Home Forums Mac Software Mac Operating Systems Repairing Permission Prior to Updating the OS

A. It seems (to me) a commonly held/believed/accepted practice that it is wise to Repair Permissions prior to installing an OS Update. MacFixIt may also endorse this practice, but of that I am uncertain.

B. I have also read (source unknown) that Repairing Permission prior to an OS install is a waste of time because the installer runs as root and thus does not affect permissions.

(Repairing Permissions after the OS install is not at issue.)

So, is “A” a techo-myth or is “B” correct? Or, maybe neither?

It's a myth. Not only is there no need to repair permissions prior to system updates, but there hasn't been any reason to regularly repair permissions since at least 10.3. Back in the day, there were a lot of bugs and/or poor code that required way-too-frequent permissions fixes. That was why repairing permissions was always considered a panacea. However, that was a long time ago and Mac OS has come a long way.

If you recently installed a third-party app and have some issues, sometimes repairing permissions can still help, since third-parties installers can be poorly coded to leave system files with the wrong permissions. But that's pretty rare today. Used to be a regular problem with MS Office, Adobe CS, and HP printer drivers, for example, but not really anymore.

Furthermore, usually the few permissions issues that you'll see fixed nowadays are minor and irrelevant. Just because the permissions are different from what the OS thinks they should be, doesn't inherently make them problematic.

Bottom line, IMHO, no reason to repair permissions before a system update. And no reason to do it regularly; it should be used in troubleshooting, not routine maintenance.

Mt thanks for the cogent, easily understood explanation. 'Tis most appreciated!

Even after all this time, it's nice to read something that tells me I "done good" when I held out. OS 9.2 was very stable. I was quite content to let others experience the early "Cats" while I waited in the shadows. And :fingerscrossed:/:knockonwood: I have yet to experience a kernel panic with Leopard, nor have I ever needed to repair permissions. :clap:

MFIs Main Page is once again perpetuating the myth (if not actually saying so themselves) re the necessity of repairing permissions prior to OS install/update.

Me thinks it's time to consign that page to whence the CNET MFI forums doth reside.

I think they mean it as more of a "hey, might as well, you never know" thing than anything else -- and it can't hurt -- but yeah, it gives folks the wrong idea about general Mac OS best-practice maintenance requirements. If someone hadn't updated their OS in a very long time and is the type to install all sorts of junk from all over, I certainly wouldn't advise against repairing permissions. But I also wouldn't have it in my step-by-step list.

I think the most-important step to highlight is quitting all running apps and not toying around with the system during the update, especially not Apple apps (!). And for folks who leave their Macs running for days & weeks at a time, a fresh reboot first wouldn't hurt to flush things out (but not necessary). My own personal paranoia is still using the combo updaters just in case, but in general that isn't usually necessary anymore for most folks. I always like to have a copy of the full combo update installer for corporate rollout anyways, so the extra download time doesn't phase me, as it may some.

I would agree that repairing permissions before the update may be a waste of time, especially under Leopard, notoriously slow in this respect. We had extensive coverage of the database glitches causing tens of permissions repaired every time. However, I would disagree that repair is not recommended after the update. When I went from 10.5.6 to 10.5.7, the usual permissions were "repaired". At the same time, transition to 10.5.8 with a combo updater caused a much more extensive "repair" (hope this is corroborated by others). I suspect it was prudent to run DU after the 10.5.8 update, although the meaning of this repair is kind of obscure yet. Hopefully, Snow Leopard would take care of the database issue. But I agree 100% with the last paragraph in Doni's post above.

Update: MacFixit article highlights real problems with permissions related to a new database glitch in 10.5.8, and provides a Terminal-based cure:
http://www.macfixit.com/article.php?story=20090806095905196

I can confirm the very long list of repairs after using the 10.5.8 combo. I could have used the delta but I always use the combo.

Likewise, on both counts.

Are you sure it is repairing the permissions and not just listing differences that are not actually repaired? It's pretty normal for Disk Utility to just display some differences that it doesn't repair; this has become more common in more recent OS releases. Please try repairing permissions again and seeing if that long list is still there.

