Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Confirmation of a multi-user application limits bug System
Just received confirmation from Apple about a bug in multiple user functionality, affecting 10.2.x through 10.3.2. Some of you may be aware of the bug, but this is the first confirmation from Apple that I've actually heard.

Bug: When setting a standard user's limitations to run only certain applications, some applications will not remain checked (enabled). Therefore, it is impossible for the user to execute these apps. Here is a quote from Apple relayed by a general technician:
It is a problem with header information in the applications themselves, and even in Apple Applications these problems can occur. There is some kind of conflict, and they are still investigating how to completely resolve this conflict altogether. It is still something that is going on, and we don't really have a solution.
Has anyone found a workaround?

[robg adds: I don't do much with multiple users (other than troubleshoot and experiment with stuff), so I haven't seen this issue myself.]
    •    
  • Currently 2.00 / 5
  You rated: 4 / 5 (3 votes cast)
 
[4,178 views]  

Confirmation of a multi-user application limits bug | 16 comments | Create New Account
Click here to return to the 'Confirmation of a multi-user application limits bug' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Confirmation of a multi-user application limits bug
Authored by: network23 on Feb 04, '04 11:32:37AM

Yes, this bug has plagued me for over a year now, and no, I haven't found a workaround yet.

I set up accounts for my children and wanted to restrict access to just games for the younger ones. At first I thought it was refusing to run some apps because they were on a shared network drive, but some of the apps claimed permissions weren't correct even if I copied the games to the machine's own hard drive.

I first called AppleCare last year about this problem with no success. I called again about a month ago when I discovered exactly what's posted here, that apps "checked" to be allowed to run are unchecked again if you leave the Accounts Prefs area and return again.

No matter what I tried -- even changing permissions on the files manually --- had no effect on some programs.

I do hope they find the problem and fix it soon!

---
Live and Direct, only from
Network 23



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: robcompton on Feb 04, '04 02:30:45PM

I had this problem with an app recently and with the help of an apple engineer assigned the application a bundle identifier. once this was done all accounts could use the app.

_-RC



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: MacMuppet on Feb 05, '04 11:46:32AM

Thank God I thought it was just me, and so far it has only happened to MSN messenger on one of my user accounts, so I had thought it was a problem with the Application.
And another thing. When you check which applications are allowed, is anyone getting duplication? For example 3 instances of MSN Messenger in the App list and 2 of iCal, 3 of Flashplayer etc....

Hope they come up with a bug soon my users get very irate with recurring bugs, which is why we went with Apple. Still its not a major problem, its not as if they released Exchange Server 2000 and then refused to admit for 3 years that the filtering doesnt work.

One minor bug every three software versions is amazing compared to the competitors...



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: datasmid on Feb 12, '04 06:55:36AM

This can be very annoying indeed. Some applications keep getting back when i exclude them. Others disappear when you do want them. The list of applications to allow took a long while to show in jaguar, this is improved in Panther. But IMHO the Admin should be able to decide what should be allowed and what not.

You should be aware that the list only affect the presence in the limited finder application folder. Some game demos start Explorer as a side effect. So do not depend on this for security.

The feature of a simple finder and limited applications works as great for kids as the MiniFinder did in the good ol' days.



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: schneb on Feb 04, '04 11:34:50AM

Doesn't this need to be placed in the Forum rather than the hints section?



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: robg on Feb 04, '04 01:15:18PM

Occasionally something that doesn't seem like a tip may actually be one -- someone may be searching for a hint on how to get an application's "allow" setting to stick, for instance, and could then find this hint, letting them know that it's a system-level bug.

In general, though, you'll find very few of these "heads-up" kinds of things here; I try to limit how often they run on the main site -- I'd much rather publish a solution than a problem :).

-rob.



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: wpdv on Feb 04, '04 12:25:08PM

With Multi-User enabled, and my childrens account "limited", including not allowing the use of Safari, I thought I was all set. However, everytime my daughter was on the computer, she was able to access the Internet. I tested the limitation settings, everything was operating as it should. Later, when my daughter was on the internet again, I asked her how she was able to get on. She said, "It was easy Dad, under the blue Apple I went to "Recent Items", and selected Safari. If that didn't work, I would go to "Mac OSX Software" and get on. I tried not to look surprised ... Leave it to a thirteen year old to find a way around Apples "security".



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: jesboat on Feb 04, '04 04:29:27PM

Hey, windoze security isn't much better. (I'm just pointing this out.)

At school, some computers are just Citrix clients. Desktop icons are disabled, right-clicking is disabled, the only things in Start are shut down and programs, the only in programs is start up, and the only thing in start up is the citrix client. Nothing is loaded into the systray, quicklaunch is not shown, and Ctrl-Alt-Del only gives you the option to Log Out, Shut Down, or Cancel.

Simply double-clicking on Startup in the Start Menu opens an explorer window.

---
--
With no walls or fences on the 'net, who needs Windows or Gates?



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: Renghe on Feb 04, '04 05:20:09PM

But that's not all about "security". With Safari she has access to every other application. Just type "file://Applications" and you'll get a new Finder window of your applications folder. Using "file://" is also possible.



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: gshenaut on Feb 04, '04 07:34:40PM

If you want to deny access to some application except for a certain group
of users, create a new group (e.g., "grownups"), and go through the
/Applications directory changing the group of the executables to the new
group, and changing the mode of the executable to 750 (owner has
read/write/execute, group has read/execute, other no permissions).
If people not in the group do not have the ability to become superuser,
then they will not be able to start the application.

A simpler method would be to change the group to "admin" if it isn't
already, and then change the mode to 750; this will restrict access to the
application to those with administrative access to the machine.

Greg Shenaut



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: climberbry on Feb 05, '04 10:17:15AM

There are many easy ways around this solution.



[ Reply to This | # ]
Just to add my voice to the din...
Authored by: jecwobble on Feb 04, '04 02:10:03PM

I encountered the same problem with some games that my daughter wants. Since I spend more time on the computer than the kids do (surprising, huh?), I just decided to live with it rather than dig deeper.

An untested thought on a workaround- create standalone AppleScript that "activates" the troublesome apps (or use DropScript with an "open -a xxxx.app" shell script), and give the users access to those. I'll try that when I get home...



[ Reply to This | # ]
Just to add my voice to the din...
Authored by: mproud on Feb 04, '04 10:55:17PM

BRING BACK AT EASE!

LOL!



[ Reply to This | # ]
Why not installing the apps in ~/Applications?
Authored by: hamarkus on Feb 04, '04 02:19:11PM

For those affected, does it help to install the applications in question in ~/Applications, i.e. installing them once for each user?



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: Johnny_B on Feb 04, '04 07:40:35PM

Didn't my post earlier say how to fix this ? Or is some other issue ?

<a href="http://www.macosxhints.com/article.php?story=20030808113010480&">http://www.macosxhints.com/article.php?story=20030808113010480&</a>



[ Reply to This | # ]
Confirmation of a multi-user application limits bug
Authored by: climberbry on Feb 05, '04 09:23:23AM

Yes and No. You were referring to 10.2 Server for one. Here, we are referring to Jaguar & Panther workstation, where Multiple users is a different animal (...but with the same name;>}). However, I've tested the fix in your post with no luck. Though it may work for you, using Server with some OS X apps, it is still not a valid fix for this bug, which persists with all Cocoa, Carbon, and Classic apps.



[ Reply to This | # ]