Permissions nightmare with Leopard (10.5)

[qubex]

Hello. I've been reading these forums for a long time but this is the first time I post because I'm experiencing a really vexing problem with Mac OS 10.5 ("Leopard").

First of all: I have the slightly unusual setup of having two seperate hard drives, one mounted at / for my "main" (system, apps, etc.) filesystem and one mounted at /Users for my data files. My user account's home directory (/Users/james) is here. This has never caused any problems but the upshot is that I can't use Disk Utility's Repair Permissions function to fix this problem, assuming it would work, which it probably wouldn't. (I have tried to use Leopard's installer Repair ACLs function in Repair Password Utility and it hasn't done any good.)

Whenever I move files to the trash, or try to save, I'm either told that the files are locked or up pops the usual dialog box asking me for an administrator password. In the present condition, the machine is almost unusable.

I have the following problem with my permissions: I don't practically have ownership of the folders inside my home directory. The permissions tell me I have, full dwrx yada yada yada, but actually I don't. If I try to apply read/write privileges to all enclosed items, Finder trawls through something, but nothing happens.

Same for sudo chmod and sudo chown invoked with the -R flag.

The very interesting thing is this: if I inspect the individual files' permissions with Get Info, I discover I have read/write privileges, there's an unknown user with Read Only, and Everybody appears twice, both with Read Only. If I try to add or remove a user in the permissions box, Finder crashes. If, however, I reaffirm one of the Everybody's Read Only privileges, I suddenly regain full control of my file.

This is not a simple problem and I don't have a clue how it occurred. How do I remove this spurious Everybody from the permissions? Alternatively, how do I resolve whatever ambiguity is going on to cause Everybody to appear twice? Is the unknown user the root of the problem? Is there a way to annihilate the current (obviously corrupted) ACLs and start from scratch?

I look forward to hearing what you suggest. Thanks in advance.

[hayne]

If you have an unusual setup (e.g. /Users on a different drive) then I wouldn't trust Finder's Get Info about the permissions. Instead you should look at the permissions using commands in Terminal. See this Unix FAQ for instructions.
New with Leopard is the use of ACLs. When you do 'ls -l' on a file or folder in Leopard, a + at the end of the permissions tells you that there are ACLs active on that file or folder.
Use the "-e" option to 'ls' to see the ACLs.

[qubex]

I had ACLs active on my System drive but not on my Users drive.

In the end I went completely mad, copied all the contents of my home directory over to a blank partition, nuked the drive, recreated my user account, re-imported everything, and now it works.

Hardly elegant, but at least it worked.

[shiatis]

This is *exactly* the problem I have had after going to 10.5. Most files on my drive, no matter where they live, show the "everybody" user twice (with two different settings). This prevents me from doing just about anything to any of those files without putting in a password. The only way I could get RP to run from disk util was to log on as root, create a new temp user, transfer the contents of my user directory into the temp user's, delete my user, create a new user with the same info as the one I deleted and transfer all my dirs back from temp. After that, running RP took just over 27 hours to complete and gave the "ACL found but not expected" message on just about every file on my hard drive. Do a search on that string and you'll find loads of other people having the same problems. It seems that ACLs are getting applied to thousands of files that they shouldn't be applied to during install.

Also of note: after the upgrade my user icon reverted to an older icon that I hadn't used in months and a second user I had set up for my wife some time back disappeared from the accounts list, but her home folder was still there.

[lockley]

I moved my entire home folder to a external FW drive, installed CLEAN leopard with format included and then moved my files back to a new admin account with the same name i used in tiger... result?

most folders in my home directory ask me for a password for EVERYTHING, some apps crash on quit because preference files can't be written...

I don't know unix, so, the question is:

Is there a MACOSX APP or simple terminal command i can use to fix this?

PD: Ive tried almos every combination of privilege settings with no solution, most files/folders say "account(me) - read & write" but i have to put my password to do anything...

thanks in advance

[Cy-Winnipeg]

I have had the same problem with permissions and having the "everybody" user twice.

The solution to the everybody user being twice is easy. Run the Terminal application and for your user directory and files in it, remove the permission to outside world users.

The following command solved it for me:

chmod -R o-rwx username
chmod -R g-rwx username

This got rid of both the "unknown" user and the 2nd "everyone" user.

The reason you get this everyone problem twice, is that there are actually 2 everyones. One seems to be a "group" named everyone, and one is outside world users. Thus, you see the name everyone twice.

As for getting rid of the ACL nightmare, the following worked for me.

1. What creates the ACL problem?
You can see it in action by creating a new user account (admin access), and create some dummy files in it. Try to change the names of these files, and no problem you can do so easily. Now go to up one directory level to your user folder, open a Get Info window on the new account you just made. You will see several users in the permission section, most likely "user", "staff", and "everyone".

Now use Get Info to apply a permission change to this new user account. For example, change the permission for "everyone" to Read Only. Then select "apply to enclosed items". Now go back to your home directory and try to change the file name of items in that account, and you will find you can't. Do a Get info on one of the files and in the permission section it says "You have custom access", instead of "You have read and write access".

You can also easily create the problem from the Terminal window, instead of the Get Info window. For example, go to your users folder using the Terminal application, and type the following in the terminal window.

chmod -R =rw,+X username

This will force Leopard to set the read and write permissions to the usual default to your user folder and to all files/folders recursively (this is what the -R is for) in your user folder (the +X will retain any execute permissions that are currently set). After doing this you will again create the problem.


2. What causes the problem?
Run the Terminal application (you should be in your home directory) and type:

ls -le

This will list all your files and folders in your home directory, along with the ACL extensions to the file permissions. On my machine I get under each "permission affected" files or folders the following additional information.

0: group:everyone deny delete

So this "everyone" person is not allowed to delete any files (or rename them). And this "everyone" person is a "group" that includes EVERYONE including the user as well. Thus, since "everyone" can't change files, neither can the user. This part is confusing at first to realize what is going on since in Unix terminology normally "everyone" only refers to the outside world, and not the user himself. I believe Apple tried to use the ACL extension to prevent certain files/folder that Leopard would not want the user to rename/delete (i.e. Pictures directory), but for some reason Leopard is applying this to all files, folder, and contents of folders.


3. The solution the solution is simple. Remove this ACL condition for all files or folders in your home directory.

3a. You typically can easily do this from the user folder level in Terminal, since the affected account also has the same ACL condition applied to it. Type ls -le to see if this condition is present for the affected user folder account itself. If it is, then all you have to do is type is:

chmod -R -a# 0 username

This will remove the ACL condition (numbered 0) from the user account folder, and all files or folders in it (the -R condition causes this recursive fix of all contents of all folders).

3b. You may not be able to do this from the user folder level in Terminal if the user folder itself does not have this ACL condition. In this case, simply go to your home directory in Terminal, and fix to each file or folder within your home directory individually, and do this recursively to all contents of folders so you don't have to do it for the contents of the folders in your home directory. Type ls -le, and find which files/folders are affected, and for each affected file/folder type the following to remove their ACL condition:

chmod -R -a# 0 file_or_folder_name

After doing this, if you type " ls -le " in Terminal window you will see that the ACL condition is gone from every fixed file or folder. Also, if you do a Get Info in Finder on any fixed file/folder you will see in the permission section the phrase "You can read and write".


Should the permission problem be fixed this way by canceling the ACL conditions, I am not sure. But it is now fixed on my machine (not solved, but fixed) and I again have full access to all my files.

[zeeb]

Hey Cy ---

You are a genius. I'm trying to perform a 'save as' to a Logic 8 file imported from 10.4.10 to 10.5.1, but even though my user(me) and admin options are showing 'read&write'/you have custom access i'm getting no joy....

I've tried ls -le and got ;

0: group:everyone deny delete , but no sign of ACL just;

'drwx------+ 4 username staff 136 Dec 12 12:45 Downloads', etc.....

I also tried the 'chmod -R -a# 0 username' in Terminal, but it tells me there is 'no ACL present'. I'm trying the second 3b part, but not sure how to navigate to my home directory in Terminal? Unfortunately, I'm a complete novice on terminal ;

"...In this case, simply go to your home directory in Terminal, and fix to each file or folder within your home directory individually, and do this recursively to all contents of folders so you don't have to do it for the contents of the folders in your home directory..."

I believe if I can get inside here I should be able to perform the fix --- and save the file i've just been working on! ...maybe.

Many thnx if you can help with the info ---

Cheers,

John

[Las_Vegas]

drwx------+ 4 username staff 136 Dec 12 12:45 Downloads

The plus symbol indicates ACL as does the 'group:everyone deny delete'

You cannot replace the file, but you can rename or move it. I suspect your primary problem is where the file was imported to. If the file is not in your Home directory or one of the folders therein, move it somewhere into your Home directory.

[Hal Itosis]

The 'unknown' entity in all these cases is likely the missing [user]group 501 (or 502, etc).

I don't believe any single cause has been identified yet, but somehow -- during the upgrade
and/or migration stage -- *some* Tiger users who had private groups (i.e., group 501, 502,
etc., whose group name matched their username) ended up with that group not existing in
the Directory Services database (/var/db/dslocal/nodes/Default/groups/).

So it shows up in Get Info windows as "unknown". Why changing that in Finder causes it to
crash I have no idea... but one of the simpler (relatively) solutions is to just re-create the
missing group. Another option is to change the unknowns to 'staff'. There are some threads
scattered about that discussed this... and one particular macosxhints tip arrived yesterday:

10.5: Repair a user/group Finder crashing issue

[observe the comment by robg, and my comment there as well.]

-HI-

[Hal Itosis]

The "group:everyone deny delete" ACL is another matter. That entry actually *belongs* on
certain Apple default user folders (Desktop, Documents, Downloads, Library, Movies, Music,
Pictures, Public, Sites... and the user's Home folder itself). If we try to delete one of those
folders, a password will be requested. [Not sure if that will actually allow the deletion.]

Anyway, I guess it's harmless enough to remove them all... idunno. I'd rather just remove
them from folders where they don't belong. (In fact... I actually *added* that entry to my
own ~/Applications and ~/bin).

Nonetheless, I believe the command:

chmod -R -N ~

will clear all ACLs from our Home.

-HI-

[CharlotteWeimar]

After installing Leopard on my new six month old iMac my User ID was lost and access denied to many files. Created a new ID and was able to get some access. But iPhoto library says 'Lost" although the images show in "all images" but are not accessible; iTunes is not there and Mail was empty. Had 30 minute call to 'Mac help' and was talked through a useless routine. Decided to copy all to an external HD, created a new ID and now have access to Mail & to iPhoto and iTunes when the HD is connected. Will Mac sort his out with software updates?

[Hal Itosis]

Quote: Originally Posted by CharlotteWeimar After installing Leopard on my new six month old iMac my User ID was lost and access denied to many files.

Did you do a "clean" install (erase the HD and import your docs with
Migration Assistant at the initial restart after installation), or did you
upgrade over Tiger with all user accounts remaining in place on the HD?

Quote: Originally Posted by CharlotteWeimar Created a new ID and was able to get some access. But iPhoto library says 'Lost" although the images show in "all images" but are not accessible; iTunes is not there and Mail was empty. Had 30 minute call to 'Mac help' and was talked through a useless routine. Decided to copy all to an external HD, created a new ID and now have access to Mail & to iPhoto and iTunes when the HD is connected.

More than likely, the perms on your docs don't match properly with those of your account.
Depending on how you installed, there are a few ways to fix this. Some of them will likely
be facilitated by using Terminal (both for changing things and also for communicating to us
the current conditions).

Quote: Originally Posted by CharlotteWeimar Will Mac sort this out with software updates?

If my guess is right, and your permissions are mismatched... then neither a software
update nor Apple's Disk Utility (to repair permissions) are of much value here. [When
I say "permissions", I'm also referring to owner ID and primary group assignment, etc.]

Perhaps if you do a clean install and migrate your stuff from a backup disk,
that could work. Not able to say much more about what I can't actually see.

-HI-

[mediter]

I accidentally messed up the Applications folder, by assigning different privileges to the default applications. I tried to remove the ACL files by using the command "sudo find <in-folder> -exec chmod -a# 0 {} +". But it didn't help. When executing this command in Terminal, it says "No ACLs Present". However, when use "ls -le" to check it out, it still reads that little plus symbol after the permissions.