I think much of the reason many folks think regular permissions repairing is still needed is because they are just seeing the same reported items, not that any repair is truly being done. I've never quite understood why, but it's normal.

When I just repaired permissions after 10.5.8 combo update, it only actually repaired a dozen irrelevant items in a list ten times as long. In other words, the repairing of permissions wasn't necessary.

No, I don't know what was actually repaired, and I haven't yet repeated it to get an impression, but I'll do so later today. As it happened, after the OS update & permissions repair I ran into an unrelated snag that sucked quite a bit harder (and more successfully) at my time... I'm aware of your position on the issue you describe, and was surprised that you actually ran the repair yourself anyway.

Heh, well I only ran it after the reports here. My assumption going in was Apple probably just didn't QC the 10.5.8 combo updater properly. So I was all ready to concede, until I decided to run it a second time. Sure, enough, the second list was almost as long as the first. Face saved (for now)

This thread inspired me to run Permission Repair after performing the OS X 10.5.8 update on the computers around here. My observations were:

• The list of "repaired" permissions on three different Macs was identical with only three or four exceptions.
• Running Permission Repair a second time on the same Mac produced the same list of "repairs" with the exception that the three or four exceptions disappeared from the list
• For some reason I cannot explain at this point Permission Repair on machine with by far the fewest installed applications, a MacBook Air, took almost two hours to complete the first attempt. The time for the second run on the same machine was comparable to the other two Macs.

It is doubtful it would have ever occurred to me to run Permission Repair if I hadn't been prompted by this thread.

> It is doubtful it would have ever occurred to me to run Permission Repair if I hadn't been prompted by this thread.

I'm surprised that nobody has referenced this MacFixIt article and the Apple Discussions thread to which it links.

The issue appears to be more complicated that has been reported here.

Artie, read my post above for the link...
10.5.8 seems to be "nastier" in this respect than the previous ones.

> Artie, read my post above for the link...

Edit: Oops! No oops; I read your post before you updated it and never looked back to see that you had done so.

> 10.5.8 seems to be "nastier" in this respect than the previous ones.

Yep... So it does. (Reading the comments to that article can make your head spin, although the most recent one says that merely re-running the Combo fixed the problem.)

I will try that and post back.

After reading the article I went back and checked my permissions to find that I had the ? with _ _ _ _ _ permissions on several system files. Running the combo update twice in a row in safe mode seems to have fixed it for now.

OK here are some of the results of a second permissions repairs after having one done immediately after the 10.5.8 update. Clearly, the two runs should have been performed in sequence instead of with an interval of about 2 days, but here it is. I copied the two DU logs into Word docs and compared them:

- Item ID (same vs. different):
Almost half of the items repaired were the same (64 same vs. 69 different), but their permissions were mostly different (53 different, 11 same). The kind of change (added 'x's in 1st, 'l' in 2nd) is consistent across all items involved. For example:

1st: should be -rw-r--r-- , they are lrwxr-xr-x .
2nd: should be -rw-r--r-- , they are lrw-r--r-- .


- Count data 1st vs. 2nd repair:
Words: 2069 - 1762
Characters (w/o spaces): 23,702 - 20,774
Characters (w/ spaces): 25,677 - 22,451
Paragraphs (CRs): 135 - 119
Lines: 384 - 342

So, in addition to a minor quantitative difference of approx. 10-15% between 1st and 2nd repair, there is a much larger qualitative difference (approx. 50%) between the two. Of course, one could argue about how meaningful those differences really are. Perhaps it's enough to cover your face...

Did not work for me. After the second application of 10.5.8 combo, the same (or nearly, see Alternaut's post above) huge list of permissions was repaired.

so, I'm getting the same repeated permissions as alternaut. but if the combo updater isn't fixing them (I had updated via SU), what's the next idea? the mac is running fine, so it's just an exercise to repair permissions at this point.

should I just wait for 10.5.9?....

I would definitely agree with that. Doubt that it would come with 10.5.9; my hope is with 10.6. Boy, I miss the tame Tiger...

Don't repair permissions.

