Sonoma - Default Home Folder Permissions

[Kwoth]

I just noticed that my Mac (M2, 14.3.1) has different user permissions for the home folder than my old Mac (Intel, 10.13.6).

It's now set to:
Myname (me): Read & Write Staff: Read only Everyone: No access

Everyone was (also according to my research) always and everywhere set to Read only.

I have not modified anything, where did the change come from and is this the default for Sonoma?

 

[bsmr]

Good point. Today I also found out that many folders within my documents do have full access for 'Everyone'.

Can someone tell, what are the standard permissions for those folders?

 

[chabig]

I have never messed with mine. My home folder is:

Myname (me): Read & Write
Staff: Read only
Everyone: Read only

 

[fivenotrump]

I haven't changed mine since installation:
drwxr-x---+ 47 me staff 1504 2 Apr 11:38 .
0: group:everyone deny delete

 

[bsmr]

thx for your feedback.

Can you see some difference between files and folders within ~home?

 

[gilby101]

Can you see some difference between files and folders within ~home?

You can see for yourself. In Terminal use the command ls -le to see all permissions. Many files and folders you create have everyone read.

By default your home directory has everyone read and delete denied to everyone (including yourself).
ls -le /Users drwxr-xr-x@ 75 gilby staff 2400 2 Apr 14:47 gilby 0: group:everyone deny delete

The home directory needs to be everyone read because ~/Public/Drop Box is a location where other users can write stuff.

Most of the macOS created folders inside your home directory give no access to everyone. This is the list for a cleanly created user (my spare admin account):
ls -le /Users/admin total 0 drwx------+ 3 admin staff 96 17 Dec 2019 Desktop 0: group:everyone deny delete drwx------+ 3 admin staff 96 17 Dec 2019 Documents 0: group:everyone deny delete drwx------+ 3 admin staff 96 17 Dec 2019 Downloads 0: group:everyone deny delete drwx------+ 88 admin staff 2816 20 Mar 19:12 Library 0: group:everyone deny delete drwx------+ 4 admin staff 128 21 Nov 2020 Movies 0: group:everyone deny delete drwx------+ 3 admin staff 96 17 Dec 2019 Music 0: group:everyone deny delete drwx------+ 4 admin staff 128 21 Nov 2020 Pictures 0: group:everyone deny delete drwxr-xr-x+ 4 admin staff 128 17 Dec 2019 Public 0: group:everyone deny delete drwxr-xr-x+ 3 admin staff 96 26 Jan 2023 Sites 0: group:everyone deny delete
If you are on a multiuser Mac, you may want to modify permissions for some of the files and folders you have created.

 

[KALLT]

gilby101 is IMO correct. The standard directories under the home directory (Desktop, Documents, Downloads, Library, Movies, Music and Pictures) are set to read/write/execute only for the user and unset (i.e. no permissions) for other users or groups.

As long as you don't create any files/folders in the root of the home directory or in the Public/Sites directories, other users have no access to the files/folders you put in these standard directories. If you create files/folders in the root of the home directory, you may want to remove access manually with:
chmod go= /path/to/directory_or_file

 

[bsmr]

hm... I don't know how I can revert it now?

Under my home directory I do only have the standard folders with permissions like:
Myname (me): Read & Write Everyone: No access

And then I did the command to apply it to all sub-objects (files/folders). Is it somehow possible to revert it to like it has to be (standard settings?).

 

[gilby101]

Is it somehow possible to revert it to like it has to be (standard settings?).

How to do it is not well documented by Apple. You could try repairHomePermissions in Recovery mode. See this post from Howard Oakley. Make sure you have a good backup before doing anything.

 

[KALLT]

hm... I don't know how I can revert it now?

Under my home directory I do only have the standard folders with permissions like:
Myname (me): Read & Write Everyone: No access

And then I did the command to apply it to all sub-objects (files/folders). Is it somehow possible to revert it to like it has to be (standard settings?).

Which folder did you change exactly or how do they look now? You could probably fix it with some command-line commands, but for that you need to be a bit more specific.

 

[bsmr]

Overall I did change the ~home folder and all sub-dir's and files to:
Myname (me): Read & Write
Everyone: No access