2

I have a share point for the shared applications folder. This auto-mounts on clients correctly but when a file is created the permissions are such that the owner can't write to it (locally: root:wheel rw-r--r-- On the server: nobody:everyone rw-r--r-- group:group1 inherited allow read,write,execute,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown). The user is still able to delete the empty file.

I don't know what more info to provide, any help is appreciated! Thanks!

1
  • A few questions to start off: What are the permissions on this directory on the server? Does the Share Point or the directory have ACLs in addition to the POSIX permissions? Is the user creating/saving the new file from within an application (if so, which one(s)) or dragging the file(s) to the directory using Finder?
    – morgant
    Sep 17, 2010 at 16:37

1 Answer 1

2
+100

When /Network/Applications is mounted on the clients, it will be mounted before a user has logged in, so it will be mounted as a guest. It will stay mounted as a guest even when a user logs in. No matter what permissions you have on the client, the AFP server is mapping it to nobody. Please have a look at my answer to this question:

AFP uses a permission model that is quite different from NFS. Clients connect using their credentials, and then file access is controlled by the server. In some cases, Privilege Mapping occurs, which is the phenomenon you're describing.

In short, your clients will not reliably be able to create or modify anything in /Network/Applications because they will be doing so with no real credentials. You could possibly use NFS instead of AFP, because NFS uses a (less secure) model of trusting the client computer to control file access. However, you would be far better off using Mac OS X Server's concept of Group Folders to allow users to read and write using their own credentials.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .