Repair permissions

Repairing disk permissions is a troubleshooting activity commonly associated with the macOS operating system by Apple. The efficacy of repairing permissions to troubleshoot application errors has been debated.^[1]

Overview

The BSD layer in macOS is responsible for file-system security, including the management of the Unix (POSIX) permissions model. Applications depend on the correct assignment and interpretation of permissions in order to function properly.^[2]

Repairing permissions involves checking the permissions of a set of files and folders on a volume with macOS installed against a list of correct POSIX permissions and correcting any discrepancies. The list of correct permissions is compiled by consulting the various bill-of-materials (.bom) files. Typically, these files are stored within reduced-size Installer package (.pkg) files in the Receipts folder in the local Library directory (/Library/Receipts) on the volume being checked. Whenever a user installs software that uses the macOS Installer package format, a bill-of-materials file is created which can be consulted for future permission repair.^[3]

Files whose permissions have been incorrectly altered by an administrator, an administrator operating with root privileges, or a poorly designed installer package (installed with similar privileges) can cause a wide array of problems ranging from application errors to the inability to boot macOS. Repairing permissions can become necessary, but has become increasingly less so for versions after Panther (10.3).^[1]

In OS X El Capitan, Apple introduced a security feature called System Integrity Protection. With it enabled, root privileges are no longer able to change system files and folders, including their permissions. Permissions repairs are instead performed automatically upon system installs and updates.^[4] To that end, Disk Utility as well as the corresponding diskutil command-line utility lost the ability to repair permissions.^[5]

Usage

In systems prior to OS X El Capitan, a permissions repair can be performed by selecting a startup volume and clicking the "Repair Disk Permissions" button in the "First Aid" section of Disk Utility. The operation can also be performed by using the diskutil command-line utility.^[6] In El Capitan, the user can instead use two command-line utilities: pkgutil to repair particular packages or /usr/libexec/repair_packages to repair a standard set of system packages.^[7][8] In both cases, the user has to disable System Integrity Protection to change permissions of system files and directories. In macOS Sierra, /usr/libexec/repair_packages is not available.

Permissions can also be repaired using third-party utilities such as The Apotek's AppleJack or Prosoft Engineering's Drive Genius.

References

1. Gruber, John. "Seriously, 'Repair Permissions' Is Voodoo". Daring Fireball. John Gruber. Retrieved March 13, 2009.
2. "Security Overview: Permissions". Apple Developer. Archived from the original on June 26, 2004. Retrieved April 4, 2007.
3. "About Disk Utility's Repair Disk Permissions feature". Apple Support. Archived from the original on November 13, 2014. Retrieved April 4, 2007.
4. "OS X v10.11". Mac Developer Library. Apple Inc. June 8, 2015. Retrieved June 11, 2015.
5. "OS X v10.11 Developer Beta 1 Release Notes". Mac Developer Library. Apple Inc. June 8, 2015. Retrieved June 11, 2015.
6. diskutil(8) – Darwin and macOS System Manager's Manual
7. pkgutil(1) – Darwin and macOS General Commands Manual
8. repair_packages(8) – Darwin and macOS System Manager's Manual