operation that require saving (exporting to PDF) etc. to local disk.
I don't know if anyone else is experiencing this problem, but seems like installing an update might just do the trick.
Peter, if you are reading, do you have a suggestion as to how exactly to remove Pages (including misc. system files it has on the system) so that I can force Mac App Store to reinstall Pages if this happens again.
Most people suggest clicking "Purchases" button on the App Store while holding down the 'Option' key. Since I have a mini I am using a regular PC keyboard and I tried using the Alt key instead but no luck.
Thanks.

When I try to save a new file from numbers, I'm given the error of it can't create a file. why would that be?

when I try to save a new file from numbers, I'm given the error of it can't create a file. why would that be?

Try using /Applications/Utilities/Disk Utility to repair file permissions.
Bob

Recently updated Mac OS 10.5.8 to 10.6.8 and and can not open exisiting Illustrator5 files or save new files.

I recently updated my MacBook Pro OS from 10.5.8 to 10.6.8 and can not open existing Illustrator5 files or save new files can someone help?

I think you have a corrupted upgrade. Do you have a backup of your old system?
Here's what you should do for now:
Reinstall OS X without erasing the drive
1. Repair the Hard Drive and Permissions
Boot from your Snow Leopard Installer disc. After the installer loads select your language and click on the Continue button. When the menu bar appears select Disk Utility from the Utilities menu. After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the installer.
If DU reports errors it cannot fix, then you will need Disk Warrior and/or Tech Tool Pro to repair the drive. If you don't have either of them or if neither of them can fix the drive, then you will need to reformat the drive and reinstall OS X.
2. Reinstall Snow Leopard
If the drive is OK then quit DU and return to the installer. Proceed with reinstalling OS X. Note that the Snow Leopard installer will not erase your drive or disturb your files. After installing a fresh copy of OS X the installer will move your Home folder, third-party applications, support items, and network preferences into the newly installed system.
Download and install Mac OS X 10.6.8 Update Combo v1.1.

HELP! Serious problem: Time Machine does note seem to back up newer files

I have a serious Time Machine issue. I noticed that after the initial backup of about 110gb, it seems to stopped backing up recently added files. Like for example, I downloaded a file into my Desktop at 6 hours ago and the file is still there right now but when I go to Time Machine, the file is not in any previous hourly back ups even though some if them were taken after I added the files.
I also tried ripping a DVD and placed the file into my Movies folder, but the same thing happen. I tried "Back Up Now" to see if the files will be added, but the 700mb file does not get copied. I watched the system preferences and it only copied 5mb of file. Why is this happening?
Also, my when I first started Time Machine backups a few hours ago, my Documents folder has 34 files in it. It now has 48 files with files being added regualrly during the next few hours but when I looked at ALL the hourly backups, they are still showing that I have 34 files!!!
Please help. I have a 500gb External Hard drive that I formatted using GUID partition scheme. It does have a SuperDuper ackup of it of my Tiger. Do I have to reformat the drive and have Time Machine start on a completely new drive?
Thansk a lot!

I have been having the same problem for some time now and only noticed it when I tried to recover a file only to find it had not been backed up. Brief details
* The initial backup (apprx 105GB) completes ok - I have checked this
* Subsequent new files are not added to the backup. I have checked this both via the Time Machine application and manually searching through the backup drive. I have also tried this with different types of files; mp4, xls, doc, text, email messages in mail etc. none get backed up. I have also tried amending an existing file but the amended file is not backed up
* Nevertheless the console log shows that the hourly back ups are being completed with no apparent problems
* I do not have any exclusions selected in Time Machine preferences
* I have not been able to replicate this consistently but occasionally after a reboot I get this console log message
12/26/07 8:23:36 PM /System/Library/CoreServices/backupd693 Event store UUIDs don't match for volume Macintosh HD II
12/26/07 8:23:37 PM /System/Library/CoreServices/backupd693 Node requires deep traversal:/ reason:kFSEDBEventFlagMustScanSubDirs|kFSEDBEventFlagReasonEventDBUntrustable|
HD II is my backup drive. Time Machine then appears to start a more extensive backup. I do not think it is a full backup as it takes no more than 10minutes. Once this finishes the backup then looks accurate with all files present. However the error then re-occurs and no new files are added to the backup
* I have spoken to Apple Care but no idea
* I have tried all of the following in no particular order; repair permissions; reformat the backup drive; delete .plist file; reset NVRAM; alternative drive; force a rebuild of the spotlight database; my host name does not include any odd characters etc etc
All very tedious...any insight greatly appreciated

Can't create new files in Illustrator CS5

We have a couple of custom New Document Profiles as well as the standard ones for Illustrator. When I launch the Illustrator it opens fine. I can create a single new file and if I keep that file open and create more new files after it they open fine as well, but if I close the files and then try to create another new file nothing happens. It doesn't matter which profile I use. If I shut down and restart Illustrator I can create a new file again.
I checked permissions on the ~/Library/Application Support/Adobe/Adobe Illustrator CS5.1/en_US/New Document Profiles folder and I have read/write to it and all contents.
Any suggestions on why this might be happening and what to do to resolve the issue?
Thanks in advance for any help!

Ok, think I figured this one out. We had the option under Type Preferences to Show Font Names in English selected. Apparently this causes some kind of conflict. I realized after posting above, that something was happening when we were changing our preferences to cause this. So I went through each preference panel, made my changes and quit then restarted Illustrator until I got to the one that brought the problem back. I could reproduce the error by turning this option on and eliminate it by turning it off. So I'm going to assume that is the cause. If I find out any different down the road I'll post back, but for now I'm considering it mystery solved.

Permissions of new files

Similar Messages

Maybe you are looking for