5 ms·

> recursively chown /usr/local to myself As of 1.0.0: you don't need to do this any more and we don't ask you to.

by mikemcquaid 10y ago

lisper 10y ago
Ah, that is very good to know! Thank you! I will take a fresh look at homebrew. :-)
- mikemcquaid 10y ago
  To perhaps save you some effort: we still ask you to chown e.g. `/usr/local/bin` which may or may not make it unacceptable to you.
  - lisper 10y ago
    That's not quite as bad as all of /usr/local, but still not great. Why "e.g."? What else is there? And why not just use /usr/local/homebrew or even better, a path determined by an environment variable? I don't mind giving you a user-owned directory to install things in. I mind very much being required to change system default security settings.
    - mikemcquaid 10y ago
      We don't require you to take ownership of any directories that already exist when macOS is installed (i.e. `/usr/local` subdirectories but not `/usr/local` itself). Regardless of whether we should have picked another path, changing now would require rebuilding all our binary packages and that's a lot of effort with little return and almost certain breakages.
      - lisper 10y ago
        I haven't done a clean install of OS X in a long time, but I'm pretty sure /usr/local/bin exists. But even if it doesn't I don't find this a compelling argument. Having /usr/local/bin owned by root is a universally accepted standard in the unix world, and with very good reason: having /usr/local/bin owned by a user introduces security risks.
        sigzero 10y ago
        I believe /usr/local/bin is empty on a fresh install.
        ams6110 10y ago
        It should be -- after all, it's there for local software.
        hibbelig 10y ago
        What are those risks?
        lisper 10y ago
        /usr/local/bin is a global resource. It is generally full of binaries that get run by many different users including root. If a regular user can replace those binaries the result is a privilege escalation.
        stiGGG 10y ago
        which programs from /usr/local/bin get run by root under current macOS?
        lisper 10y ago
        Well, by default /usr/local/bin is empty. But people commonly install things there that eventually get run by root. The most obvious example is various programming languages, different versions of Python, alternate shells, etc.
        mikemcquaid 10y ago
        `/usr/local` is empty on a new install. I reconfirmed with a clean install VM.
    - comex 10y ago
      You can use a different directory, though some packages may be broken: https://github.com/Homebrew/brew/blob/master/docs/Installation.md https://github.com/Homebrew/brew/blob/master/docs/Installati...
      - lisper 10y ago
        Yeah, that's kind of the situation I'm in. So for any given package it's a crap shoot whether or not it will work. (And if it doesn't work, uninstalling it can be a real problem!) Hence my continued mixed feelings about homebrew in general.
    - deleted 10y ago
      [deleted]
  - the_other 10y ago
    (Reaching back into foggy memory...) The last time I installed Homebrew, I think I had the problem that `/usr/local/bin` didn't exist, and I didn't have write permissions for `/usr/local/` so I couldn't create it (w/out sudo/chown) etc. This, using Sierra. Does that seem likely? Usual? What's the ideal solution?
    - mikemcquaid 10y ago
      You need to use `sudo` as a one-off thing when you install Homebrew. Our installer does that for you otherwise we'll prompt you with `brew doctor`.
      - jessedhillon 10y ago
        Why don't you have your binaries installed in a user-owned directory like ~/brew or whatever, and then put that at the front of the path? Asking people to `chown` a system path is plainly a contravention of the principle of least privilege.
        mikemcquaid 10y ago
        `~/brew` varies from username to username and requires us to be able to relocate all binaries so they reference the correct path. We do this for as many as possible but it's not possible for all of them.
andreareina 10y ago
I'm on an older version (0.9.5); how do I fix the ownership of my /usr/local tree? EDIT: I know how to `chown`, I mean more, what can I give back to root, what needs to remain under homebrew's control? Does the new version ship with a tool/command that does this?
- mikemcquaid 10y ago
  `brew update` and check you've not hit the update bug: https://github.com/homebrew/brew#update-bug https://github.com/homebrew/brew#update-bug We'll tell you what permissions you need to keep/remove. Alternatively, uninstall and reinstall Homebrew and similarly we'll tell you on permissions.

