16

Warning: SUID file “System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent” has been modified and will not be repaired.

I keep getting this after running Disk Utility to repair permissions.
Will this cause problems?

22

It's simply telling you that the file has been modified, and because it's been modified Disk Utility can't fix the permissions on it.

ARDAgent.app is the Apple Remote Desktop agent, and the file shown in the path above is the binary file contained within the app package. It's normal for the file to be shown as an error here. Simply ignore it.

Apple KB article TS1448 details which error messages you can ignore in Disk Utility.
The error that you provided is shown in the list, so it can be safely ignored.

Disk Utility's Repair Disk Permissions messages that you can safely ignore

  • Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.
  • Many thanks to you for you help I will ignore it!! – Bob Winn Nov 19 '13 at 20:03
  • 2
    After investigating this a bit, I found that this particular program was known to have a security hole. Since it's an SUID executable, having a buffer overflow issue or providing the ability to execute arbitrary code makes it a privilege escalation vulnerability. Given that Disk Utility is complaining that the file has been modified, and that Apple has listed it as a warning that is safe to ignore: I'd guess that they patched it, but didn't tell Disk Utility to recognize the new version – TrinitronX Jan 30 '15 at 0:28
  • 2
    It is alarming though to find an SUID executable that a known trusted Apple application like Disk Utility warns about being modified. Usually when a tripwire-like tool warns about some executables on the system being modified from their original signatures/checksums, then it raises a red flag. This is especially alarming if it's also an SUID executable, and has a known flaw. So, bear in mind it's always good to be careful. – TrinitronX Jan 30 '15 at 0:34
  • Files can be modified and permissions changed when they're in use (they can even be deleted). The changes simply don't affect any instances of the file already in memory. The message means the file has changed from what was on record, not that it is in use. – teppic Mar 30 '15 at 18:38
5

Don't worry, this is one of the messages that are safe to ignore. For a full list, visit the Apple Knowledge Base article on this topic.

-1

This error happened after I updated to the latest RDA from Apple. To track it down I did the following:

  1. Clean install of OS X 10.9.1
  2. Run "Repair Disk Permissions" - Nothing found
  3. Update iTunes to latest (and theoretically greatest)
  4. Run "Repair Disk Permissions" - Nothing found
  5. Update iBooks (another great piece of work)
  6. Run "Repair Disk Permissions" - Nothing found
  7. Update Remote Desktop Admin.
  8. Run "Repair Disk Permissions" - Warning: SUID file “System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent” has been modified and will not be repaired.
  9. Run Repair Disk Permissions - Same results
  10. Go to System/Library/CoreServices/RemoteManagement
  11. Rename RemoteManagement RemoteManagement-Bak
  12. Run "Repair Disk Permissions" - Nothing found (I did not reboot after renaming the directory so if the file is active (and it doesn't show up in Activity Monitor, so I'm not overly convinced that it is), why did it not give me the same error message? Now, I don't want to jump to conclusions here, but I somehow think the problem is in the RDA upgrade. I never had that error message before (starting with 10.7) but I had it after the upgrade.
    Oh, as a side note: Before I renamed that directory and made the error message go away, I booted into single user mode and ran Disk Utility and had the exact same error message. I then booted from a USB install drive and ran Disk Utility once again, same results. Now if this error is caused because the file is open, why did it not show up on the first run of "Repair Disk Permissions"before I did the updates? Why did it only show up after the update was performed? I may not be Einstein, but I know that 2+2=3.9999999 more or less...and this is a RDA update = error message.
  • 1
    Do you mean ARD instead of RDA? – IconDaemon Jan 15 '14 at 2:32
  • Based on your observations, you're probably right: The update is what makes Disk Utility warn about this. In the past, ARDAgent was a known security flaw, which Apple already patched! The warning from Disk Utility actually could be from it not recognizing the patched/updated version of ARDAgent. Please note that Apple patched ARDAgent in 2008. Judging from Apple's Official KB Article, they say the warning is safe to ignore, so it's probably the case. – TrinitronX Jan 30 '15 at 0:57
  • I've heard some suggest to fix the problem by installing ARDAgent from a fresh OS X install or install media. Do be forewarned that this solution does make the warning go away, however... if you are installing an old enough version of ARDAgent, you may be re-introducing a security flaw onto your system! – TrinitronX Jan 30 '15 at 0:59
  • Since you mention that you're using OS X 10.9.1 (likely from 2013 at earliest), I'd hope this probably isn't the case and that the baseimage comes with a more-secure version than from 2008. However, if they had patched it again it could be that they fixed another hole. – TrinitronX Jan 30 '15 at 0:59
-2

Note that i made a wrong action by globally changing permissions in the var folder. After reinstalling system, still had problems to open dmg files The DiskUtility announced the following issues :

Permissions differ on "private/var/db/ConfigurationProfiles"; should be drwxr-xr-x ; they are drwsr-s--T 
Warning: SUID file "private/var/db/ConfigurationProfiles" has been modified and will not be repaired
Permissions differ on "private/var/db/SystemPolicy"; should be -rw-r--r-- ; they are -rwsr-s--T 
Warning: SUID file "private/var/db/SystemPolicy" has been modified and will not be repaired
Permissions differ on "private/var/db/launchd.db/com.apple.launchd"; should be drwxr-xr-x ; they are drwsr-sr-t 
Warning: SUID file "private/var/db/launchd.db/com.apple.launchd" has been modified and will not be repaired
Permissions differ on "private/var/db/locationd"; should be drwxr-x--- ; they are drwsr-s--T 
Warning: SUID file "private/var/db/locationd" has been modified and will not be repaired
Permissions differ on "private/var/yp/binding"; should be drwxr-xr-x ; they are drwsr-s--T 
Warning: SUID file "private/var/yp/binding" has been modified and will not be repaired

After carefully reset the permissions by hand as DiskUtility would not do it by itself (why ? ), my problem was solved.

So i don't agree on what is written everywhere : those messages are important, and if you got bad permissions somewhere, you must correct them..

  • 1
    Welcome to Ask Different! This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post once you have sufficient reputation. If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. – Tetsujin Jul 4 '15 at 5:19
  • I'm sorry, but this give an answer to the question : i needed to modify all permissions by hand in order to have my system work correctly... So my answer is "Yes : this will cause you problems, if you don't manage the permissions issues notified by DiskUtility". At lease in my case, i had to manage them... – Cédric NICOLAS Jul 10 '15 at 12:38
  • @CédricNICOLAS, do you want to keep this answer here? – D A Vincent May 20 '16 at 4:09
  • I believe it can be useful to users, i mean in my own experience if i didn't reset correctly the bad permissions, i was not able to install anything with .dmg files on my machine...As the question was "Will this cause problems?", i am answering "Yes" to the question, so i don't see why i am not answering the question indeed ;-) – Cédric NICOLAS May 23 '16 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .