|
|
#1 |
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
Problem with "protected" folder
I copied some folders from my old PC.
One of these folders appears to be "protected". I cannot delete files in there. I already checked the permissions - no chance. Also tried to delete the ACL (access control lists) using Sanbox -> error, not permitted. Owner is root but that`s the case for all the folders I copied from the PC and the other folders don`t have this problem (not "protected"). How can I un-protect this folder? I have admin-access, of course. |
|
|
|
|
|
#2 |
|
Moderator
Join Date: Jun 2003
Location: Boulder, CO USA
Posts: 19,549
|
Can we see a long directory listing of this problematic folder in the Terminal? (Terminal is an app found in /Applications/Utilities.)
For example, if the folder is found on your Desktop, and the folder is named 'protected', then we would need to see (this command assumes that you're using Leopard, based on your mention of an ACL): ls -alO ~/Desktop/protected If the directory has a space in the name, then remember to put quotations around the folder name. So, for another example, if the folder is named 'protected stuff', then we would need to see ls -alO ~/Desktop/"protected stuff" If that's not clear enough, and you need further help crafting the command that we need to see, tell us exactly the name of the folder, and exactly where in the filesystem the folder can be found. Trevor
__________________
How to ask questions the smart way |
|
|
|
|
|
#3 |
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
Hello Trevor,
Thanks for this first try. Unfortunately "protected" is not part of the folder(s) name(s) (it is a sub-section of the folder-tree with several subfolders). "Protected" is the info I get from the info panel (selected from the context menu). There is also a lock-symbol added to the folder icons. And it looks like I cannot change this. Probably I can but I don`t know how. |
|
|
|
|
|
#4 |
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
Accessing the folder (and all sub-folders) from the admin account directly (instead of the owner) the behavior is even more odd:
Again I have full read/write access. And I can create new sub-folder and delete those. But I cannot change the names of any objects (folders/files) in this particular folder (and sub-folders). The odd thing: I can delete anything I don`t need any longer. But I can`t rename anything. ? I used Sandbox to recursively delete the ACLs. Result: I still can`t rename anything from my admin account. I do now have to re-enter the admin password when I want to delete anything. Permissions as shown in info-panel(s) for... (a) Top-most folder: read/write permission for system, wheel, everyone (Sandbox info: "owner: root") (b) any folders/files below the top-most folder: read/write permission for system, wheel, everyone (Sandbox info: "owner: username-of-accout-where-the-folder-was-copied-from-external-NTFS-formatted-HDD-to-HFS+-formatted -internal-Mac-drive") When adding a new permission particularly for the admin account and propagating this (read/write) trough all subfolders I get a long list of errors. Then using the information panel (in the finder) for the contents, I find that many objects have inheritated the desired permissions (still can`t change their names) but some haven`t. I have the suspicion this might have to do with the total pathlength: The foldername(s) and pathlength is getting pretty long when navigating through the contents. By the way (don`t know if it makes any difference): I used ChronoSync for the copying. I used OS X` HD utility (don`t know the exact english name) to check and repair permissions: It found "different permissions" on quite a few files. FrontRow, iPhoto, iLife. And I use none of these. I started iTunes twice so far to watch a video podcast. That was it. So I repaired the rights and checked again: Again the same problems that had allegedly been repaired. That`s not even the first time: I repaired permissions before (maybe a week ago) and I recall the results where the same. So now I am "check"-ing "volume". Result: "volume Macintosh HD apparently is OK". (again I have a localized version, not english so don`t get confused if the text is not what you know from the english version). 1 more piece of information: The folder causing the odd behavior is stored at users/shared. Last edited by mostly harmless; 04-14-2009 at 09:50 AM. |
|
|
|
|
|
#5 |
|
Hall of Famer
Join Date: Apr 2002
Posts: 3,315
|
When can we see a Terminal listing of the problem folder?
|
|
|
|
|
|
#6 | |||||||||||||||||||||||
|
Moderator
Join Date: Jun 2003
Location: Boulder, CO USA
Posts: 19,549
|
You haven't told us what the file name is, and there's no possible way that we can guess that. 'protected' is just an example, use the actual file's name, and show us the directory listing if you would like help with this. Trevor
__________________
How to ask questions the smart way |
|||||||||||||||||||||||
|
|
|
|
|
#7 |
|
Hall of Famer
Join Date: Jan 2002
Posts: 3,541
|
Hi. I wrote Sandbox. It's not clear to me, either, what you're actually encountering. Please do what the people in this thread have asked, and show us some Terminal output. Post a screenshot of Sandbox if you like, as well, but the Terminal output will be very helpful to everyone.
