2

After a few reckless uses of chomod (and some history I don't recall, apparently) I currently have the following ownership in my /usr/local:

drwxr-xr-x   13 Rax   admin   Caskroom/
drwxr-xr-x   87 Rax   admin   Cellar/
drwxr-xr-x    3 Rax   admin   Frameworks/
drwxr-xr-x   17 Rax   admin   Homebrew/
drwxr-xr-x    2 Rax   admin   Library/
drwxr-xr-x    6 root  wheel   MacGPG2/
drwxr-xr-x  654 Rax   admin   bin/
drwxrwxr-x   16 Rax   admin   etc/
drwxr-xr-x  118 Rax   admin   include/
drwxr-xr-x    4 Rax   admin   info/
drwxr-xr-x  438 Rax   admin   lib/
drwxr-xr-x    3 Rax   admin   libexec/
drwxr-xr-x    5 Rax   admin   man/
drwxr-xr-x    7 Rax   admin   mysql-utilities-1.5.3/
drwxr-xr-x  111 Rax   admin   opt/
drwxr-xr-x    3 root  wheel   remotedesktop/
drwxr-xr-x   42 Rax   admin   share/
drwxr-xr-x   10 Rax   admin   texlive/
drwxr-xr-x    6 Rax   admin   var/

Is this the correct default ownership for current (≥ 10.12.5) macOS? Should I change some of these (back) to root:wheel?

orome
  • 11,983
  • 64
  • 144
  • 260

1 Answers1

3

Out of the box - root:wheel has ownership of /usr/local and 0755 permissions. It's really up to you what you want. Since you clearly have homebrew or remnants of that, I'd do whatever brew doctor says you need to do for the user account you want to run things. I'd say keeping user:admin permissions is just fine for almost all cases in that part of the directory.

I have user:admin and 0775 permissions on everything but /usr/local itself and /usr/local/remotedesktop which match and are root:wheel with 0755.

bmike
  • 235,889
  • So there's no reason to set, for example, bin or etc to root:wheel (and they don't come that way by default)? FWIW, brew doctor seems happy with what I've got. An – orome Jul 16 '17 at 19:43
  • 1
    @raxacoricofallapatorius Correct - You could open an installer with a tool like Pacifist and see the permissions that the vanilla installer runs or snoop on the recovery HD - https://apple.stackexchange.com/a/116612/5472 - if memory serves neither bin or etc comes out of the box so it's up to whatever process creates them to set permissions or responsible for what permissions you have. – bmike Jul 16 '17 at 19:48
  • FWIW, looking at what's on the recovery HD (in what's mounted by hdiutil mount /Volumes/Recovery\ HD/com.apple.recovery.boot/BaseSystem.dmg) I see that bin, lib, libexec, sbin, share, and standalone are all present (and all that's present) and all have Rax:staff. – orome Jul 16 '17 at 20:00
  • I must admit I'm not clear with the significance of staff vs admin is here. – orome Jul 16 '17 at 20:00
  • @raxacoricofallapatorius If you mount a dmg you are the owner of the mounted volume and consequently all files are RAX:staff - even the mach_kernel! Also: /usr/local doesn't exist in there. – klanomath Jul 16 '17 at 22:15
  • @klanomath Ah, so what was bmike's point? – orome Jul 16 '17 at 23:19
  • 1
    I retract my point in comments about recovery. I’ve looked at the actual installer - /usr/local is the only stock directory and it’s root and wheel - the body of he answer is correct. The comments not so much. – bmike Jul 16 '17 at 23:34