Permissions
Properties ▸ Sharing & Permissions shows who may read and write an item and lets you change it. Nothing is written until you press Apply.
What the table shows
macOS keeps two kinds of permissions on every file and folder of an APFS or HFS+ volume:
- The classic Unix permissions: read, write and execute for three classes, the owner, the item's group and everyone else. The table has one row for each.
- An optional access control list (ACL): an ordered list of entries, each naming one user or group and saying whether it allows or denies a set of rights, with finer rights than read / write / execute (delete, append, change permissions, take ownership, and more) and, on folders, whether new items inside inherit the entry. The table has one row per entry.
The system checks the ACL first, entry by entry, and falls back to the Unix bits only for the rights no entry decided. A deny entry therefore beats everything below it: a user can lose access although their row says "Read & Write".
Each row offers four levels: Read & Write, Read only, Write only (Drop Box) and No Access. The octal mode (644) and the rw-r--r-- form are at the top of Properties.
"Custom"
A row shows Custom, and its menu is disabled, when the entry fits none of the four levels: a deny entry, or a set of rights made by hand ("read, write" without the attribute rights that usually go with them, or "delete" alone). Such entries come from chmod +a in Terminal, from server and management tools, or from other apps. The app keeps them exactly as they are; the only change it offers is removing the entry with "−". A Unix class whose bits fit no level, such as a folder that can be read but not searched, shows Custom too.
The app does not show the inheritance flags or the exact rights of a Custom entry. Terminal does: ls -le <path> prints every entry, chmod +a and chmod -a# change them.
Changing permissions
Pick a level in a row's menu, "+" to add a user or group (Pro), "−" to remove the selected ACL entry. The changes wait: a bar under the section counts them, Reset discards them, and Apply lists them and asks before writing. One Apply is one Undo step. Showing other items drops unapplied changes.
A few rules the app enforces:
- You cannot set your own row to Write only or No Access on an item you own, which would lock you out.
- Only the owner can change an item's permissions. Items you do not own show disabled controls and the reason.
- Network volumes are shown as the server reports them; what can be changed depends on the server.
- Volumes without ACL support (FAT, exFAT, many network shares) show the Unix permissions only.
"+" adds an allow entry with Read only; on a folder it is inherited by new items inside. Choosing No Access on an ACL row removes the entry.
Lite and Pro
The Lite edition shows the whole table, ACL entries included, but changes only the Unix rows: ACL entries are listed in grey with their level. They still apply, so a Lite user can see "Read & Write" on their own row and be refused by a deny entry further down. The Pro edition edits, adds and removes ACL entries, with an account picker for "+".
Apply to Enclosed Items… (Pro, in the ⋯ menu of the section) copies a folder's permissions and ACL onto everything inside. Files keep their own execute bits, and inheritance flags are dropped on files. The change shows a count and progress, can be cancelled, and is one Undo step.
When you may write but cannot
If the table says you may write and the app still refuses, look for a Custom entry below your row, or run ls -le on the item in Terminal. A deny entry set by another tool is the usual cause. See also Troubleshooting.