4 ms·

Disabling SIP, at least from Apple's POV does most of what you want. They've also implored people to be good UNIX citizens and make liberal use of /usr/local, w

Disabling SIP, at least from Apple's POV does most of what you want. They've also implored people to be good UNIX citizens and make liberal use of /usr/local, which they explicitly give you - the user of the hardware - ownership of.

saagarjha 7y ago
> They've also implored people to be good UNIX citizens and make liberal use of /usr/local, which they explicitly give you - the user of the hardware - ownership of. /usr/local is root:wheel by default. macOS provides it to you as a place to put your software, but it not give your user ownership of this directory.
- stephenr 7y ago
  > but it not give your user ownership of this directory. Admin users can sudo, sudo should be used to install software. Your thinking is the shenanigans that Brew does, making `/usr/local/whatever` writable by anyone, without a password. This is not how smart people install software. Edit: wow what a typo. One character completely reversed the intend meaning of the last sentence.
  - saagarjha 7y ago
    > This is now how smart people install software. On the contrary, I think what Homebrew does with regards to permissions is fundamentally incorrect. /usr/local, being shared, should be owned by root, and it should require administrator permissions to install software there.
    - stephenr 7y ago
      Gah, sorry typo in my comment, it should say "not", but it says "now. Anyway, I agree, it should be root owned and use sudo/similar to install. Sorry for the confusion!
    - fiddlerwoaroof 7y ago
      If I shared my Mac with anyone I’d agree, but as it is, my Mac is a single-user machine and I’d rather run brew as myuser:mygroup to avoid running the install scripts as root.
      - stephenr 7y ago
        With Brew it's a moot point - you can't choose to do otherwise, it will refuse to run as root, and has no capability to do the "normal" `make && sudo make install` pair, where you build as user and install as root.
        fiddlerwoaroof 7y ago
        I'd rather not run a random `make install` (or, in Brew's case, as random ruby script) as root, though.
        stephenr 7y ago
        And that's what a user ~/bin directory is for then - you don't want to run as root, install in your home. Installing user-own software, in a user-specific location is fine. /usr/local is not user specific, and setting the permissions so it is treated that way doesn't stop other software referring to it as a system-wide $PATH.
        Wowfunhappy 7y ago
        There is no ~/bin directory on macOS though. Homebrew could create one, but iirc Apple's guidelines discourage creating new directories in the user's home folder. (Which I generally agree is a bad practice, btw, although this might be an exception.) I guess you could put something in the ~/Library folder, although that's not ideal either...
        stephenr 7y ago
        There's no `/usr/local/Brew` (or whatever directory it uses) either, but it creates it, and it changes the ownership of `/usr/local/bin` to make it writable without a sudo prompt - which is more egregious than creating a `~/bin` directory, any day of the week. If they didn't insist on using `/usr/local/bin` (which is in the default $PATH) the permissions issue would be much less of an issue IMO (not a non-issue, but less of an issue than it is currently)
  - fiddlerwoaroof 7y ago
    I happily make /usr/local owned by myuser:mygroup—on a single-user machine that’s no more dangerous than putting ~/bin into $PATH
    - stephenr 7y ago
      If you edit your own $PATH, it literally only affects your user account. `/usr/local/bin` is in the default $PATH, so making it world writable means anything malicious installed there may end up being called by a system utility that runs as another user than your own. For your (and Brew's stated goal), installing into ~/bin would be a better result, because it's literally that single users account. But the Brew developers never want to hear any criticism of their ridiculous bullshit, whether it's security issues or their half-assed dependency resolution.
  - chrisfinazzo 7y ago
    I should have been clearer about this^ On most systems with 1 user it's irrelevant as by default they are in the admin group. Rather, usr/local exists and you may read and write into it even if you don't have explicit ownership (e.g, root). Whether that's brew, or your own script doesn't really matter.
    - stephenr 7y ago
      On Mojave at least, `/usr/local` is owned by root:wheel, the first user account (which has admin rights) is not in the wheel group but can use sudo to write to `/usr/local`.

saagarjha 7y ago

> They've also implored people to be good UNIX citizens and make liberal use of /usr/local, which they explicitly give you - the user of the hardware - ownership of. /usr/local is root:wheel by default. macOS provides it to you as a place to put your software, but it not give your user ownership of this directory.

stephenr 7y ago
> but it not give your user ownership of this directory. Admin users can sudo, sudo should be used to install software. Your thinking is the shenanigans that Brew does, making `/usr/local/whatever` writable by anyone, without a password. This is not how smart people install software. Edit: wow what a typo. One character completely reversed the intend meaning of the last sentence.
- saagarjha 7y ago
  > This is now how smart people install software. On the contrary, I think what Homebrew does with regards to permissions is fundamentally incorrect. /usr/local, being shared, should be owned by root, and it should require administrator permissions to install software there.
  - stephenr 7y ago
    Gah, sorry typo in my comment, it should say "not", but it says "now. Anyway, I agree, it should be root owned and use sudo/similar to install. Sorry for the confusion!
  - fiddlerwoaroof 7y ago
    If I shared my Mac with anyone I’d agree, but as it is, my Mac is a single-user machine and I’d rather run brew as myuser:mygroup to avoid running the install scripts as root.
    - stephenr 7y ago
      With Brew it's a moot point - you can't choose to do otherwise, it will refuse to run as root, and has no capability to do the "normal" `make && sudo make install` pair, where you build as user and install as root.
      - fiddlerwoaroof 7y ago
        I'd rather not run a random `make install` (or, in Brew's case, as random ruby script) as root, though.
        stephenr 7y ago
        And that's what a user ~/bin directory is for then - you don't want to run as root, install in your home. Installing user-own software, in a user-specific location is fine. /usr/local is not user specific, and setting the permissions so it is treated that way doesn't stop other software referring to it as a system-wide $PATH.
        Wowfunhappy 7y ago
        There is no ~/bin directory on macOS though. Homebrew could create one, but iirc Apple's guidelines discourage creating new directories in the user's home folder. (Which I generally agree is a bad practice, btw, although this might be an exception.) I guess you could put something in the ~/Library folder, although that's not ideal either...
        stephenr 7y ago
        There's no `/usr/local/Brew` (or whatever directory it uses) either, but it creates it, and it changes the ownership of `/usr/local/bin` to make it writable without a sudo prompt - which is more egregious than creating a `~/bin` directory, any day of the week. If they didn't insist on using `/usr/local/bin` (which is in the default $PATH) the permissions issue would be much less of an issue IMO (not a non-issue, but less of an issue than it is currently)
- fiddlerwoaroof 7y ago
  I happily make /usr/local owned by myuser:mygroup—on a single-user machine that’s no more dangerous than putting ~/bin into $PATH
  - stephenr 7y ago
    If you edit your own $PATH, it literally only affects your user account. `/usr/local/bin` is in the default $PATH, so making it world writable means anything malicious installed there may end up being called by a system utility that runs as another user than your own. For your (and Brew's stated goal), installing into ~/bin would be a better result, because it's literally that single users account. But the Brew developers never want to hear any criticism of their ridiculous bullshit, whether it's security issues or their half-assed dependency resolution.
- chrisfinazzo 7y ago
  I should have been clearer about this^ On most systems with 1 user it's irrelevant as by default they are in the admin group. Rather, usr/local exists and you may read and write into it even if you don't have explicit ownership (e.g, root). Whether that's brew, or your own script doesn't really matter.
  - stephenr 7y ago
    On Mojave at least, `/usr/local` is owned by root:wheel, the first user account (which has admin rights) is not in the wheel group but can use sudo to write to `/usr/local`.