macOS share - how can I enforce read-only even for subfolders?

[sl0wmotion]

I wanted to ask this question for long long time - I know I can create / change the Read-Write / Read-Only / No-Access to any user/user group to a share but apparently it is not applicable to subfolders unless you chmod recursively or use Finder to apply attributes changes to enclosed items.

What it bugging me is that I have a 1TB of music storage which I still maintain regularly and I don't want to have a remote access client (say a music player) to mess up my music share when it traverses the whole file share.

On Windows PC the answer is pretty simple as the network share can make a real read-only share that by default makes every file / folder read-only, but I never found equivalent on macOS.

Did I overlook something? Appreciate for any comment.

 

[Slartibart]

The below isn’t working for you?

1. Open the Users & Groups preference pane.
2. Click the lock icon in the lower-left corner and authenticate yourself with Touch ID on equipped Macs or by entering an administrator password.
3. Click the plus (+) sign at the bottom of the user list.
4. From the New Account list, select Sharing Only.
5. Create a name by which the user will be displayed, an account name, password and hint.
6. Click Create User.

Now you can put this account to use in the Sharing preference pane:

1. Open the Sharing preference pane.
2. Select File Sharing in the Service list.
3. Select an existing shared item, like a folder or a volume, in the Shared Folders list. You can also drag an item in from the Finder or click the plus sign to select a folder or volume.
4. With a shared item selected, you can apply the shared user in the Users view. Click the plus sign, select the user, and click Select.
5. The user now appears, and you can set permissions, which include Read & Write, Read Only, and Write Only.

Use this user when connecting with e.g. your music player.

nota bene: of course it would be good to know which version of macOS you’re using?

 

[sl0wmotion]

The below isn’t working for you?

1. Open the Users & Groups preference pane.
2. Click the lock icon in the lower-left corner and authenticate yourself with Touch ID on equipped Macs or by entering an administrator password.
3. Click the plus (+) sign at the bottom of the user list.
4. From the New Account list, select Sharing Only.
5. Create a name by which the user will be displayed, an account name, password and hint.
6. Click Create User.

Now you can put this account to use in the Sharing preference pane:

1. Open the Sharing preference pane.
2. Select File Sharing in the Service list.
3. Select an existing shared item, like a folder or a volume, in the Shared Folders list. You can also drag an item in from the Finder or click the plus sign to select a folder or volume.
4. With a shared item selected, you can apply the shared user in the Users view. Click the plus sign, select the user, and click Select.
5. The user now appears, and you can set permissions, which include Read & Write, Read Only, and Write Only.

Use this user when connecting with e.g. your music player.

nota bene: of course it would be good to know which version of macOS you’re using?

Hi Slartibart,

The share can be created with read-only without problem - the root of the share is really read-only and unable to create sub-folder or file. But then once I enter an previously created sub-folder, the read-only attribute is gone, and now my own account (that is, slowmotion(me) becomes Read-Write when checked with Get Info).

I am using Monterey 12.5.1, however this problem on my Mac has existed from day 1, ever since I was using Leopard.

 

[Slartibart]

Hi Slartibart,

The share can be created with read-only without problem - the root of the share is really read-only and unable to create sub-folder or file. But then once I enter an previously created sub-folder, the read-only attribute is gone, and now my own account (that is, slowmotion(me) becomes Read-Write when checked with Get Info).

Sorry, I do not completely understand what you are doing… if you e.g. enable “guest”-access for a share and connect to or mount e.g. a SMB-shared folder as such, you have only read-only access. On all files, in whichever subfolder included in said shared folder.

If I access or mount the share as e.g. “my day to day regular“-user I have all rights this account comes with/are assigned to it.

Shared access does not physically alter files in the file system. Well, at leastnot if it is restricted to read-nly.