__________________
COMPUTER TYPE SOME SPECIFICATIONS I COPIED FROM THE BOX STUFF I INSTALLED ALL BY MYSELF "WITTY QUOTE" |
|
|
|
|
|
#8 |
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
this is terminal`s output for one of the sub-directories while being logged in as admin.
drwxrwxrwt+ 6 root wheel - 204 10 Mai 2008 . drwxrwxrwt+ 3 root wheel - 102 10 Mai 2008 .. -rwxrwxrwt 1 root wheel - 38832 7 Mai 2007 Drachenzeichnung negativ.jpg -rwxrwxrwt 1 root wheel - 38966 7 Mai 2007 Drachenzeichnung.jpg drwxrwxrwt+ 21 root wheel - 714 10 Mai 2008 Scenes -rwxrwxrwt 1 root wheel - 70 7 Mai 2007 workspace.mel Last edited by mostly harmless; 04-15-2009 at 11:51 AM. |
|
|
|
|
|
#9 | |||||||||||||||||||||||
|
Hall of Famer
Join Date: Apr 2002
Posts: 3,315
|
Oh wow... sticky bits... on FILES??? Not recommended. (usually *only* swapfiles and sleepimages in /var/vm get those). -- Looks to me like someone must have done a chmod -R 1777 at some point from some level, and possibly a chown -R 0:0 as well. I don't see how copying from a PC gets root ownership. EDIT: and who knows exactly what ACLs are there... better add -e to the ls command. EDIT#2: perhaps the procedure suggested in the linked post: Fix Admin Permissions After the Restoring Leopard might be one place to start? Last edited by Hal Itosis; 04-15-2009 at 05:28 PM. |
|||||||||||||||||||||||
|
|
|
|
|
#10 | |||||||||||||||||||||||
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
The permissions are not as they originally where because I first used the information panel to use the chosen permissions (read/write access for everyone) on all contents (that is the option in the menu with the toothed-wheel-symbol) and when this didn`t work I used Sandbox. In Sandbox I first created permissions for my admin account. When this didn`t work I recursively deleted all ACLs (whicht Sandbox). Sandbox produced a long list of chmod-related errors. The root-ownership occurs after deleting ACLs as far as I understand it. Before deleting the ACLs the top-most folder`s contents all belonged to the user account where I was logged in when copying the files. Thing is: When I copy sub-folders or files from there, then I can do everything I want (including renaming). Looking at the info-panel for the copied files however produces 3 entries of my admin account`s name. That does not look healthy. Furthermore I want to be able to use and edit these files from all user accounts. Thanks for the link. I will see what I can get out of it. |
|||||||||||||||||||||||
|
|
|
|
|
#11 | |||||||||||||||||||
|
Hall of Famer
Join Date: Jan 2002
Posts: 3,541
|
Removing an ACE from the ACL of a file or folder does not change its owner.
__________________
COMPUTER TYPE SOME SPECIFICATIONS I COPIED FROM THE BOX STUFF I INSTALLED ALL BY MYSELF "WITTY QUOTE" |
|||||||||||||||||||
|
|
|
|
|
#12 |
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
Ok, first the same with -e:
Code:
drwxrwxrwt+ 6 root wheel - 204 10 Mai 2008 . 0: user:admin allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit drwxrwxrwt+ 3 root wheel - 102 10 Mai 2008 .. 0: user:admin allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit -rwxrwxrwt 1 root wheel - 38832 7 Mai 2007 Drachenzeichnung negativ.jpg -rwxrwxrwt 1 root wheel - 38966 7 Mai 2007 Drachenzeichnung.jpg drwxrwxrwt+ 21 root wheel - 714 10 Mai 2008 Scenes 0: user:admin allow list,add_file,search,delete,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit -rwxrwxrwt 1 root wheel - 70 7 Mai 2007 workspace.mel Another folder that has not yet been treated with any changes of permissions after copying with ChronoSync: Code:
drwx------+ 8 root wheel uchg 272 27 Dez 17:59 . 0: group:everyone deny delete 1: user:standarduseraccount allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity drwx------+ 9 root wheel uchg 306 27 Dez 17:59 .. 0: group:everyone deny delete 1: user:standarduseraccount allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity -rwx--x--x+ 1 root wheel uchg 1229484 9 Aug 2002 leibnitz_verstand1.pdf 0: group:everyone deny delete 1: user:standarduseraccount allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rwx--x--x+ 1 root wheel uchg 1230112 9 Aug 2002 leibnitz_verstand2.pdf 0: group:everyone deny delete 1: user:standarduseraccount allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rwx--x--x+ 1 root wheel uchg 1245463 9 Aug 2002 leibnitz_verstand3.pdf 0: group:everyone deny delete 1: user:standarduseraccount allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rwx--x--x+ 1 root wheel uchg 1016090 9 Aug 2002 spinoza_ethik1.pdf 0: group:everyone deny delete 1: user:standarduseraccount allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rwx--x--x+ 1 root wheel uchg 952191 9 Aug 2002 spinoza_ethik2.pdf 0: group:everyone deny delete 1: user:standarduseraccount allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rwx--x--x+ 1 root wheel uchg 328333 9 Aug 2002 spinoza_ethik3.pdf 0: group:everyone deny delete 1: user:standarduseraccount allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity ![]() The checkbox is greyed out even after I unlocked the lock-symbol in the lower right corner of the window. The standard user has full read/write permissions according to the info-panel. Most folders that are higher in the hierarchy do not have the lock symbol and can be changed (renaming, deleting). All where copied in the same session by ChronoSync from a NTFS formatted drive to a HFS+ formatted drive while being locked in to this standard user account which I am also using now to check permissions and to find out what I am allowed to do with these files. Usernames have been changed to protect the innocent. Last edited by trevor; 04-16-2009 at 01:40 PM. Reason: Added [code] tags around command-line output for readability |
|
|
|
|
|
#13 |
|
Hall of Famer
Join Date: Apr 2002
Posts: 3,315
|
As far as i can tell, all this nonsense is happening inside your home folder somewhere, correct?
