Repair permissions in terminal

Macintosh software/hardware discussion and troubleshooting

Moderator: James Steele

User avatar
mikehalloran
Posts: 15134
Joined: Sun Jan 25, 2009 5:08 pm
Primary DAW OS: MacOS
Location: Sillie Con Valley

Re: Repair permissions in terminal

Post by mikehalloran »

I've worked in a professional support environment for years, there was not a single instance when repairing permissions actually resolved an issue. Simple things, like a reboot, or deleting prefs, are much more effective
Did you write this before my last post or are you doubling down?
DP 11.31; 828mkII FW, micro lite, M4, MTP/AV USB Firmware 2.0.1
2023 Mac Studio M2 8TB, 192GB RAM, OS Sonoma 14.4, USB4 8TB external, M-Audio AIR 192|14, Mackie ProFxv3 6/10/12; 2012 MBPs Catalina, Mojave
IK-NI-Izotope-PSP-Garritan-Antares, LogicPro X, Finale 27.4, Dorico 5.2, Notion 6, Overture 5, TwistedWave, DSP-Q 5, SmartScore64 Pro, Toast 20 Pro
User avatar
bayswater
Posts: 11925
Joined: Fri Feb 16, 2007 9:06 pm
Primary DAW OS: MacOS
Location: Vancouver

Re: Repair permissions in terminal

Post by bayswater »

stratology wrote: I've worked in a professional support environment for years.
Ya got pros coming out the yinyangs around here. Get four of them in a room and you'll get five opinions. :rofl:
2018 Mini i7 32G 10.14.6, DP 11.3, Mixbus 9, Logic 10.5, Scarlett 18i8
stratology

Re: Repair permissions in terminal

Post by stratology »

mikehalloran wrote:With DP, it is the packages that need to be repaired.
This directly contradict's Apple's knowledge base article, which states that no DP files, only Apple installed files, are repaired. Are you saying that the Apple developers don't understand their own tech?


A message in the logs that states that a permission was repaired means just that. It does not mean that the change of this permission actually resolved an issue. If there was, for example, a reboot at any stage, it's much more likely that the reboot resolved the issue.

Most of the messages like the one you quoted are harmless, you may have seen the long list in the kb article linked above.

mikehalloran wrote: This is the best article I have read on the subject in El Cap.
The article completely ignores SIP, and that the only way to repair any permissions in /S/L/ is to disable it - which is a truly bad idea.
User avatar
bayswater
Posts: 11925
Joined: Fri Feb 16, 2007 9:06 pm
Primary DAW OS: MacOS
Location: Vancouver

Re: Repair permissions in terminal

Post by bayswater »

stratology wrote:This directly contradict's Apple's knowledge base article, which states that no DP files, only Apple installed files, are repaired. Are you saying that the Apple developers don't understand their own tech?
Then only files installed by Apple should show up in the repair log?
2018 Mini i7 32G 10.14.6, DP 11.3, Mixbus 9, Logic 10.5, Scarlett 18i8
stratology

Re: Repair permissions in terminal

Post by stratology »

bayswater wrote: Ya got pros coming out the yinyangs around here. Get four of them in a room and you'll get five opinions. :rofl:
Not true. If you look at any professional Mac support environment, pretty much everyone agrees on the basics.

Here and here are good Apple articles that show the foundation of meaningful troubleshooting.

Everyone who works professionally has a clear understanding of how POSIX permissions and ACLs work, and experience with cases when actual permission issues occur (i.e. when users change or propagate permissions). Even in those cases, Disk Utility's repair permission feature does not help - obviously.
stratology

Re: Repair permissions in terminal

Post by stratology »

mikehalloran wrote:Did you write this before my last post or are you doubling down?
Wrote it before your last post :D
stratology

Re: Repair permissions in terminal

Post by stratology »

Another quote from Apple's knowledgebase:

"Beginning with OS X El Capitan, system file permissions are automatically protected. It's no longer necessary to verify or repair permissions with Disk Utility."



As mentioned above, System Integrity Protection actually prevents the repair of permissions of system files by users (including root).
User avatar
bayswater
Posts: 11925
Joined: Fri Feb 16, 2007 9:06 pm
Primary DAW OS: MacOS
Location: Vancouver

Re: Repair permissions in terminal

Post by bayswater »

stratology wrote:Another quote from Apple's knowledgebase:

"Beginning with OS X El Capitan, system file permissions are automatically protected. It's no longer necessary to verify or repair permissions with Disk Utility."



As mentioned above, System Integrity Protection actually prevents the repair of permissions of system files by users (including root).
So, those using the Terminal command should see no errors reported when they run it?
2018 Mini i7 32G 10.14.6, DP 11.3, Mixbus 9, Logic 10.5, Scarlett 18i8
stratology

Re: Repair permissions in terminal

Post by stratology »

bayswater wrote: So, those using the Terminal command should see no errors reported when they run it?
No it's actually the opposite. If an incorrect permission in a system file is found, and you try to change ('repair') that permission, you should get an error (because root is not allowed to change system files).


Here's the Wiki page for SIP, here is Apple's documentation.
Last edited by stratology on Tue May 03, 2016 9:56 pm, edited 1 time in total.
User avatar
bayswater
Posts: 11925
Joined: Fri Feb 16, 2007 9:06 pm
Primary DAW OS: MacOS
Location: Vancouver

Re: Repair permissions in terminal

Post by bayswater »

I'm talking about permissions errors. There will never be any according to the quotes you made. None from non Apple files, because these won't be checked, and none from Apple files because they will alway be correct.
2018 Mini i7 32G 10.14.6, DP 11.3, Mixbus 9, Logic 10.5, Scarlett 18i8
stratology

Re: Repair permissions in terminal

Post by stratology »

bayswater wrote:I'm talking about permissions errors. There will never be any according to the quotes you made. None from non Apple files, because these won't be checked, and none from Apple files because they will alway be correct.
I added links to my post above, can't explain it much better than that.

