
30 Chapter 1 User Management Overview
Directory and File Owner Access
When a directory or file is created, the file system stores the user ID of the user who
created it. When a user with that user ID accesses the directory or file, he or she can
read and write to it by default. In addition, any process started by the creator can read
and write to any files associated with the creator’s user ID.
If you change a user’s user ID, the user may no longer be able to modify or even access
files and directories he or she created. Likewise, if the user logs in as a user whose
user ID is different from the user ID he or she used to create the files and directories,
the user will no longer have owner permissions for them.
Directory and File Access by Other Users
The user ID, in conjunction with a group ID, is also used to control access by users who
are members of particular groups, or of parent groups.
Every user belongs to a primary group. The primary group ID for a user is stored in the
user’s account. When a user accesses a directory or file and the user isn’t the owner, the
file system checks the file’s group permissions.
• If the user’s primary group ID matches the ID of the group associated with the file,
the user inherits group permissions.
• If the user’s primary group ID doesn’t match the file’s group ID, Mac OS X searches for
the group account that does have permission. The group account contains a list of
the short names of users who are members of the group. The file system maps each
short name in the group account to a user ID, and if the user’s ID matches the user ID
of a group member, the user is granted group permission for the directory or file.
• If the user’s primary group ID (or a parent group ID) matches the ID of the group
associated with the file (or a parent group), the user inherits group permissions.
• If neither of these cases applies, the user’s access permissions default to the generic
“everyone/world.”
Globally Unique Identifiers
Beginning with Mac OS X version 10.4, a universal ID called a globally unique identifier
(GUID, pronounced GOO-id) provides user and group identity for ACL permissions. The
GUID also associates a user with group and nested group memberships.
A discussion of GUIDs and their implications appears in Appendix B.
Komentáře k této Příručce