Apples file permissions and extended attributes and ACLs

This entry was posted by Saturday, 26 September, 2009
Read the rest of this entry »

Whilst i realize this is not ‘linux’ is is unix based and has a similar permissions and command line.

I recently upgraded my OS X laptop to Snow leopard. Being the good sysadmin I am i made sure i used Time Machine to backup all my files and data to an external drive. I used the chance to do a fresh install also, and the upgrade went fine.

I then restored from my backup. I noticed immediately that I couldn’t write to some files and was unable to do some things without entering the root password. Now I had changed the username so i assumed naturally that they would be perhaps owned by my own username and somehow timemachine hadnt changed it.

This was not the case, the permissions seemed fine, they could be all drwxrwxrwx and owned by me i still could not write to them. I did notice the symbol on the end which was an @ symbol.

drwxr-xr-x@   5 wishes  staff         170 18 Jul 22:15 wordpress

Interesting! After much googling i found this is extended attributes symbol, and to view those you can use

ls -l@

drwxr-xr-x@ 146 wishes  staff  4964 28 Aug 21:38 Cheerleading
com.apple.metadata:_kTimeMachineNewestSnapshot      50
com.apple.metadata:_kTimeMachineOldestSnapshot      50

After a bit of googling i figured out i can remove this using the command

sudo xattr -d “com.apple.metadata:_kTimeMachineOldestSnapshot” filename

So i wrote a quick shell script that stripped both the “com.apple.metadata:_kTimeMachineOldestSnapshot” and “com.apple.metadata:_kTimeMachineNewestSnapshot” off since none of these files were in time machine any more. I wasn’t sure at that time if this was why i was unable to remove it, as it turns out it wasn’t.

As it turns out by removing the extended attributes i discovered the @ had now turned into a +

-rw-r–r–+   1 wishes  staff       56743 16 Sep 07:03 Recipes.pdf

Again, i set off to google this one. I found this excellent page here which explains all the ACLs. By doing the following i can list all the ACLs

ls -le@O

drwxrwxrwx+   5 wishes  staff  –        170 28 Aug 21:41 Raw Photos
0: group:everyone deny add_file,delete,add_subdirectory,delete_child,writeattr,writeextattr,chown

So now i knew that it was ACLs i was able to remove those with the following

chmod -a# 0 *

Bingo! now i can access all my files happily! Hopefully this saves somebody else the frustration i went through trying to figure it out 🙂

3 Responses to “Apples file permissions and extended attributes and ACLs”

  1. David

    I was having a very similar problem administering files that were manually recovered from a Time Machine archive folder. The chmod -a# 0 solved my problem. Thanks!

  2. Lasonya

    Amazing, this was actually a exceptional article. Why are you so far down in the big g.

    I stumbled on you at page 9, you should easily be page 1 using this type of information — it is genuinely excellent!

    What is it with google these days anyhow… their results are
    horrendous! Anybody else think so?

  3. It is refreshing to find detailed information that is not
    autospun garbage on the first 3 pages of the big g. Nearly all useful
    websites are 5 and 6 pages deep in the big g now,
    happy to see you have broken away from the lot of em.


Leave a Reply