UME: Regular Permissions - ACL Permissions

Gentelmen,
After reading recently published SDN article about WD security (Aug 31, 2004 -- https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sapportals.km.docs/documents/a1-8-4/web dynpro security.pdf), one question araise for me: what is a connection (if any) between regular UME permissions (in fact, std. java permissions) and UME ACL permission?
Any thoughts?
VS

[ -closed with no resolution- ]

Similar Messages

Why can't I change ACL permissions of a volume on mac os x 10.6

Hello,
I'm currently working with a Mac OS X 10.6.8 Server with 2x1TB drive installed in RAID configuration (/Volumes/LTRK) and 1x2TB installed as a regular volume (/Volumes/LTRK2/). For both volumes I could set all permissions perfectly, but recently, I cannot change the permissions on the 2TB volume. I have the following current permissions:
ACL:
Group of regular division members (read + all descendants)
Group of ICT co-workers (read/write + all descendants)
Administrators (read/write + all descendants)
Everyone (read + all descendants)
POSIX:
The admin user account (read/write + this folder)
The 'staff' group which is automatically there (read/write + this folder)
Others (read + this folder)
If I compare to the drive where I can change the permissions and where everything works correctly (the RAID config), the only difference is that the 'Everyone' group permissions are not set to be inherited for the working drive (so only on the volume level). I wanted to check whether this was the source of my problems and tried to change the permissions of the 'Everyone' group. However, as soon as I click Save in Server Admin, it automatically reverts to all descendants.
The results of the failure to reset the permissions, leads to the fact that I don't have write access anymore with the admin user accound (I guess due to counteracting permissions). I also tried to delete all permissions from the volume with "chmod -R -N /Volumes/LTRK2" but this gives me a list of every file on that volume, with the error message: "chmod: Filed to clear ACL on file filename: Invalid argument"
Does anyone have any suggestions on how to solve this issue?
Kind regards

Welcome to iMovie Discussions.
See my 2nd reply to 'getzcreative', here.

User Level permissions (ACLs) - HOW?

Dear Expert,
One more victim of Mackeeper writing to you seeking help...
I tried my best to remove it from the comp and I have succeded.
However, I am stuck at 2 points:
1) How User Level permissions (ACLs)? Please guide....
2) Mackeeper keeps opening pages in safari on its own, whenever I open a new tab. Please GUIDE.
Please help.....
Look forward to receiving valuable inputs.
Regards,
Sony Thadani

There is no need to download anything to solve this problem.
You may have installed the "Downlite" or "VSearch" ad-injection malware. Follow the instructions on this Apple Support page to remove it. It's been reported that some variants of the malware block access to the page. If that happens, start in safe mode by holding down the shift key at the startup chime, then try again.
Back up all data before making any changes.
One of the steps in the article is to remove malicious Safari extensions. Do the equivalent in the Chrome and Firefox browsers, if you use either of those. If Safari crashes on launch, skip that step and come back to it after you've done everything else.
If you don't find any of the files or extensions listed, or if removing them doesn't stop the ad injection, then you may have an adware variant not covered by the support article. Ask for instructions in that case.
The problem may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it, and if you wish, replace it with the genuine article from mplayerx.org.
This malware is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.
In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.
Still in System Preferences, open the App Store or Software Update pane and check the box marked
Install system data files and security updates
if it's not already checked.

Which command line to delete all ACL permissions ?

Hi,
I would like to clean all old ACL permissions in folders and sub-folders, to put on the main share folder the right ACL's and distribute them.
It seems it's impossible in Server Admin interface. Which is the command line able to do that ?
I believe it's something like chmod ???
Thanks for your response.
Patrick

chmod -N is the command to remove ACLs. -R runs recursively, therefore to recursively remove all ACLs from a directory tree:
sudo chmod -R -N /path/to/dir

Cleaning up ACL/Permissions

Hi, in working on an Advanced Leopard server that someone had setup... I'm seeing ACL permissions listed for system level directories and files. To my knowledge, they shouldn't be there, is this a correct, in a normal install ACL's are not in use here?
In any case, with all the overalpping individual users based ACL's used in the general data files, I'd like to cclear them all out, if advisable, and start with some new one's based on gorups.
Can someone advise as to the best way to clean things up, without harming file access? - Lewis

Hi again.
When setting/deleting acls via the commandline the changes will be reflected in the GUI as it is calling the same underlying tool. You could test this yourself by setting some acls on a test file in the GUI and then listing the acls via the ls -le command in the terminal then run the chmod -N command and repeat the ls -le command.
If you do this with the sharing 'browse' pane of Server Admin open in the background you will see the changes as they happen.
A couple of interesting articles on the subject here and here
Cheers

Default acl permissions for root and user?

after running permissions i keep getting acl permissions changed and will repair. Apparently it doesn't. Is their a manual way of resetting to defaults for both root and user.

