How can I work around these permission problems?

Question

I have a service on my local Mac that offers a command line utility to work with it from the Terminal (The service is FileMaker Server and the utility is fmsadmin, but I don't think those facts are relevant). When the server program was installed, it created an fmserver user for it to operate under, and everything fmsadmin does seems to be under that user. Files created by the server or the utility are all owned by fmsadmin and in the wheel group, although I don't know why they have that group, as fmserver doesn't seem to be a member of it.

The script I'm trying to write will use the fmsadmin tool to make a backup of one of the served files to a temporary folder. This much I have working. But then I want to move the file to a different location controlled by the currently logged in user.

And there's the catch 22. fmsadmin can't write to the location I want the file to be in, and my account can't move the file to where I want because it doesn't have permission to move it. I can do it manually in the Finder, but only by putting in my account password.

Currently my (Python) script is having fmsadmin back the file up to /tmp/. The backup, even though it's a single file, actually creates a folder structure, duplicating the folder structure FileMaker uses for hosting the files. So the backup command results in the file being at /tmp/Databases/Subfolder/database.fmp12. Here are the ls results for each of those:

drwxrwxr-x  3 fmserver  wheel  96     Nov 17 16:01 Databases/
drwxrwxr-x  3 fmserver  wheel  96     Nov 17 16:01 Subfolder/
-rw-rw-r--  1 fmserver  wheel  954368 Nov 17 16:10 database.fmp12

Id like to move the file database.fmp12 to /Users/chuck/project-name/

drwxr-xr-x    8 chuck  staff   256 Nov 17 16:09 project-name/

How can I automate this in a (Python) script? Currently I run into permission errors when trying to move the file to where I want or when trying to save the backup where I want it. My goal isn't to solve this just on my system, but to make the script work on another user's system.

Answer 1

There are a few things you could do. The easiest thing might be to just add chuck to the wheel group. Is there a reason why that won't work?

Alternatively, you could try changing the owner of /tmp/Databases/ to the staff group and then setting the setgid bit on that directory, i.e.:

sudo chown :staff '/tmp/Databases/'
sudo chmod g+s '/tmp/Databases/'

Then all of the new files created in that directory should be owned by staff. In either case, you'll probably want to make sure that the fmserver user has the right umask, although based on what you've posted it looks like it does. Check out this post:

• Set umask in OS X Yosemite

It looks you can use launchctl to set the umask on OS X:

launchctl config fmserver umask 002

There's also the fancier option of using access control lists. For more about that see the following AskDifferent post:

• How do I use chmod on a Mac to make new files inherit parent directory permissions?

Answer 2

After much help from igal, I found a solution. The end result I wanted was for a file written to by the fmserver user to be placed in a particular location. fmserver couldn't write to the folder, and chuck couldn't move it from the temp folder. Both users, however, were a member of the staff group, so editing the permissions for the target folder with chmod g+w project-folder was the answer.