Monitoring and Troubleshooting Permissions and Flags

This section examines how to obtain information about permissions and flags and how to correct some common problems. You will learn how to use options to the find command to find files with specific permissions or flags set. You will also learn what Disk Utility's permission check does and does not do.

Finding Files by Permission Mode

You can use the -perm option to the find command to identify files with specific permissions. Specify +1000 to list folders with the sticky bit set. Specify +4000 to list setUID programs, +2000 to list setGID programs, and +6000 to list both.

For example, the following find command lines find setUID and setGID programs, respectively, and then perform a long listing on each one.

$ find . -perm +4000 -exec ls -l {} \; -rwsr-xr-x 1 root wheel 36516 23 Sep 23:39 ./ps $ find . -perm +2000 -exec ls -l {} \; -r-xr-sr-x 1 root operator 23336 23 Sep 23:47 ./df

Finding Locked Files

Locked files in the Trash might cause the Finder's Empty Trash process to fail.

You can use the -flags option to the find command to identify files with specific flags set. Specify +uchg to list files locked with the uchg flag. For example:

$ cd /Applications/Adobe\ Acrobat\ 5.0/ $ find . -flags +uchg ./Distiller/Settings/eBook.joboptions ./Distiller/Settings/Press.joboptions ./Distiller/Settings/Print.joboptions ./Distiller/Settings/Screen.joboptions

Repairing Disk Permissions in Disk Utility

Occasionally a program or install package will modify permissions resulting in applications that are not running correctly. You can run Disk Utility to repair permissions on your system drive as a regular maintenance task.

Disk Utility uses the receipts from the installation of Mac OS X or Mac OS X Server as a reference for file permissions. If files are not installed as part of an installer package, then Disk Utility will not be able to verify or repair the permissions on those files.

The permissions for installed files are stored in the bill of materials (BOM) files under /Library/Receipts. The Mac OS X installer uses a BOM to determine which files to install, remove, or upgrade. You can use the lsbom command to view the permissions in a BOM. For example:

$ lsbom -p ?Mf /library/Receipts/BSD.pkg/Contents/Archive.bom root/admin  drwxrwxr-t  . root/admin  drwxrwxr-x  ./Library root/admin  drwxrwxr-x  ./Library/Documentation root/admin  drwxrwxr-x  ./Library/Documentation/Commands root/admin  drwxrwxr-x  ./Library/Documentation/Commands/bash

More Info

For more information on BOMs, see the man page for lsbom.

Because home folders are not part of any package, Disk Utility does not repair them. For example if the user changes permissions on files and folders they own, permissions on those will not be repaired.