Locking Preferences

[JasonNVSD]

Has anyone tried locking large portions of the user's library? In the past we've locked specific plist files such as com.apple.dock, but now we'd like to lock down a lot more. I'm thinking the entire Preferences folder and either parts of, or the entire Application Support folder.

 

The initial tests I've done have been very positive (no errors, everything reverts after logging off and on), but I'm worried what long term issues may arise.

[davidacland]

It might depend on the method you're using to lock them down. I've had odd issues with some third party apps (things like Adobe CS, Office and lots of the audio apps). A lot of them don't like not being able to write into their own preference files etc.

 

I would normally go for deleting the ~/Library folder at logout to force it to refresh the settings.

 

How are you locking them down?

 

David Acland - Amsys

[JasonNVSD]

How are you locking them down?

chflags uchg

 

I had no idea you could safety delete the entire ~/Library folder. Does it just restore it from /System/Library/User Template/English.lproj/Library?

 

Thanks for the reply.

[davidacland]

Yep, it recreates itself on the next login.

 

If its only certain folders you're concerned about I would just delete those with a logout script.

[JasonNVSD]

Yep, it recreates itself on the next login.

Have you tried this on 10.10? It definitely did recreate a whole new ~/Library, but not from the version at /System/Library/User Template/English.lprof/Library. It looks like it partially restored from some sort of backup it had for that specific user. I'm kinda stumped at this point.

[davidacland]

I have although there are a few other things that might be playing a part for your specific setup.

 

When a new user logs in for the first time (with no home folder), the starting point is the user template. After that, other items are created by their respective apps. For example, there is no login.keychain in the user template as it is created by a separate process as soon as it is needed.

 

If you are getting custom user preferences or settings returning, it is likely that OS X is reading them from its preference cache (since 10.9 OS X has kept a separate cached copy of the preferences). To clear out the preferences cache for a specific for a specific user run "killall cfprefsd" at the start of the script that deletes the preference files. When cfprefsd reloads it will start fresh.

 

The other variables that will affect the folder deleting approach are managed preferences / configuration profiles from a Mac management system (if you have one) such as profile manager or workgroup manager running on an Open Directory server.

 

Hope this is of some help.

[JasonNVSD]

I've spent an inordinate amount of time working on this, but I learned a lot in the process...

 

it recreates itself on the next login

Yes, the user library does recreate itself, but not from the user template. This is strange. It only uses the user template if you delete the entire user.

 

I would just delete those with a logout script

Who knew this would be such a challenge! Apple says, "Login and logout scripts are a deprecated technology. In most cases, you should use launchd jobs instead". I've used launchd before, but even after spending a day using launchd to "trap" logout signals, I ultimately gave up. By contrast, using "deprecated" logout hooks worked perfectly (even on Yosemite).

 

In the end I created a login hook that deleted the user library and copied the library from the template. My shell script:

if [ $1 == 'User' ]; then
     su $1 -c 'killall cfprefsd'
     rm -Rf /Users/$1/Library
     cp -R /System/Library/User\ Template/English.lproj/Library /Users/$1/Library
     chown -R $1 /Users/$1/Library
fi
exit

 

So far so good.