Turns out they didn't change themselves, but authentication got out of whack. This post fixed it for me, but I just jogged access on ical and blogs. Not sure which or both is needed, but after I toggled them over and back I was up and running again.
<SNIP>
Solution found athttp://michaeljin.wordpress.com/2010/01/05/locked-out-of-mac-os-x-server/
It’s blog update time! Updates have been a little scarce lately, been super busy with getting trophies on PS3
Anyway, recently encountered the following with a Mac mini server running Snow Leopard Server:
Despite being able to ARD / Screenshare the Mac mini, I was unable to get any further than the login window. Authentication credentials are obviously valid. No weird access permissions have been set. However, the weird thing was, I can connect to the server via Server Admin tools (from another Mac) and all other services were running without a hitch.
After much head scratching it turns out to be a sACL (Service Access Control List) issue.
This thread solved the mystery!
http://discussions.apple.com/thread.jspa?threadID=1654864
To save you the trouble, I’ll lay it out here. I cannot take credit for this, but Randall can!
Open Server Admin on a computer (any), and connect with the local admin to the machine.
Select the server and authenticate.
Select Settings, then go to Access. You’ll want to make sure that Login Window and SSH have the local admin account listed if you select the option to “Allow only these users”. For now, I would suggest making sure all services have “Allow all users and groups” selected.
If (as in my case) it was set to Allow All in the first place, simply toggle the settings – back and forth.
Save.
Try logging in again… should be a good one!
</SNIP>

WCCP Deny and permit ACL on 3750

Hi everyone,
I have configured 3750 switch as WCCP.
I am redirecting only inside traffic.
Switch has direct connection to Mcafee Gateway.
Our internal LAN subnets are 172.16.x.x and 192.168.0.0.
Need to confirm if i want internal users to access the internet then under permit ACL i can say
permit 172.16.0.0 to any?
If i want some users traffic should not be redirected to Mcafee gateway then i can say
deny 172.16.10.10 any?
Regards
MAhesh

Hi Reuben,
Yes IOS version is higher than 12.2(58)SE.
Thanks for reply.
Regards
MAhesh

When I repair disk permissions I get the following:Repairing permissions for "MacIntosh HD" Determining correct file permissions. Permissions differ on ./Library/Widgets, should be drwxr-xr-x , they are drwxrwxr-x Owner and group corrected on ./Library/W

Repairing permissions for “MacIntosh HD”
Determining correct file permissions.
Permissions differ on ./Library/Widgets, should be drwxr-xr-x , they are drwxrwxr-x
Owner and group corrected on ./Library/Widgets
Permissions corrected on ./Library/Widgets
Permissions differ on ./System/Library/User Template, should be drwx------ , they are drwxr-xr-x
Owner and group corrected on ./System/Library/User Template
Permissions corrected on ./System/Library/User Template
Group differs on ./usr/bin/fetchmail, should be 0, group is 6
Permissions differ on ./usr/bin/fetchmail, should be -rwxr-xr-x , they are -rwxr-sr-x
Owner and group corrected on ./usr/bin/fetchmail
Permissions corrected on ./usr/bin/fetchmail
Permissions differ on ./usr/lib/php/build/Makefile.global, should be -r--r--r-- , they are -r-xr-xr-x
Owner and group corrected on ./usr/lib/php/build/Makefile.global
Permissions corrected on ./usr/lib/php/build/Makefile.global
Permissions differ on ./usr/lib/php/build/acinclude.m4, should be -r--r--r-- , they are -r-xr-xr-x
Owner and group corrected on ./usr/lib/php/build/acinclude.m4
Permissions corrected on ./usr/lib/php/build/acinclude.m4
Permissions differ on ./usr/lib/php/build/mkdep.awk, should be -r--r--r-- , they are -r-xr-xr-x
Owner and group corrected on ./usr/lib/php/build/mkdep.awk
Permissions corrected on ./usr/lib/php/build/mkdep.awk
Permissions differ on ./usr/lib/php/build/phpize.m4, should be -r--r--r-- , they are -r-xr-xr-x
Owner and group corrected on ./usr/lib/php/build/phpize.m4
Permissions corrected on ./usr/lib/php/build/phpize.m4
Permissions differ on ./usr/lib/php/build/scan_makefile_in.awk, should be -r--r--r-- , they are -r-xr-xr-x
Owner and group corrected on ./usr/lib/php/build/scan_makefile_in.awk
Permissions corrected on ./usr/lib/php/build/scan_makefile_in.awk
Permissions differ on ./usr/lib/system/libmathCommon.A.dylib, should be -r-xr-xr-x , they are -rwxr-xr-x
Owner and group corrected on ./usr/lib/system/libmathCommon.A.dylib
Permissions corrected on ./usr/lib/system/libmathCommon.A.dylib
Permissions differ on ./usr/libexec/dumpemacs, should be -r-sr-xr-x , they are -r-xr-xr-x
Owner and group corrected on ./usr/libexec/dumpemacs
Permissions corrected on ./usr/libexec/dumpemacs
Permissions repair complete
The privileges have been verified or repaired on the selected volume
Then I sometimes get the brown screen that states,You must re-start your computer.
I have already zeroed out the hard drive and re-installed Panther and the upgrade Tiger disc.
I repair permissions using the Tiger disc upgrade.
Can anyone help me with this??

