File Sharing and Permissions
This domain tests how macOS shares files over SMB, NFS, and legacy protocols, and how POSIX permissions and ACLs combine. Expect practical questions about share points, access control entries, inheritance, and why an authorized user still cannot open a file.
Protocols and share points
SMB is the default file-sharing protocol for macOS clients and servers. AFP is deprecated and should not be chosen for new deployments. NFS is available for UNIX-style exports but has different authentication and permission behavior. A share point is a folder exported by the file-sharing service; users also need permission on the share point and on each parent folder in the path.
POSIX permissions and ACLs
POSIX permissions use owner, group, and other with read, write, and execute bits. On a folder, execute means traverse, so a user without execute on a parent folder cannot reach a file even if the file itself is readable. ACLs add ordered allow and deny entries and can be inherited. Inspect them with ls -le; modify POSIX bits with chmod and ACLs with chmod +a or chmod -a. A deny ACL can override a broader allow. Sharing-only users appear in sharing permissions but cannot log in locally.
Worked example
A user is in a group with read and write on a project folder but gets permission denied when opening a file inside it. Reasoning: check the entire path, not just the file. If the parent folder lacks execute for that group, the user cannot traverse into it. Add execute on the parent or correct inheritance; do not simply make the file world-readable.
Traps
- Read permission on a file does not guarantee access if a parent folder blocks traversal.
- ACL order matters; a deny entry can beat a later allow.
- Changing a share point does not automatically fix permissions on existing nested items.
- AFP is legacy; do not treat it as the preferred modern choice.