If so, you can decontaminate all such crud (locked items, ACLs, root ownerships) with Terminal... sudo chflags -R nouchg,nouappnd ~ # unlocks all items sudo chmod -R -N ~ # clears all ACLs sudo chown -R `id -u` ~ # makes you the owner EDIT: make sure the tilde (~) is at the end of all those commands... and do **not** even think about running those on the entire volume (/). EDIT#2: of course -- in any home folder -- there may exist a few items which should be root-owned, but that's the least of your worries. Frequently those come in the form of "helper" tools, but they usually will get reset when their main program notices the change, and requests your admin password. Last edited by Hal Itosis; 04-16-2009 at 06:28 PM. |
|
|
|
|
|
#14 | |||||||||||||||||||||||
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
Thanks for your suggestion. I will try this. The first folder is in the users/shared home folder an this data is supposed to be available (unlimited access) to all users. The second example folder is in one particular user`s home folder. But it is not the entire user`s home folder which is affected but only the data which I copied with ChronoSync - and that is still in one seperate folder, which I then wanted to step by step copy into other places within the home folder. The data of the second example only needs to be accessed by one user most of the time. Does setting the owner mean there are any restrictions for other users? Of course when this is being solved I could be happy and not ask how it happened but actually I am considering buying ChronoSync now after the demo license expired - and of course the question is if ChronoSync has anything to do with these permission problems. I don`t want to be dealing with this kind of things on a regular basis. |
|||||||||||||||||||||||
|
|
|
|
|
#15 | |||||||||||||||||||||||
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
Just one more question. Since I am not familiar with using the terminal, yet: How do I change the directory (folder) permanently so the 3 actions you proposed affect the correct folder and only this folder? Or do I have to add the path for each step (by drag n dropping the folder from the finder to the terminal) before executing the command? |
|||||||||||||||||||||||
|
|
|
|
|
#16 | |||||||||||||||||||||||
|
Moderator
Join Date: Jun 2003
Location: Boulder, CO USA
Posts: 19,549
|
You substitute where Hal Itosis has the tilde (~) for the path to the folder in question. A few pointers: ~ = your home folder, so if your username is (for example) mostlyharmless, then the full path that equates with the ~ is /Users/mostlyharmless/ If you start a path with the / then you are giving the full path, beginning at the root directory of the filesystem. If you don't start a path with the / then it 'starts' at your current working directory. So if you current working directory is your home folder, and you use the path Desktop/"Correct Folder"/ then the full path corresponding to that would be /Users/mostlyharmless/Desktop/"Correct Folder"/ If you have spaces anywhere in your path, you need to escape them, or use quotation marks around them. So if you have a folder on your Desktop named Correct Folder you either use quotations around that (like I've shown above), or else you use the \ character before the space to indicate that the following character should be taken literally, and not as a divider between parts of your command. So both of the following two paths are identical and correct: /Users/mostlyharmless/Desktop/"Correct Folder"/ /Users/mostlyharmless/Desktop/Correct\ Folder/ The second version is more traditional. There's a lot more good information about this type of thing, both in the Unix FAQ on hayne's website, linked to from the Unix - Beginners forum sticky here, and also at the Learning Center, written by my friends Janice and Adrian Mayo. Trevor
__________________
How to ask questions the smart way |
|||||||||||||||||||||||
|
|
|
|
|
#17 | |||||||||||||||||||||||
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
