> Just to clarify - does firebird embedded definitely need write access to
> security2.fdb?

Yes. It must verify user name and password. In order to do so, it
must read some info from security2.fdb. For it a transaction must be
started. And, as the result - TIP is written.

BTW, embedded on MAC OSX is not even close to embedded on Windows.

SY, SD.