> I repair permissions using the Tiger disc upgrade.
One thing to note... When running Repair Disk Permissions, it is best to run it while started up normally, from your normal startup disk, not from a Mac OS X installation disc. The only time you should run it while started up from an installation disc is if some problem is preventing you from starting up normally. OTOH, Repair Disk can only be used when starting up from a different disk (such as an installation disc).
So, I would start up normally, run Disk Utility, and use Repair Disk Permissions on your normal startup disk.
NOTE: Repair Disk Permissions often gives alerts messages that can be ignored. They are more "informational," not serious errors.
http://support.apple.com/kb/TS1448
You should still run it periodically. When you run it, what needs to be repaired has been repaired; consider the rest of it an FYI. I've never experience a problem, where a Repair Disk Permissions message actually caused a problem. But, if you ever get an error while running Repair Disk (or Verify Disk), that is usually a serious problem.

Startup Permissions & File Permissions

Recently, something went wrong within my computer. I'm not sure what it was, but a lot of the file permissions got screwed up. I can no longer use VMware Fusion, as it claims that it does not have the rights to run the program and to access all directories it uses for files, and so on. Also, at startup, I get a whole flood of warning messages saying that startup items were omitted due to lack of correct permissions. Is there some way to just set all file permissions back to default to end this misery?
I have already spent two days researching, and I'm wondering if someone has found a way to solve this.
Keep this in mind: Most people will say, "Reinstall your OS and all your programs." Here is my problem: I purchased this computer legally with a huge bundle of software, including CS5 and Final Cut Studio. They are both legal, but unfortunately, I don't have the installation stuff for them. So, does anyone have any suggestions?
I don't want to re-install my OS - that would hurt everything I have.
My computer specs, because someone is bound to ask for them:
Intel Core i5
8GB RAM
512MB VRam
MacOSX Snow Leopard (10.6, I believe)
In dire need of good help! Thanks, I'm glad I found this community. If this question has already been answered, please link me the page. I couldn't find it.
Colin