> recursively chown /usr/local to myself As of 1.0.0: you don't need to do this any more and we don't ask you to.

lisper 10y ago

Ah, that is very good to know! Thank you! I will take a fresh look at homebrew. :-)

mikemcquaid 10y ago
To perhaps save you some effort: we still ask you to chown e.g. `/usr/local/bin` which may or may not make it unacceptable to you.
- lisper 10y ago
  That's not quite as bad as all of /usr/local, but still not great. Why "e.g."? What else is there? And why not just use /usr/local/homebrew or even better, a path determined by an environment variable? I don't mind giving you a user-owned directory to install things in. I mind very much being required to change system default security settings.
  - mikemcquaid 10y ago
    We don't require you to take ownership of any directories that already exist when macOS is installed (i.e. `/usr/local` subdirectories but not `/usr/local` itself). Regardless of whether we should have picked another path, changing now would require rebuilding all our binary packages and that's a lot of effort with little return and almost certain breakages.
    - lisper 10y ago
      I haven't done a clean install of OS X in a long time, but I'm pretty sure /usr/local/bin exists. But even if it doesn't I don't find this a compelling argument. Having /usr/local/bin owned by root is a universally accepted standard in the unix world, and with very good reason: having /usr/local/bin owned by a user introduces security risks.
      - sigzero 10y ago
        I believe /usr/local/bin is empty on a fresh install.
        ams6110 10y ago
        It should be -- after all, it's there for local software.
      - hibbelig 10y ago
        What are those risks?
        lisper 10y ago
        /usr/local/bin is a global resource. It is generally full of binaries that get run by many different users including root. If a regular user can replace those binaries the result is a privilege escalation.
        stiGGG 10y ago
        which programs from /usr/local/bin get run by root under current macOS?
        lisper 10y ago
        Well, by default /usr/local/bin is empty. But people commonly install things there that eventually get run by root. The most obvious example is various programming languages, different versions of Python, alternate shells, etc.
      - mikemcquaid 10y ago
        `/usr/local` is empty on a new install. I reconfirmed with a clean install VM.
  - comex 10y ago
    You can use a different directory, though some packages may be broken: https://github.com/Homebrew/brew/blob/master/docs/Installation.md https://github.com/Homebrew/brew/blob/master/docs/Installati...
    - lisper 10y ago
      Yeah, that's kind of the situation I'm in. So for any given package it's a crap shoot whether or not it will work. (And if it doesn't work, uninstalling it can be a real problem!) Hence my continued mixed feelings about homebrew in general.
  - deleted 10y ago
    [deleted]
- the_other 10y ago
  (Reaching back into foggy memory...) The last time I installed Homebrew, I think I had the problem that `/usr/local/bin` didn't exist, and I didn't have write permissions for `/usr/local/` so I couldn't create it (w/out sudo/chown) etc. This, using Sierra. Does that seem likely? Usual? What's the ideal solution?
  - mikemcquaid 10y ago
    You need to use `sudo` as a one-off thing when you install Homebrew. Our installer does that for you otherwise we'll prompt you with `brew doctor`.
    - jessedhillon 10y ago
      Why don't you have your binaries installed in a user-owned directory like ~/brew or whatever, and then put that at the front of the path? Asking people to `chown` a system path is plainly a contravention of the principle of least privilege.
      - mikemcquaid 10y ago
        `~/brew` varies from username to username and requires us to be able to relocate all binaries so they reference the correct path. We do this for as many as possible but it's not possible for all of them.

andreareina 10y ago

I'm on an older version (0.9.5); how do I fix the ownership of my /usr/local tree? EDIT: I know how to `chown`, I mean more, what can I give back to root, what needs to remain under homebrew's control? Does the new version ship with a tool/command that does this?

mikemcquaid 10y ago
`brew update` and check you've not hit the update bug: https://github.com/homebrew/brew#update-bug https://github.com/homebrew/brew#update-bug We'll tell you what permissions you need to keep/remove. Alternatively, uninstall and reinstall Homebrew and similarly we'll tell you on permissions.