[Hal Itosis]

Should only be the "/Applications" folder itself and the "/Applications/Utilities" folder
that have ACLs anyway. Anyway... if you've added a bunch, then my Dec. 13th post
should indicate a way to do it without 'find'. (And the syntax you posted doesn't look
right either; what's the + for?). I would think sudo chmod -R -N /Applications is
all it would take (but then you'll need to add ACLs back on the 2 folders I mentioned).

[JadeIIII]

Same problem...

Also, when Time Machine is backing up, my laptop (mbp 2gig ram 2.16ghz) often locks up, becomes unresponsive, or acts really strange...

Anybody else experience this? I bought a brand new lacie hd when leopard came out for Time Machine, and it has all of the latest updates...

I really hope some of these issues are resolved soon...

bye,
David

[Hal Itosis]

Quote: Same exact acl problem... Will apple fix this? I really hope some of these issues are resolved soon...

The issues discussed in this thread happened to a relative minority of users,
most (if not all) of whom did an "upgrade" rather than a clean install. The more
time that passes, the *less* likely Apple will care about such cases... as more
and more Leopard installs will be done cleanly. If it ever is "fixed", it will be in
the form of a 10.5.x DVD... that future (new) users will purchase.

Why don't you just do a clean install? [erase HD, migrate from backup]

As far as MacBookPro, Time Machine and LaCie goes... I have that exact setup,
with zero problems. Most likely, a clean install will be good for that too.

[Madison_Carl]

I’m a new subscriber, and a novice in dealing with UNIX level modifications of my Mac. I’ve run headlong into one of the permissions problems that have plagued new Leopard users, and I’ve tried to follow many of the user forums on the subject, but with admitted mixed levels of understanding. My problem seems to have a twist that I’ve not seen addressed in the forums, and I’m hoping you or one of the forum readers will be able to help.

My MacPro has six hard drives, four internal, and two external. Two of the internal, and both of the external drives show on the desktop as having the usual hard-drive icon, but also has a small “Yale lock” shown in the lower left hand corner of the icon. A get info shows that I (administrator) do not have write privileges on these four locked drives.

The following is a list of my UNIX level settings gleaned from the Terminal.

carl-j-bowsers-mac-pro:/ cbowser$ cd Users
carl-j-bowsers-mac-pro:Users cbowser$ ls -la
total 0
drwxr-xr-x 9 root admin 306 Jan 8 20:07 .
drwxrwxr-x 48 root admin 1700 Jan 6 09:30 ..
-rw-r--r-- 1 root wheel 0 Sep 23 19:43 .localized
drwxrwxr-x 13 root admin 442 Jan 8 12:47 Carlos
drwxr-xr-x 12 Guest _guest 408 Jan 8 20:07 Guest
drwxrwxrwt 14 root wheel 476 Jan 6 02:02 Shared
drwxrwxr-x 16 root admin 544 Jan 7 21:22 bowser
drwxrwxr-x 16 carlbowser admin 544 Jan 8 12:00 carlbowser
drwxrwxr-x 27 cbowser admin 918 Jan 9 14:19 cbowser

carl-j-bowsers-mac-pro:Users cbowser$ cd /Volumes
carl-j-bowsers-mac-pro:Volumes cbowser$ ls -la
total 8
drwxrwxrwt@ 8 root admin 272 Jan 9 09:43 .
drwxrwxr-x 48 root admin 1700 Jan 6 09:30 ..
drwxrwxr-x+ 14 root admin 544 Dec 19 09:06 Backup_external
drwxrwxr-x@ 42 cbowser cbowser 1496 Jan 3 09:31 LaCie Disk
lrwxr-xr-x 1 root admin 1 Jan 9 09:42 Leopard HD -> /
drwxrwxr-x@ 49 cbowser cbowser 1734 Jan 9 09:12 Macintosh HD
drwxrwxr-x@ 14 cbowser cbowser 544 Dec 31 14:01 Photos
drwxrwxr-x+ 20 cbowser cbowser 748 Jan 3 09:27 Photos Backups

carl-j-bowsers-mac-pro:Volumes cbowser$ whoami
cbowser


Using “Get Info for the six drives reveals that three of the four locked drives have “(unknown)” as a user. They are: Photos, Photos Backups, and LaCie Disk. Another unlocked disk has the unknown user, and that is the disk on which resides a bootable Tiger shell. Further I have absolutely no idea who “wheel” is. Suggestions?