Seriously, if your Mac "is running fine," there's no reason to repair permissions.

Second that! And if the Mac is not running fine, this often would not help.

Considering that the release of 10.6 is just around the corner, it's entirely possible that 10.5.8 is the last update to Leopard.

OMG! then i'll be really really really really behined!

PChaterosx—

While I know we don't strictly observe the distinction between troubleshooting threads, which are for helping to provide information and advice about various Mac-related issues, and "social" threads, which are meant to be in the Lounge (that's what the Lounge is for!), it's really not appropriate to make comments in a thread like this which offer no useful information regarding the topic under discussion.

Your enthusiasm is admirable , but please keep the off-topic comments out of troubleshooting threads.

Thanks, and good luck with everything.

Sorry can you move it to the right place, please?

> OMG! then i'll be really really really really behined!

Since this hasn't yet been moved to the Lounge I'll respond to it here.

Snow Leopard is *Intel* Mac *only*, so your *PPC* PowerBook will *not* be able to run it, so you will *not* be any further behind than you currently are, i.e. really, really, really.

> After the second application of 10.5.8 combo, the same (or nearly, see Alternaut's post above) huge list of permissions was repaired.

The post immediately (I think) above the one I cited says you've got to rerun the Combo *before* repairing permissions, while the one I cited says the fix worked even *after* repairing them.

I dunno!

The key is that Apple changed the package structure for applications and neither Disk Utility nor the original installer manifests have any awareness of this change, and so throw out spurious "error" messages.

Let me back off for a moment with some context. Leopard allows for "code signing" with a cryptographic hash to prove that an application has not been altered. The core idea is that malware, upon making unauthorized changes to an application, would be detected. Leopard could -- but does not currently AFAICT -- reduce the affected application's privileges upon detection and so limit any potential harm.

Leopard does recognize and use the signature in the new application firewall. For signed applications, you are NOT asked to approve access to the internet upon updating a signed application. You may notice that unsigned third-party applications however will re-ask for approval upon any update to that applications. As there is no signature, there is no way to prove it is the same application, so the user must manually provide that approval.

I'm not sure how else the signing is used in Leopard, although I expect it to be more integrated in future OS X releases. The iPhone's version of OS X is much stricter, and won't allow installing unsigned applications. In fact, that is the whole idea behind "jailbreak" tools; to allow unsigned applications to be installed and used. And that act increases the attack surface of the iPhone to malware.

Somewhere -- I forgot which point update -- in Leopard's history, Apple restructured the application package (remember that an OS X application is not a single file, but a potentially large collection of files and resources in multiple directories.) There used to a single file with cryptographic fingerprints for every file at the top level of an application's bundle. Newer point version of 10.5.x added a directory just to hold the hashes. For backwards compatibility, Apple added a soft link (alias) in the top level to the new location within a _CodeSignature folder. It would seem Apple is preparing to allow for a more granular set of fingerprints rather than requiring everything being thrown into one large file.

Repairing permissions looks at the original manifest, expects a file called CodeResources, and instead finds the modified structure of a soft link call CodeResources pointing to the file in its new location under the _CodeSignature directory. This change is responsible for the error message (the "l" is the new link) in every application or code-containing bundle (including internet plugins) that has been updated to the new directory structure. It is an error only in the sense that Disk Utility is not aware of the equivalence between the older and newer bundle structure. One can presume that an install of Snow Leopard would include installer manifests reflecting the new structure and hence would not indicate these spurious errors.

To that end, I'm not sure it is even worth worrying about. If one has a problem due to permissions, and repairing permissions fixes it, great. If not, and I believe this business of repairing permissions has been elevated to the point of obsessiveness, also great. In any case, those "error" messages are certainly NOT indications of anything being broken or damaged.

And a miracle occurs: Our very own joemikeb is quoted at MacFixit (aka CNET) in UPDATED: Worried about permissions?. There should have been a link to FTM.

As I've been saying all along: Don't worry about it!

Added a comment to that MFI thread:

Shouldn't it read, former MacFixIt Forums and current FineTunedMac.com moderator "joemikeb"?

Hey at least I got credit for the post.