Here is something else that may help you: I tried using the Disk Utility to repair the permissions, but it simply does this every time I tell it to repair the permissions:
Repairing permissions for “Macintosh HD”
Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Italian.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .
Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/Italian.lproj/UIAgent.nib".
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Classes/jconsole.jar ", should be -rw-r--r-- , they are lrwxr-xr-x .
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Classes/jconsole.jar ".
User differs on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Home/lib", should be 95, user is 0.
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Home/lib".
User differs on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Libraries", should be 95, user is 0.
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Libraries".
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/ Contents/Home/lib/security/cacerts", should be -rw-r--r-- , they are lrwxr-xr-x .
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/ Contents/Home/lib/security/cacerts".
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/ Contents/Resources/Java/deploy.jar", should be -rw-r--r-- , they are lrwxr-xr-x .
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/ Contents/Resources/Java/deploy.jar".
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/ Contents/Resources/Java/libdeploy.jnilib", should be -rwxr-xr-x , they are lrwxr-xr-x .
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/ Contents/Resources/Java/libdeploy.jnilib".
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPlugin Cocoa.bundle/Contents/Resources/Java/deploy.jar", should be -rw-r--r-- , they are lrwxr-xr-x .
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPlugin Cocoa.bundle/Contents/Resources/Java/deploy.jar".
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPlugin Cocoa.bundle/Contents/Resources/Java/libdeploy.jnilib", should be -rwxr-xr-x , they are lrwxr-xr-x .
Repaired "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPlugin Cocoa.bundle/Contents/Resources/Java/libdeploy.jnilib".
Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/English.lproj/RemoteDesktopMenu.ni b", should be drwxr-xr-x , they are -rwxr-xr-x .
Repaired "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/Resources/English.lproj/RemoteDesktopMenu.ni b".
Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired.
Permissions differ on "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/English.lproj/UIAgent.nib", should be drwxr-xr-x , they are -rwxr-xr-x .
Repaired "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/Rem ote Desktop Message.app/Contents/Resources/English.lproj/UIAgent.nib".
Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/English.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .
Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreen.app/Contents/Resources/English.lproj/MainMenu.nib".
Permissions differ on "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/English.lproj/MainMenu.nib", should be drwxr-xr-x , they are -rwxr-xr-x .
Repaired "System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Su pport/LockScreenLeopard386.app/Contents/Resources/English.lproj/MainMenu.nib".
Permissions repair complete
And here is terminal after the repair, including every line created since the beginning of the repair.
I hope this will act as another clue, and I really hope this doesn increase the headache of the situation at hand.

Repair Disk Permissions - ACL Errors

I opened Disk Utility and repaired disk permissions last night and was surprised to find six errors. I ran it again, and the first three errors disappeared. But the other three remain even after I repaired disk permissions two more times.
These are the errors:
ACL found but not expected on "Applications/Utilities".
ACL found but not expected on "Applications".
ACL found but not expected on "Library".
Does anyone know what they mean, and how I can fix them?
Thanks.

Hi, they were common before the update to 10.5.2, and than they went away for the most part. There is much information on them with a search. Google the ACL errors and you will see what I mean. I hesitate to offer a solution because there's so many conflicting statements.
Ray

Does FCSvr read ACL permissions set in OD?

We have set up a series of permissions using ACL's within OD. I assumed that FCSvr would pick up these permissions to certain areas of an Xsan. However within FCSvr you can still see media from areas that have been denied to certain users - set up in OD.
Within FCSvr, I have created further permissions within the permission sets for each user group. But, because these are driven by metadata, it then causes further access problems with any media that is scanned in or comes from a watch folder- as metadata is not inputted straight away for this media. My next thought now is to break the areas in the Xsan down as Devices, and then set permissions to these in Fcsvr admin, but I have read in another forum that there is a bug with this process as it denies access to the wrong areas and can mess up the look of the interface.
Really, FCSvr should be able to read the ACL's in OD, surely?
Any advice appreciated.

Actually, FCSvr always operates as admin. It is as if every user is the admin user when working with the devices of FCSvr. As you noted, the only way to limit permissions in FCSvr are via metadata filtering, traits, and devices.
You should divvy up your SAN into multiple devices. This used to be a problem, but in v1.1.1 the interface problems related to device permissions have been corrected. You can restrict access and activity device by device, group by group. You can also set metadata during scans and with subscriptions + set asset metadata responses. My file naming convention allows me to have FCSvr automatically fill in six different fields just from creating the asset (assuming my users name their files properly of course, but there's only so much an admin can do).

Disk Permissions: ACL Found

I ran "Repair Disk Permissions" with the following result:
ACL found but not expected on "private/var/root".
Repaired "private/var/root".
ACL found but not expected on "private/var/root/Library".
Repaired "private/var/root/Library".
ACL found but not expected on "private/var/root/Library/Preferences".
Repaired "private/var/root/Library/Preferences".
I then ran Verify Disk Permissions with the following results:
ACL found but not expected on "private/var/root".
ACL found but not expected on "private/var/root/Library".
ACL found but not expected on "private/var/root/Library/Preferences".
Why are these ACL's show up after they have been repaired?