If you look at the manpage for repair_packages, it explains that it compares the permission of a package to an expected value in the receipt database. So if you run that command, it's still possible that you see (=read - allowed under SIP) a mismatch between the actual permission and the expected value from the database (I guess that's what you mean by 'error').
If that mismatch refers to any file protected by SIP, the attempt to repair (=change) that file will throw an error.
User avatar
mikehalloran
Posts: 15134
Joined: Sun Jan 25, 2009 5:08 pm
Primary DAW OS: MacOS
Location: Sillie Con Valley

Re: Repair permissions in terminal

Post by mikehalloran »

stratology wrote:
bayswater wrote:I'm talking about permissions errors. There will never be any according to the quotes you made. None from non Apple files, because these won't be checked, and none from Apple files because they will alway be correct.
I added links to my post above, can't explain it much better than that.

If you look at the manpage for repair_packages, it explains that it compares the permission of a package to an expected value in the receipt database. So if you run that command, it's still possible that you see (=read - allowed under SIP) a mismatch between the actual permission and the expected value from the database (I guess that's what you mean by 'error').
If that mismatch refers to any file protected by SIP, the attempt to repair (=change) that file will throw an error.
Trying to understand what your point is. If it's that one never needs to run it, you are flat out wrong.

DP users need to do it, especially with older versions or it may not work properly. MOTU's tech notes are absolutely correct on the subject as those of us who have had such problems (and have helped many others with them) can attest.

MOTU may no longer support DP 5/6/7 in El Capitán but they still work.
DP 11.31; 828mkII FW, micro lite, M4, MTP/AV USB Firmware 2.0.1
2023 Mac Studio M2 8TB, 192GB RAM, OS Sonoma 14.4, USB4 8TB external, M-Audio AIR 192|14, Mackie ProFxv3 6/10/12; 2012 MBPs Catalina, Mojave
IK-NI-Izotope-PSP-Garritan-Antares, LogicPro X, Finale 27.4, Dorico 5.2, Notion 6, Overture 5, TwistedWave, DSP-Q 5, SmartScore64 Pro, Toast 20 Pro
stratology

Re: Repair permissions in terminal

Post by stratology »

Not sure what's actually so difficult to understand here.

The 'Repair Permissions' feature in Disk Utility is gone.

The same feature in Terminal (diskutil with verify and repair permissions verbs) is gone.


The supposed workaround sudo /usr/libexec/repair_packages starts with 'sudo', this is why it cannot execute successfully: under El Cap, the root user has no privileges to modify anything in /System and other system relevant folders (details linked above).
So even if the command finds 'incorrect' permissions (this is allowed when you use sudo, because it only reads file properties), they cannot be repaired, because sudo does not give the command sufficient privileges to change system files.


If you look at your linked article that suggests the workaround, it links to another article on the same site that attempts to explain permissions. That article states that you can see the permissions of a file in the 'Get Info' window in the Finder. This was correct only before ACLs were introduced in Mac OS 10.4 Tiger, back in 2005. In Tiger and all following versions of OS X, you cannot see the full permissions of a file (which means both POSIX permissions and ACLs, which override POSIX permissions) in the 'Get Info' Window in the Finder. You can display them via ls -@ael in Terminal.
So that article was written by someone who does not understand the basics of how permissions currently work in OS X, and who is not familiar with System Integrity Protection, introduced in El Capitan.

According to both Gruber and Wikipedia, the 'Repair Permissions' feature may have been useful in OS X versions before 10.4, but not since.
User avatar
kgdrum
Posts: 4068
Joined: Tue Nov 16, 2004 10:01 pm
Primary DAW OS: MacOS
Location: NYC

Re: Repair permissions in terminal

Post by kgdrum »

So..........I recently updated my 2012 MBP to 10.11 to check out El Capitan.
After updating I repaired permissions in terminal and all went well but subsequently when I tried again (paste etc.....) repairing permissions never seem to start.
If I go to quit Terminal I get a message that the repair permission process will stop if i quit Terminal (which I did) but I never see the process actually happening since the 1st time.
I've restarted the MBP ,checked the command I'm pasting into Terminal but don't see permission repair actually happening since the 1st time after updating to El Capitan.
Primarily I upgraded to see if this would ease my hesitation of upgrading my Mac Pro to 10.11 anyone have any ideas why I don't see permissions repairing on my MBP after the 1st time?

Thanks,
KG
2012 Mac Pro 3.46GHz 12 core 96 gig,Mojave, DP11.01,Logic 10.51, RME UCX,Great River ME-1NV,a few microphones,UAD2, Komplete 12U,U-he,Omni & way too many VI's,Synths & FX galore!, Mimic Pro w/ SD3,Focal Twin 6 monitors, Shunyata...........
User avatar
MIDI Life Crisis
Posts: 26254
Joined: Wed May 18, 2005 10:01 pm
Primary DAW OS: MacOS
Contact:

Re: Repair permissions in terminal

Post by MIDI Life Crisis »

I don't see progress until it actually starts to repair stuff. Seems that is the new normal.
2013 Mac Pro 32GB RAM

OSX 10.14.6; DP 10; Track 16; Finale 26, iPad Pro, et al

MIDI LIFE CRISIS
Post Reply