I’d like to remove the locked icons and return permissions to the admin account (cbowser). Any suggestions you could offer would be appreciated immensely.

A suggested script using my username and procedural approach would give me that confidence to try what I’m at this point unwilling to try for fear of doing irreversible harm.

Thanks, Carl

[Hal Itosis]

Quote: Originally Posted by Madison_Carl Further I have absolutely no idea who “wheel” is.

Wheel is to groups as root is to users. Its gid is 0 (zero).
Actually, both items shown in your lists with "wheel" look 100% correct.

These listed user folders have wrong ownerships:
drwxrwxr-x 13 root admin 442 Jan 8 12:47 Carlos
drwxrwxr-x 16 root admin 544 Jan 7 21:22 bowser

These listed user folders have *atypical* groups (as do the above):
drwxrwxr-x 16 carlbowser admin 544 Jan 8 12:00 carlbowser
drwxrwxr-x 27 cbowser admin 918 Jan 9 14:19 cbowser
...but, I suppose that's doable.

These volumes (which you say appear locked?) are... interesting:
drwxrwxr-x@ 42 cbowser cbowser 1496 Jan 3 09:31 LaCie Disk
drwxrwxr-x@ 49 cbowser cbowser 1734 Jan 9 09:12 Macintosh HD
drwxrwxr-x@ 14 cbowser cbowser 544 Dec 31 14:01 Photos
drwxrwxr-x+ 20 cbowser cbowser 748 Jan 3 09:27 Photos Backups

Apparently "Photos Backups" has an ACL... and -- for all we know --
the others may also have ACLs. Unfortunately, the @ overrides the +
when ls displays that string... so there's no way to be sure unless we
explicitly tell ls to show us any ACLs. Also... there may be flags which
have locked these disks... but we need to tell ls to display them.

Do it again with the -e and the -O options: ls -lkbaeO /Volumes
[that's an uppercase o... not a zero.]

While you're there, the id command will show some info whoami missed.

[Madison_Carl]

Thanks to Hal_Itosis for hints and a local UNIX expert who helped identify the problem. Three and a half hours with a very patient and helpful Apple expert I have unlocked the four offending drives. I offer this summary in the hopes that it might help others with a similar problem.

The helpful woman who finally led me to a "sudo" session with the terminal found the solution on the web page: http://docs.info.apple.com/article.html?artnum=106237.

Procedure:
1) Unplug my external drives and restart the MacPro

2) Using terminal I used the following command for each of the offending, internal drives with the lock symbol.

sudo chflags -R nouchg 'volume name'

That cleared the locked icon for the internal drives, and I then transferred all files from the external "locked" drives then reformatted them with Apples "Disk Utility".

Using 'Disk Utility' the two external volumes show that the S.M.A.R.T. Status is 'Not supported' and the Partition Map Scheme is set to 'Apple Partition Map'.
The internal drives have S.M.A.R.T. Status as 'Verified' and the Partition Map Scheme set at 'GUID Partition Table'. I'm not sure why the two are different, and would appreciate any insights any of you experienced UNIX-Leopard users may have.

Thanks again Hal.

[johnsawyercjs]

Quote: Originally Posted by Madison_Carl Using 'Disk Utility' the two external volumes show that the S.M.A.R.T. Status is 'Not supported' and the Partition Map Scheme is set to 'Apple Partition Map'. The internal drives have S.M.A.R.T. Status as 'Verified' and the Partition Map Scheme set at 'GUID Partition Table'. I'm not sure why the two are different, and would appreciate any insights any of you experienced UNIX-Leopard users may have.

SMART isn't supported for Firewire or USB drives--only for drives directly connected to the ATA or SATA bus.

APM is Apple's older partitioning scheme; GUID is the newer scheme, used with Intel-based Macs, but Intel Macs work properly with APM, but not as a startup volume--Intel Macs can start up from an APM volume, but some things won't work right, and you can't install OS X onto an APM volume that's connected to an Intel Mac. Your internal drives are partitioned as GUID since your Mac is Intel-based. Your external drives may predate your Intel Mac; they'll work fine as APM, so though they can be re-initialized as GUID, there's no need to, unless you want to install or copy OS X onto them.