BobVB said:
But how is it more secure? We have the typical setup of a single person using the mac - they ARE the administrator even if they are using a regular account. How does it make it more secure making them switch accounts to put something in the Applications folder over just confirming they are the administrator and doing the exact same thing from their regular account?
Warning: this explaination is a little long and a little technical but should be understandable to non experts.
Say this single user has two accounts on their computer:
NaiveUserAccount and
ScaryAdminAccount.
Now, if the user always logs into the
ScaryAdminAccount to install applications then the application
MyNewApplication.app will be saved with the file permissions
rwxrwxr-x and will be owned by the user
ScaryAdminAccount with the group owner as
admin. These are permissions you typically end up with if you drag and drop the application to install it.
These file permissions mean that the user who owns the application (in this case
ScaryAdminAccount) has read, write and execute permissions (the first three characters in the file permissions highlighted in
blue). The any users in the group that owns the file (in this case
admin) has read, write and execute permissions (the second three characters in the file permissions highlighted in
red). And all other users have read and execute permissions (the final three characters in the file permissions highlighted in
magenta).
These three groups of permissions control what different classes of user can perform. If the current user name matches the user name for the owner of the application, then the user permissions (the
blue file permission characters) control what the current user can do with the application file. If the user names do not match then the "group" permissions come into play.
If the group name on the file matches a group that the current user is a member of, then the group permissions (the
red file permission characters) control what the current user can do with the application file. If the group names do not match, then the "other" permissions come into play. The "other" permissions are defined by the final three (
magenta) characters in the file permissions above.
So, assuming the user is currently logged in as the
ScaryAdminAccount. Since
MyNewApplication.app has user permissions of
rwx this means that the current user has write access to the application. Therefore, any application the current user runs is able to write and modify
MyNewApplication.app. This is not safe.
Assume the user is currently logged into another administrator account, say
GroovyAdminAccount. Since the user name on
MyNewApplication.app does not match the current user the user permissions are ignored. But, all administrator accounts are a member of the
admin group. The application is owned by the
admin group and the current user is in the admin group. Therefore, the group permissions are applied. The group permissions in the application are
rwx so the current user can modify the application as much as they like. This is not safe.
If the user is currently logged into the
NaiveUserAccount and this account is not an administrator so it is not a member of the
admin group. The current user name does not match the owner of the application so the user permissions are not relevant. The current user is not in the
admin group so the current user's group does not match the group owner of the application. Therefore the group permissions are not relevant. This leaves the "other" permissions as being relevant. The other permissions on this application are
r-x meaning that the current user can read the application and execute the application but they cannot write to or modify the application. Since nothing the current user can do has the ability of changing the application then this is a safe situation.
Ultimately, it means that anything that will change applications on the system must be a deliberate act by the end user. The end user makes it a deliberate act by specifically logging in to the administrator account since that is the only account with the appropriate permissions to change the applications. Alternatively, the user can attempt to modify the application but will not have the correct permissions so the OS will prompt the user for administrator credentials in the form of a username and password.
Hope that helps answer your question.
