MacOS – Access user folders via Terminal

One way of doing it would be assigning the script a launchd service:

Create the shell script as usual. Then you can make a launchd service to run it at startup. Those are located at /Library/LaunchDaemons. These are in the XML property list format. Create another and populate it with something like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
        <string>com.example.app</string>
        <key>ProgramArguments</key>
        <array>
            <string>/bin/sh</string>
            <string>/path/to/script</string>
        </array>
        <key>RunAtLoad</key>
        <true/>
        <key>KeepAlive</key>
        <false/>
    </dict>
</plist>

Change com.example.app, /bin/sh and /path/to/script as required.

The script will then run while the system is booting. If it runs too early, you can either write the script to try and do what it needs to do until it succeeds, or have it exit with a non-zero error code and add this to the property list before the </dict> line:

<key>KeepAlive</key>
<dict>
     <key>SuccessfulExit</key>
     <false/>
</dict>

For more on OS X launch daemons and services, I suggest looking here for a nice quick-reference on making them, or here for a more comprehensive reference on what launchd can do.

I strongly advise to use full FileVault 2 encryption instead of using the FileVault 1 wannabe below!

You can mimic the FileVault 1 behavior either with an encrypted sparse bundle image or a second volume encrypted with FileVault 2. Two users are needed though and it's no elegant solution.

A proper backup of your OS X system volume before conducting one of the two how-tos below is strongly advised!

Example how-to with a sparse bundle image:

usera: admin user - usere: user with user folder which should be encrypted

• as usere create an encrypted sparse bundle image - large enough to hold all current and future usere content

• mount the image and create a folder with the name usere and modify it with chmod 744 ...

• log out as usere and log in as usera
• disable "Ignore Ownership on this volume" of the mounted sparse bundle image

• Open Terminal and enter

  su usere
  

• Now - as user usere - copy the content of the home folder of usere to /Volumes/name_of_sparsebundle_volume/usere:

  rsync -aAvX /Users/usere/ /Volumes/name_of_sparsebundle_volume/usere
  

• rename the old home folder of usere:

  mv /Users/usere /Users/userebackup
  

• exit usere - now you are usera again

• link /Volumes/name_of_sparsebundle_volume/usere to /Users:

  sudo ln -s /Volumes/name_of_sparsebundle_volume/usere /Users/usere
  

  You may have to modify the permissions of the soft link with sudo chown usere:staff /Users/usere and sudo chmod 744 /Users/usere.

• Now log out as usera and log in as usere
• Check if everything works

• If everything is fine, remove the folder /Users/userebackup:

  rm -Rd /Users/userebackup
  

Example how-to with FileVault 2:

The method is the same except that you have to encrypt an empty volume (right-click volume -> encrypt volume) instead of creating a sparse bundle image.

You can't log-in to usere directly because neither the encrypted sparse bundle image nor the FileVault 2 volume are mounted while the system boots. You either have to log-in as usera, mount the image/volume, log-out as usera & log-in as usere or you may log-in in console mode, mount and unlock the image/volume and log-in as usere. The latter is untested because I didn't get it to work in my VM.

According to Internet sources encrypted sparse bundle images are prone to (encryption) header corruption. Such a header corruption may render the image un-unlockable!