Access control.
WHAT ACCOUNT TYPES EXIST
Administrator, able to change system settings and install software Standard, restricted Sharing-only, for file access Guest
WHAT TO USE FOR DAILY WORK
A standard account, with a separate administrator account.
WHY
Anything that runs inherits the privileges of the account running it.
WHAT THE ROOT ACCOUNT IS
The superuser, disabled by default.
WHAT TO USE INSTEAD
Elevation for a single command, when required.
WHAT UNIX PERMISSIONS CONTROL
Read, write and execute, for owner, group and others.
WHAT ACCESS CONTROL LISTS ADD
Finer permissions for specific users and groups.
WHY THAT MATTERS
They override the simpler permissions, and explain access that appears inconsistent with them.
WHAT TO CHECK WHEN ACCESS FAILS
Ownership Permissions Any access control list entries Whether the system's privacy protections are involved
WHAT THAT LAST POINT MEANS
Access to certain locations requires explicit user consent, regardless of file permissions.
WHAT TO NEVER DO
Grant full permissions to everything to make a problem go away.
