Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Locking files and folders to prevent changes System
In addition to the standard UNIX permissions (read, write, execute for owner, group, other), OS X has a few flags that can be set on files and folders to make them locked.

These flags supersede the standard UNIX permissions. If a file is locked, that overrides the write permissions so that applications treat the file as read-only. If a folder is locked, no files can be added or removed from that folder, no matter what the write permissions on the folder are. These restrictions apply to all users, independent of the permissions that are set on the files or folders. They even apply to the root user (or to admin users using sudo).

You can view the state of the "locked" flag for a file or folder by using File -> Get Info in Finder. The Get Info window allows you to change the locked state of a file (i.e. you can unlock a file that is locked, or lock a file that is unlocked) if you are the owner of that file. But there is no way to change the locked state of a folder using the Get Info window -- the checkbox is always dimmed.

However, it is possible to change this flag by using the command line (in Terminal). Suppose that the folder is named MyStuff. Then the following command would make it locked:
 % chflags uchg MyStuff
You could subsequently unlock that folder by doing:
 % chflags nouchg MyStuff
The only documentation that I could find about these extra flags is the UNIX man page for the command chflags (execute the command man chflags to read it). It lists the following flags:
arch    "archived flag"
opaque  "opaque flag"
nodump  "nodump flag"
sappnd  "system append-only flag"
schg    "system immutable flag"
uappnd  "user append-only flag"
uchg    "user immutable flag"
The uchg flag is the one used for locking files and folders (as illustrated above). If the uchg flag is set, the file or folder is locked. You prefix the flag name with no when using the chflags command if you want to unset the flag (as illustrated above). The uchg flag can only be set or unset by the file's owner or by an admin user using sudo.

The schg flag can also be used to lock a file or folder. However, this flag can only be set by the root user or an admin user using sudo. And once set, it is much harder to unset it, so it is more permanent. The schg flag can only be unset in single-user mode (restart your Mac and hold down Command-S after the chime).

You can see the state of these extra flags with the ls command in Terminal if you use the -lo option; i.e. ls -lod MyStuff shows the flags for the MyStuff folder.

I don't know anything more about the arch flag. The opaque flags is only relevant if you use the "union" option when mounting a filesystem (and I don't know if OS X currently supports that option). The nodump flag is only relevant when using the dump command. But the uappnd and sappnd flags are potentially quite useful. If the uappnd flag is set on a file, the file cannot be changed except by appending data to the end of the file (e.g. with cat >> myfile).

If the uappnd flag is set on a folder, new files may be added to that folder, but the files in that folder cannot be renamed and no files may be removed from the folder. The uappnd flag can only be set or unset by the file's owner or by an admin user using sudo.

The sappnd flag gives the same effects but (like schg) is more permanent, being only unsettable in single-user mode. There is no indication of the state of these "append" flags in Finder's Get Info window.

Especially since the state of most of these flags is not visible in Finder, it would be a good idea to keep a separate document recording which files or folders you changed the flags on. That way you have something to remind you what you changed if troubles occur sometime later. Note also that Apple does not document the behaviour of most of these flags, so you would be well advised to do thorough tests before relying on them in a production environment.

There have been a few previous hints (1, 2) that mentioned the uchg & schg flags in connection with troubles when trying to delete files, but I haven't seen anything that explained about the use of uchg to lock folders nor anything about the use of uappnd.

Note also that there are several 3rd-party utilities that provide GUIs for setting some of these flags. I haven't tried these utilities myself, so I won't mention them here.
    •    
  • Currently 3.00 / 5
  You rated: 4 / 5 (9 votes cast)
 
[67,671 views]  

Locking files and folders to prevent changes | 8 comments | Create New Account
Click here to return to the 'Locking files and folders to prevent changes' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Correction
Authored by: vladimus on Oct 17, '03 01:34:40PM

Sudo'ers can delete locked files, no matter what. At least, that's the experience on my machine (Jaguar 10.2.8).