Hello M:
I think "ACL" refers to access control list which seems to be something used in wireless configurations (I have no wireless things in my network).
Why are these ACL's show up after they have been repaired?
I assume that this is the reason:
found but not expected
Unless you are having problems, I would completely ignore the messages. As an aside, running permission repair is, IMHO, a waste of time (although I admit I do it myself after software updates)
Barry

Question about ACL permissions

I have a situation and i wounder how to set up the permissions to make it work.
I have a folder (the share point) with ~200 subfolders,(called -1000,-2000, -3000, etc etc) In these folders there are tons of pictures.
I want a group(picturesRW) to be able to Read all files/folders, change name on the files (but not on the folders) and also add new files, but not delete(files or folders) Also not to move folders in to other folders (if that is possible).
Then i want another group to be able to just read everything, but thats the easy part.
Hoping there is someone that knows how to set this up. Have tried with allowing "Write attributes" but they still cant rename files..
Cheers!

Hi
A good place to start in my opinion in understanding ACLs is Gerrit de Witt's excellent series of posts:
http://discussions.apple.com/thread.jspa?messageID=1535247
If you have not already done so download the Admin Manuals:
http://manuals.info.apple.com/en/UserManagement_Adminv10.4.pdf
http://images.apple.com/server/macosx/docs/UserManagementv10.5.mnl.pdf
Bear in mind that on 10.4 Server you have to enable ACLs on a volume, followed by a restart otherwise the ACLs don't take and all that is working is the standard POSIX permissions. 10.5 Server has ACLs enabled by default. If you don't want them you have use terminal to disable them. You can't have ACLs without standard POSIX. Both permissions models apply and are accumulative. You can use standard POSIX permissions without ACLs. Be careful when using both models to define an access policy as a deny using both models can easily lock you out of the server. Use WGM when applying permissions. Don't be tempted to do it using the Finder. Defining permissions using terminal - in my opinion - is better but it is not to everyone's taste. ACLs should take precedence over standard POSIX permissions.
Hope this helps, Tony

Transport KM ACL permissions without content

Hallo
Is it possible to transport ACL KM permissions without transporting the content in the KM folders?
As fare as I can see, it is only possible to transport the ACL permission if I select the import mode u201CDelete Conflicting Data Firstu201D. Thus that our solution is in production, this is not an option.
I have a situation where I need to change a significant number of KM folder permissions and I would like to avoid doing this manually in all 3 portal environments (development, test and production).
I have looked at the u201CPropagation of ACLsu201D report but I can not define a single template folder u2013 I have around 40 different settings, which have to be applied in 3 different repositories.
We are on NW 7, SP16.
Thanks in advance,
Henrik Andersen

Hi Henrik,
I have the exact same query, although I envy you as you only have 40 setting (I have 30 times 160).
The reply from Julian is correct altough needs custom development.
Hopefully SAP will introduce a ACL Export / Import function soon... They already have something similair for assinging roles as you can export assignments to text and import them again OR like the PCD objects XML import/export...
Only thing I can do is share my current workaround I did (note this action needs to be done in planned downtime as the content will be unavailible for a while).
on the source system
1. run KM toolbox > Report > Mass copy with ACL to a temp repository
(only copy the elements that where changed)
2. Transport this temp copy to the target system
on the target system:
3. MOVE your content from the actual location to the temp structure
result is old content in new structure with new permissions
4. REMOVE the old structure
5. MOVE the complete structure and content from the temp location back to the original location
Please do a complete backup and test for that you do it for real as all systems are different and cannot be commpared.
But again I hope that sombody has a real solution (I hope SAP in SP17 or so)
Cheers,
Benjamin Houttuin

When I do a repair permissions "ACL found..." keeps showing up. Why?

2008-03-16 22:22:15 -0400: Repairing permissions for “Macintosh HD”
2008-03-16 22:26:00 -0400: ACL found but not expected on "Applications/Utilities".
2008-03-16 22:26:00 -0400: ACL found but not expected on "Applications".
2008-03-16 22:26:00 -0400: ACL found but not expected on "Library".
2008-03-16 22:26:09 -0400:
2008-03-16 22:26:09 -0400: Permissions repair complete
2008-03-16 22:26:09 -0400:
2008-03-16 22:26:09 -0400:

This question has been asked and answered many times already, and what you see is of no concern. Please search the discussions before posting, as it can save you time in the future.
http://docs.info.apple.com/article.html?artnum=306925

UME: Regular Permissions - ACL Permissions

Similar Messages

Maybe you are looking for