OK. As a first step I have used the first 2 commands you proposed for the first folder I have problems with. Now the permissions of a sub-folder look like this: drwxrwxrwt 6 root wheel - 204 10 Mai 2008 . drwxrwxrwt 3 root wheel - 102 10 Mai 2008 .. -rwxrwxrwt 1 root wheel - 38832 7 Mai 2007 Drachenzeichnung negativ.jpg -rwxrwxrwt 1 root wheel - 38966 7 Mai 2007 Drachenzeichnung.jpg drwxrwxrwt 21 root wheel - 714 10 Mai 2008 Scenes -rwxrwxrwt 1 root wheel - 70 7 Mai 2007 workspace.mel The info panel shows that "everyone" has read/write access. I still cannot change object`s (files/folders) names. I am logged in as admin. Then I used the 3rd command to make me (admin account) the owner. Now I can rename while being logged in as adming (owner) but when I am logged in as standard user (no administrative rights) I cannot rename anything. To delete I have to give the admin name and password. drwxrwxrwt 6 admin wheel - 204 10 Mai 2008 . drwxrwxrwt 3 admin wheel - 102 10 Mai 2008 .. -rwxrwxrwt 1 admin wheel - 38832 7 Mai 2007 Drachenzeichnung negativ.jpg -rwxrwxrwt 1 admin wheel - 38966 7 Mai 2007 Drachenzeichnung.jpg drwxrwxrwt 21 admin wheel - 714 10 Mai 2008 Scenes -rwxrwxrwt 1 admin wheel - 70 7 Mai 2007 workspace.mel Again: These files are supposed to be accessed by all users. So I want to grant full permission with giving "everyone" full permission. Is it necessary to give permissions to each user individually? Last edited by mostly harmless; 04-20-2009 at 03:26 AM. |
|||||||||||||||||||||||
|
|
|
|
|
#18 |
|
Triple-A Player
Join Date: Mar 2009
Posts: 97
|
More problems:
Yesterday I imported and sorted some sounds. Today I wanted to change a folder`s name while being logged in as admin. Originally I had created (imported) the files bein logged in as standard user (username MusicProduction). As an admin I could not rename the folder. So I logged in as user MusicProduction: I cannot rename the folder here, either. ??? drwxr-xr-x+ 9 MusicProduction staff - 306 19 Apr 15:53 . 0: group:everyone deny delete 1: user:admin allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity drwxr-xr-x+ 49 MusicProduction staff - 1666 19 Apr 17:29 .. 0: group:everyone deny delete 1: user:admin allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity -rw-r--r--@ 1 MusicProduction staff hidden 6148 19 Apr 15:53 .DS_Store 0: group:everyone deny delete 1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rw-r--r--@ 1 MusicProduction staff - 18940 19 Apr 15:53 SNAP 01.aif 0: group:everyone deny delete 1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rw-r--r--@ 1 MusicProduction staff - 18940 19 Apr 15:53 SNAP 02.aif 0: group:everyone deny delete 1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rw-r--r--@ 1 MusicProduction staff - 55804 19 Apr 15:53 SNAP 03.aif 0: group:everyone deny delete 1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rw-r--r--@ 1 MusicProduction staff - 37372 19 Apr 15:53 SNAP 04.aif 0: group:everyone deny delete 1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rw-r--r--@ 1 MusicProduction staff - 18940 19 Apr 15:53 SNAP 05.aif 0: group:everyone deny delete 1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurity -rw-r--r--@ 1 MusicProduction staff - 3756 19 Apr 15:53 SNAPS.exs 0: group:everyone deny delete 1: user:admin allow read,write,append,readattr,writeattr,readextattr,writeextattr,readsecurityadmin According to the info panel/window both admin and MusicProduction have read/write permissions. Last edited by mostly harmless; 04-20-2009 at 07:10 AM. |
|
|
|
|
|
#19 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Hall of Famer
Join Date: Apr 2002
Posts: 3,315
|
The sticky bits (and ownerships) are preventing you. [i forgot about the sticky bits because my link in post #9 should have been followed first.] sudo chmod -R u-t ~
Yes, but the ACLs say different... and how did you manage to get them on every file??????????? sudo chmod -R -N /path/to/stubborn/folder
Really? When?
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
#20 |
|
Hall of Famer
Join Date: Apr 2002
Posts: 3,315
|
> Furthermore I want to be able to use and edit these files from all user accounts.
That request may have been overlooked by most readers (i plead guilty), amidst the messy situation... what with the focus placed on restoring normality. There are threads around here discussing that aspect of your quest (or someone else here may step in again to guide you). I would suggest that -- when posting listings like the above -- that you include the command you typed, so we can see all options and args (e.g., the folder's pathname). |
|
|
|
![]() |
| Thread Tools | |
| Display Modes | Rate This Thread |
|
|