Tuesday, August 23, 2011

Disk Utility administrator permissions on Mac OS

If you have the public Mac computer and many people use it the best practice make an user account with user permissions and grant it to public users. By default, the main user on Mac OS has the administrative permissions. If you have an empty password for it, this user can destroy system data and bring your computer to `unbootable` state. The Mac OS 10.7 Lion has same security problems as 10.6 That is why the user account with user rights is best for such situations.
There is one little psychological problem for user. If user see that he is not an administrator he falls into depression ;) This article shows how make things better.
Let's take an example. The user knows well how to start Disk Utility and check if disk has file system corruption or check if system has files permissions problem. But with user rights Disk Utility asks for administrator password. User usually fall in depression by this. Or call system administrator if he is available. You can say, that is OK and no need do this for user. Right. To format own external (USB/Firewire/Thunderbolt) disks the user can without administrator prompt, by the way. The real system administrator has a power to make things better for user and don't give administrative access to system.
There is one system file in /etc directory. It calls `authorization`. This tweak may compromise security on your system. It wasn't tested well. So I'm not responsible for security risk. This file can be edited by real administrator.
Fire up the text editor and look in it. Don't ask me how. You should know, if you real administrator ;) This tweak was tested with Mac OS 10.6 and Mac OS 10.7 Lion.
The file has XML structure, so find the `com.apple.DiskManagement` key. Then find the `rule` key and change the string as shown below. That's it. Now your disk Utility won't ask you for administrator password even you are user.
P.S. If any file system corruption on bootable drive  user won't be able to repair it. As usual, you should boot from recovery disk and use Disk Utility from there.

No comments: