Friday, September 05, 2008

Permissions bug in OS X 10.5 - unable to update applications

I hate OS X permissions problems.

There were enough of them before Apple introduced ACLs in 10.4 alongside UNIX permissions. The dual parallel systems hasn't made things any easier.

Evil apps, like just about anything that Adobe makes or anything that uses a VISE installer, are prone to wreck permissions. Rumor has it that using "apply to enclosed items" changes to the Application and Utilities folders can have unexpected consequences.

To add injury to insult, running "Repair Permissions" from the OS X disk utility app never seems to fix anything. (I think that's a Potemkin application).

So, I had a permissions problem. Again.
Since upgrading to 10.5, when I try to update applications by dropping new versions into my (all user) Applications folder I get this message -- despite entering my admin credentials on request: "The operation cannot be completed because you do not have sufficient privileges for some of the items."

The target application will be partly removed at this point. I have to delete it (no problems) and then drop the new one on.

A minor annoyance, but aggravating.

I figured I'd have to fix it sooner or later, but today my daughter complained that her evil Flash using kid sites were crashing. Time to update Adobe's little OS X virus, aka Flash. Except I was getting Access denied errors from the evil VISE (of course) installer. I'd already tried repairing permissions, so I knew I had to do more.

Others had run into the same problem: Apple - Support - Discussions - The operation cannot be completed - you .... VK (level 4!) advised (modified slightly here):
... sounds like you have incorrect permissions and ACLs on your Applications folder.

Run the following terminal commands from an admin account ... copy and paste the commands into a terminal window.

sudo chown -R root:admin /Applications
(This will reset the ownership on /Applications to system defaults.)

You'll have to enter your admin password when its requested. You won't see anything when you enter it. These tasks can take a few minutes to complete, so just wait -- there's no progress dialog. Depending how long execution takes you may need to reenter your password. Wait for the prompt to return before entering commands.


sudo chmod -R g+w,+X /Applications
(this should set unix permissions correctly)


sudo chmod -RN /Applications
(this will delete all ACLs from everything in /Applications)


sudo chmod +a "everyone deny delete" /Applications /Applications/Utilities
(this will put the necessary ACLs back where they belong)
I tried installing the latest version of Onyx to see if it had a bundled fix, but it didn't. So, with some reluctance, I followed the above.

I then did a safe boot restart, then a regular restart, and then I ran repair permissions from Disk Utility. DU didn't like the settings VK recommended -- it changed many of them. I'm not sure who's right here, because an evil app can mess up the permissions database (Ex. an Adobe product) and repair permissions might be getting bad advice.

After that I run Adobe's Flash Installer (drag it from the DMG file to run it). It still gave me access errors, but I was pretty sure I'd removed all Flash stuff by hand. I suspect Adobe's Flash uninstaller is old.

I tried the Flash 9 for Intell installer again (drag it from DMG file to run) and this time I didn't get any privilege warnings.

So now I'll see how my next app update goes. Next step is probably a clean install.

Non-geeks don't have a chance with this stuff - or bad design?
  1. Having both ACLs and BSD permissions at the same time is just asking for trouble.
  2. It's wrong that badly behaved installers should be able to wreck permissions. (Apple should at least put up a warning ... something like ... "this ill-bred Adobe product is going to wreck your system, we recommend Aperture instead ..."
  3. Repair permissions ought to work better than it does. It shouldn't be getting its settings from a corruptible source.
Update 11/20/08: Some better fixes have been discovered.

Update 9/16/10: The official fix.


Matthias said...

Have the same problems here with DevonThink and EyeTV updates... ran all of your suggestions, and still does not work...

Any ideas + tricks are welcome.


John Gordon said...

I haven't seen the bug recently, but I doubt it's really fixed.

I think sooner or later Apple might fix it, but, true to form, they won't tell us.

If they do fix it, we'll probably make us run disk utility to implement the fix, but they won't tell us that either.


DevonThink support is pretty good. Maybe see if they have ideas? You could point them to this blog post too. If they come up with a fix I'd love to hear!

William Burke said...

I have the fall 2013 latest version of iMac, dual core, and everything.

In Maveriks, there is an enduring problem with a file in Library/printer whic
h occurs with astounding regularity. I own no printer, nor has any printer ever been connected to my computer.

I cannot comprehend what's really going on; I can run file permissions every ten minutes, and the very same corrupted file will be there again.

I mean how fucked-up is that? The result is frozen test blocks, eternally-spinning beachballs.

My fondest wish is that Apple would spin off OS X and concentrate on their cash cow, iPhone, and contract OS X to someone who can write much better code... But might the issue reside in a much earlier OS X built
to be much more usable.

I can't grasp why one a printer file is so commonly found without ever ever using it.