Permissions bug in OS X 10.5 - unable to update applications

I hate OS X permissions problems.

There were enough of them before Apple introduced ACLs in 10.4 alongside UNIX permissions. The dual parallel systems hasn't made things any easier.

Evil apps, like just about anything that Adobe makes or anything that uses a VISE installer, are prone to wreck permissions. Rumor has it that using "apply to enclosed items" changes to the Application and Utilities folders can have unexpected consequences.

To add injury to insult, running "Repair Permissions" from the OS X disk utility app never seems to fix anything. (I think that's a Potemkin application).

So, I had a permissions problem. Again.
Since upgrading to 10.5, when I try to update applications by dropping new versions into my (all user) Applications folder I get this message -- despite entering my admin credentials on request: "The operation cannot be completed because you do not have sufficient privileges for some of the items."

The target application will be partly removed at this point. I have to delete it (no problems) and then drop the new one on.

A minor annoyance, but aggravating.

I figured I'd have to fix it sooner or later, but today my daughter complained that her evil Flash using kid sites were crashing. Time to update Adobe's little OS X virus, aka Flash. Except I was getting Access denied errors from the evil VISE (of course) installer. I'd already tried repairing permissions, so I knew I had to do more.

Others had run into the same problem: Apple - Support - Discussions - The operation cannot be completed - you .... VK (level 4!) advised (modified slightly here):

... sounds like you have incorrect permissions and ACLs on your Applications folder.

Run the following terminal commands from an admin account ... copy and paste the commands into a terminal window.

sudo chown -R root:admin /Applications
(This will reset the ownership on /Applications to system defaults.)

You'll have to enter your admin password when its requested. You won't see anything when you enter it. These tasks can take a few minutes to complete, so just wait -- there's no progress dialog. Depending how long execution takes you may need to reenter your password. Wait for the prompt to return before entering commands.

next

sudo chmod -R g+w,+X /Applications
(this should set unix permissions correctly)

next

sudo chmod -RN /Applications
(this will delete all ACLs from everything in /Applications)

next

sudo chmod +a "everyone deny delete" /Applications /Applications/Utilities
(this will put the necessary ACLs back where they belong)

I tried installing the latest version of Onyx to see if it had a bundled fix, but it didn't. So, with some reluctance, I followed the above.

I then did a safe boot restart, then a regular restart, and then I ran repair permissions from Disk Utility. DU didn't like the settings VK recommended -- it changed many of them. I'm not sure who's right here, because an evil app can mess up the permissions database (Ex. an Adobe product) and repair permissions might be getting bad advice.

After that I run Adobe's Flash Installer (drag it from the DMG file to run it). It still gave me access errors, but I was pretty sure I'd removed all Flash stuff by hand. I suspect Adobe's Flash uninstaller is old.

I tried the Flash 9 for Intell installer again (drag it from DMG file to run) and this time I didn't get any privilege warnings.

So now I'll see how my next app update goes. Next step is probably a clean install.

Non-geeks don't have a chance with this stuff - or bad design?

1. Having both ACLs and BSD permissions at the same time is just asking for trouble.
2. It's wrong that badly behaved installers should be able to wreck permissions. (Apple should at least put up a warning ... something like ... "this ill-bred Adobe product is going to wreck your system, we recommend Aperture instead ..."
3. Repair permissions ought to work better than it does. It shouldn't be getting its settings from a corruptible source.

Update 11/20/08: Some better fixes have been discovered.

Update 9/16/10: The official fix.