Finder Item Protection

New to SuperLock 4.5 Pro is the ability to protect individual files and folders on a user-by-user basis. This feature greatly enhances SuperLock Pro's utility in the typical multi-user environment, letting you do such things as:

Give your secretary access to your word processor and spreadsheet, but prevent access to your financial documents.
Only allow your kids access to the web browser during certain hours of the day when you know you'll be home to watch over them.
Allow students in a lab to access their documents folder, but no one else's.
Prevent a co-worker from using the Chooser to change your printer.
Make sure that your roommate can't copy your exam answers by keeping them out of the exam altogether.
...and so on.

Configuring

SuperLock Pro's Finder Item Protection feature takes a passive approach to protecting files and folders. That is, rather than telling it which files to allow a user access to, you instead tell it which files to disallow access to. Therefore, a newly added user by default still has access to everything, just as in previous versions. Then, you tell SuperLock Pro which files--like games or financial documents--you don't want that user to see. For simplicity, all interaction with the Finder Item Protection feature takes place within a single dialog. To activate this dialog, click the Finder Items button in Admin; the following window appears:

The main feature of this dialog is the scroll list and adjacent popup menu. The menu lists all users in alphabetical order; the scroll list lists those files and folders which will be hidden from the user selected in the menu.

To add a file, click the Add File button. A Navigation Services dialog will appear, wherein you can select the file. Add folders in a similar fashion, but click on the Add Folder button rather than Add File. Alternatively, you may drag files and folders directly into the Finder Item Protection window from the Finder, and they will be added to the list.

To remove an item from the list, simply select it, then click the Remove button.

Tip: You can double-click an item in the list to select it in the Finder. This is especially handy if you have multiple items with the same name.

Note: if you are using a version of Mac OS older than 8.5, and you don't have the Navigation Services library installed, the Add Folder and Add File buttons will be replaced with a single Add Item button, which you use to add both files and folders through a Standard File dialog.

The two buttons in the lower-left portion of the window allow you to turn the Finder Item Protection feature on and off independent of other SuperLock Pro features. This is quite useful if you temporarily want to allow a user full access without having to delete all of their associated Finder items then add them back in later.

When you are finished, click the Save button to save your changes and return to the main window. If you want to return without saving your changes, click the Cancel button.

Using

Finder Item Protection brings with it to SuperLock Pro the concept of logging out. This is accomplished through a new application called Logout, which is installed in the installation folder, and an alias to which is installed in the Apple menu. When a user logs out, the following things happen:

All applications are quit, except for Logout itself, the Finder, and any background-only applications like File Sharing or Overseer.
Client is launched.
When a new user logs into Client, the previous user's protected files and folders are re-shown, and the new user's files and folders are hidden.
The Finder is brought to the front for the new user.

Once a user logs in, Client can be reactivated at any time to protect the Mac, without the user having to log out. This is handy if, say, the user wants to grab something to drink but doesn't want to leave the Mac unprotected. They just activate Client, and when they come back and re-enter their username and password, everything is how they left it previously. When they're done for good, they launch Logout, which will properly log them out and launch Client for a new login by someone else. As an alternative to using Logout, the user may simply restart or shut down the computer (using the Finder's Special menu), which will automatically log them out.

An important side-effect to remember is that once a user is logged in, a new user cannot log in until the previous user has logged out. Should the first user launch Client and leave, the second user will be rejected by Client, even though their login information is correct.

Should the first user leave without logging out, then there are two solutions for the second user to gain access:

Request the assistance of the super-admin user.
As always, the super-admin user has overriding privileges, and can log in even when the previous user has not logged out. Once logged in, the super-admin should then use Logout to perform a proper logout so that the second user can log in.
Restart the Macintosh.
If the second user must log in, and the super-admin is not present, then restarting the computer (with cmd-ctl-power-on or equivalent) will allow them to log in again. This procedure is not recommended, as it is likely to lead to data loss and corrupted files, including, perhaps, with SuperLock itself (which may result in no one being able to log in).

Other Changes

With the addition of Finder Item Protection, a couple of SuperLock Pro's previous features have been modified slightly. Specifically:

The Auto-Activate After Inactivity option in the Security window has been changed to Request Password if Inactive. It works as in previous versions (launching Client after a period of inactivity), but the new label better reflects the fact that it launches Client, not Logout, so that the user is not forced to log out.
The Activate Client Hot Key option in the Security window has been changed to Request Password Hot Key. It works as in previous versions (launching Client at the press of a hot key), but the new label better reflects the fact that only Client is launch, not Login, and so the user is not forced to log out.
The main window in Admin has an additional button, Finder Items, that brings up the Finder Item Protection configuration window.