<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 18 Jun2021, at 2:13 PM, Bill Cole <<a href="mailto:macportsusers-20171215@billmail.scconsult.com" class="">macportsusers-20171215@billmail.scconsult.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 2021-06-18 at 10:17:13 UTC-0400 (Fri, 18 Jun 2021 10:17:13 -0400)<br class="">Murray Eisenberg <<a href="mailto:murrayeisenberg@gmail.com" class="">murrayeisenberg@gmail.com</a>><br class="">is rumored to have said:<br class=""><br class=""><blockquote type="cite" class="">Indeed,<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>sudo chmod a+x /Users /Users/me /Users/me/Sites<br class=""><br class="">fixed the permissions access problem.<br class="">...</blockquote><br class="">The requirement is that the user running httpd must have search access on the whole tree above anywhere httpd is serving files from. The precise meaning of the 'search' permission (i.e. the 'execute' bit on a directory) is not intuitive or even well documented. It is simply the ability to access nodes within the directory based on those nodes' permissions, provided the caller knows the name of the item being accessed. Without search permission it simply does not matter what the permissions on items below the directory might be, they cannot be accessed. If you are concerned with other users (i.e. processes running as other users, such as 'daemon' which runs httpd under MacPorts) you can 'chmod a-r' on those directories to block reading of the directories themselves (i.e. the list of names of sub-nodes.)<br class=""><br class="">You can provide the search permission via the basic rwx by user/group/all mechanism or by extended ACLs, but you cannot create a deep space of access without a path from above….<br class=""></div></div></blockquote><br class=""></div><div>With macOS 11.4 at least, the command </div><div><br class=""></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>chmod a-r /Users</div><div><br class=""></div><div>and even</div><div><br class=""></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sudo chmod a-r /Users</div><div><br class=""></div><div>gives error "chmod: Unable to change file mode on /Users: Operation not permitted”.</div><div><br class=""></div><div>(By contrast, making the change for /Users/me and /Users/me/Sites is OK.)</div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">---<br class="">Murray Eisenberg<span class="Apple-tab-span" style="white-space: pre;"> </span><a href="mailto:murrayeisenberg@gmail.com" class="">murrayeisenberg@gmail.com</a><br class="">503 King Farm Blvd #101<span class="Apple-tab-span" style="white-space: pre;"> </span><br class="">Rockville, MD 20850-6667<span class="Apple-tab-span" style="white-space: pre;"> </span>Mobile (413)-427-5334<br class=""><br class=""></div>
</div>
<br class=""></body></html>