[ Reply to This | # ]
Oops
Authored by: hayne on Oct 17, '03 03:17:26PM

I apparently didn't test that enough.
It is true that you can use 'sudo' to remove a 'uchg' file - it asks you to confirm that you want to override the permissions and then does it.
But 'sudo' is still no help in removing files from locked folders or removing locked folders.



[ Reply to This | # ]
Locking files and folders to prevent changes
Authored by: mattcrane on Aug 15, '04 03:04:38AM

I have a locked folder on my desktop named "Documents".
I created it, and somehow it became locked.
I tried using the "chflags nouchg" command to unlock it (while in single user mode in Panther 10.3.5) and received message "chflags: Documents: Read-only file system". It will not change the flag of this folder, so I cannot get rid of it!! Very annoying.
Through the "Get Info" window in the GUI, I have all read-write permissions on the folder (I am the only user account on the machine).

Any suggestions? I can't find any information on how to get rid of this thing anywhere.... our local Apple rep (who is pretty Pro at a lot of this stuff) couldn't do it either... any help would be great! Thanks.



[ Reply to This | # ]
Read-only file system in single-user mode
Authored by: hayne on Aug 19, '04 11:51:39AM

The filesystem is (as you have found out) read-only by default in single-user mode. To make it writable, you need to execute the command:

mount -uw /



[ Reply to This | # ]
Locking files and folders to prevent changes
Authored by: macmedix on Jan 30, '06 10:57:25PM
Great Hint! I really like this:
chflags -R uappnd *
It's a great way to protect files & folders that are not supposed to change, but do need to be opened, looked at, and copied (but NOT deleted, moved, edited, nor accidentally overwritten!). The * gets all files & folders at this level, plus the -R gets all folders & files recursively. Even the mighty Root can't change files after this command has been applied, and that goes for admins doing sudo as well. Nicely protected. Use ls -lo to see the flags. If you want to change the files, use
chflags -R nouappnd * to turn it off again. Nifty.

Ok, so my goal is to protect the files that are on a server:
ssh root@servername
cd /volumes/hdName/TopFolder2Protect/
then
chflags -R uappnd *


I planned to use this command to protect files on a ReadyNAS which I believe is using some Linux variation, but serves up AFP over TCP. I would apply the command either SSH-ed into the ReadyNAS, or mount the NAS as a AFP volume, then apply the command as if it were a local volume.

Problem:
this seems to work differently on a network volume, even if I ssh into that server. When on a network volume (in this case OSX (non-server) 10.3.4) The files are protected against name edits, file edits, etc, but in some cases they are not openable, either. I'm using a bunch of GIFs & PNGs in folders as a test, and They can double-click open into Preview, but Graphic Converter can't open them as they are locked. ("System Error software lock on file, not a subscriber") Adobe Illustrator X says it can't open the GIF files because "the server has denied access to the file". That's sort of disappointing, as I expected it would work the same on the servers as it does on my Mac. I want the files to not only be protected, but also easily opened in place.

How could this be improved to work better?

Thanks!
Dave N


[ Reply to This | # ]
Locking files and folders to prevent changes
Authored by: pendraggon87 on Dec 01, '07 10:18:04PM

I noticed that if you set an immutable flag in a preference, such as setting the magnify-immutable preference in com.apple.dock to YES, you can still override this by navigating into System Preferences and accessing the preference via the GUI.



[ Reply to This | # ]
Locking files and folders to prevent changes
Authored by: pendraggon87 on Dec 01, '07 10:22:47PM

Correction: Apparently this is a glitch in the magnify-immutable preference - if the other immutables, such as position, are set, then the corresponding preference in System Preferences is greyed out.



[ Reply to This | # ]
displaying the flags in Leopard (OS X 10.5)
Authored by: hayne on Feb 23, '09 11:38:53PM

In Leopard, you use the "-O" (uppercase O) option to display the flags with 'ls':
ls -lO myFile
or
ls -lOd myFolder



[ Reply to This | # ]