Mac OS 9 Multi-User Shared Folder Security

Mac OS 9 introduced an integrated Multiple Users feature that allowed several people to share a single computer while maintaining separate environments and private files. To facilitate collaboration without exposing private user data, the operating system utilized a designated "Shared Documents" directory alongside AppleShare-derived folder privileges managed through the Finder. This article explains how Mac OS 9 implemented local access controls, segregated profile spaces, managed shared directories, and enforced security boundaries across user accounts.

The Multiple Users Architecture

Unlike modern Unix-based systems such as Mac OS X, Mac OS 9 operated on the classic Macintosh System Software architecture, which lacked preemptive multitasking, protected memory, and kernel-level file permissions. Consequently, multi-user security was handled primarily at the system software level via the Multiple Users control panel and accompanying system extensions.

When an administrator enabled Multiple Users, the operating system generated a central "Users" directory on the boot drive. Each user account (categorized as Normal, Limited, or Panels) received its own isolated folder containing private preferences, desktop items, and personal documents.

Isolation and the Shared Documents Folder

To prevent unauthorized access across accounts, the Multiple Users extension intercepted File Manager and Finder calls. If a user attempted to navigate into another user's private directory, the Finder denied access.

To allow collaboration on a single machine, Mac OS 9 created a globally accessible "Shared Documents" folder inside the root "Users" directory. This folder served as a neutral space:

  • Universal Access: All profiles, regardless of restriction level, were granted baseline read and write privileges to the Shared Documents directory.
  • Shared Libraries and Application Support: System-wide items were kept in shared directories within the System Folder, ensuring restricted accounts could execute software without possessing write permissions to critical application files.

Folder Privileges and Drop Boxes

To control access more granularly within shared environments, Mac OS 9 adapted AppleShare network permissions for local storage. Through the Finder’s "Get Info" (Privileges) window, an administrator or folder owner could assign specific privileges to folders shared across the system:

  1. Read & Write: Permitted users could open, edit, delete, and add files within the shared directory.
  2. Read Only: Users could view and copy files out of the directory but could not alter or delete existing files.
  3. Write Only (Drop Box): Users could deposit files into the folder, but could not see the folder's contents or access files placed there by other users. This was commonly used in educational and office environments to submit assignments or documents securely.
  4. None: Barred specific profiles from viewing or modifying the directory entirely.

Limitations of the Security Model

Because the underlying file system (HFS or HFS+) in Mac OS 9 did not feature native POSIX access control lists (ACLs) enforced by a secure kernel, the security was administrative rather than cryptographic:

  • Extension Dependence: The security layer relied on system extensions loading properly at boot. If a user restarted the machine while holding the Shift key to disable extensions, the Multiple Users safeguards were bypassed, exposing all files.
  • Alternative Startup Disks: Booting the machine from an external drive, a secondary partition, or a system CD gave direct access to all private and shared directories without restriction.

Within normal operating conditions, however, the combination of the Multiple Users extension, Finder-level restrictions, and AppleShare privilege mapping provided an effective system for isolating accounts and managing shared files on a single computer.