Authors: Adam Gray cism

File Permissions

The umask is short for user file-creation mask. Like file permissions in octal format, the umask is an octal number. File and directory permissions are technically a 4 digit octal number, but the left most digit is optional unless you’re specifically trying to set that set of bits. For some reason in at least some versions of OS X, the umask displays as a 4 digit number with a leading 0, but technically, you can’t change that digit; only the last 3 digits. Each digit of the umask is subtracted from 7 to give you the permissions for a newly created file. For example, if the umask is 0022, then a newly created file would have permissions 755, or user=read,write,execute, group=read,execute,other=read,execute.

• 
  sudo defaults write /Library/Preferences/.GlobalPreferencesNSUmask 23
  

NOTE: there is a file called /Library/Preferences/.GlobalPreferences.plist, but that is not what we want to type in the command. We want the GlobalPreferences domain. Shell expansion, might add the “.plist” part: be careful. You’ll need to logout and back in, as this setting takes affect at login time.

So, now we’ve taken care of files that will be created in the future, but what about files already created? We need to find all the files that have weak permissions. To find files that have world write permissions:

• 
  sudo find / -perm -002
  

This will produce a list of files that are world writable. Another problem is looking for programs that are Set User ID (suid) and world executable. suid and Set Group ID (sgid) deal with that 4^th octet I was speaking about above in the umask section. When this is set, the execution of the program is run with the program owner’s or program group owner’s authority, not the authority of the user who executed the script. A classic example is the su command. This command will let you switch to another user in a terminal window. This program is owned by root, and needs to be run with root authority, so that it can switch you to the other user (possibly root itself). Everyone has execute permissions (both group and other) because everyone has the ability to switch to another user if they know that user’s password.

• 
  sudo find / -perm -4000 –o –perm -2000 [-a -user root ]
  

The [ -a -user root ] is optional. Sometimes you might only be concerned if a program is SUID/SGID if the privileges granted would be for root. Consult your man page for the find command to extend the complexity of the search. Be very careful changing file permissions that are suid or sgid, because if you remove that permission you could break the system. Generally, we’re looking for them to remove the world execute privileges, not the suid/sgid privileges. The best way to stay out of trouble is to perform this find on a brand new system, and assume that (for the most part anyway) those permissions are correct. Then you just run this again periodically and compare the results to the original run. Just add a:

• 
  >
  

… to the end of the find command and the output will go to that file, instead of standard out.

File ACLs

• 
  sudo /usr/sbin/fsaclctl -p / -e
  

To enable a user based ACL for a file called secrets.txt:

• 
  chmod +a “joeuser allow read” secrets.txt
  

To enable a group based ACL for the same file:

• 
  chmod +a “administrators allow write” secrets.txt
  

With ACLs you can also specifically deny access. So, we've allowed the administrators to have write access, but what if we don't want user bob to have write access. Let's deny bob access:

• 
  chmod +a “bob deny write” secrets.txt
  

To view ACLs from the command line:

• 
  system $ ls -le secrets.txt
  
• 
  -rw-r----- + 1 user1user1 0 Oct 12 10:27 secrets.txt
  
• 
  0: user:joeuser allow read
  
• 
  1: group:administrators allow write
  
• 
  2: user:bob deny write
  
• 
  system $
  

Encrypting Home Folders

• 
  Create the FileVault master keychain
  
• 
  open System Preferences->Security.
  
• 
  Click on the FileVault tab
  
• 
  Click on the Master Password item and then set a master password.
  

Select a strong password here, and do not use the same password that you use to login in to the system with.

• 
  Open the Security System Preference.
  
• 
  Click the “Turn on FileVault” button.
  
• 
  Check Use secure erase so that files will be overwritten with patterns when deleted so their contents cannot easily be recovered by an intruder.
  

This will then log you out of your system and then encrypt your home folder. This can take a while, so be patient here. Once done, your system will reboot, and your home folder icon should now look like a safe.