3

I'm totally stumped on this one — a Macbook Air, 10.9.2. As far as I can tell, I should be able to write to my Library directory. Everything I can see suggests I should be able to:

[njvack@zot Library]$ sw_vers | grep ProductVersion
ProductVersion: 10.9.2
[njvack@zot Library]$ id -a
uid=503(njvack) gid=20(staff) groups=20(staff),403(com.apple.sharepoint.group.3),12(everyone),61(localaccounts),402(com.apple.sharepoint.group.2),100(_lpoperator),401(com.apple.sharepoint.group.1)
[njvack@zot Library]$ pwd
/Users/njvack/Library
[njvack@zot Library]$ ls -ld@ .
drwx------@ 58 njvack  staff  1972 Apr 14 16:06 .
    com.apple.metadata:_kTimeMachineNewestSnapshot    50 
    com.apple.metadata:_kTimeMachineOldestSnapshot    50 
[njvack@zot Library]$ touch foo
touch: foo: Permission denied

And then for some reason I can work in ~/Library/iMovie, even though the permissions should be effectively identical:

njvack@zot Library]$ cd iMovie/
[njvack@zot iMovie]$ pwd
/Users/njvack/Library/iMovie
[njvack@zot iMovie]$ ls -ld@ .
drwx------+ 4 njvack  staff  136 Apr 16 08:41 .
[njvack@zot iMovie]$ touch foo

What else could be causing this? What can I check? FWIW, Disk Utility's Check Permissions doesn't complain about anything.

EDIT: As suggested, here's the ACL entries:

[njvack@zot Library]$ ls -led .
drwx------@ 58 njvack  staff  1972 Apr 14 16:06 .
 0: group:everyone deny add_file,delete,add_subdirectory,delete_child,writeattr,writeextattr,chown

... and as ACLs override UNIX permissions, removing the ACLs was the trick:

[njvack@zot Library]$ pwd
/Users/njvack/Library
[njvack@zot Library]$ chmod -RN .
[njvack@zot Library]$ touch foo

How did I get such screwy ACLs on my ~/Library? I have no idea.

  • Does sudo works ? – Thomas Ayoub Apr 16 '14 at 15:59
  • What does ls -ld@eO on it show? (The -e and -O show access control entries and file flags, respectively.) – Gordon Davisson Apr 16 '14 at 16:07
  • @GordonDavisson It was ACL entries, thanks! If you add an answer (chmod -RN ~/Library recursively removes 'em) I'll accept it :) – Nate Apr 17 '14 at 13:53
0

To see the rest of the permissions (ACLs and file flags), add -e and -O to the ls command. I habitually use ls -leO@ as a "tell me everything" version of ls.

In this case, the problem was a "deny" access control entry, which will override the regular POSIX permissions. I have no idea how that might've gotten added to your ~/Library folder, but you can remove it with chmod -N ~/Library.

It's a bit late, but I would not have recommended using -R (apply recursively to all contents) on that chmod command, since there are some items inside ~/Library that are supposed to have ACLs (mostly to prevent accidental renaming or deletion of important items). But I don't think removing everything will to any actual harm, and if you're worried about other spurious ACLs, the recursive reset makes sense.

  • A bunch of the subdirectories had crazy ACLs applied to them as well, so it was either gonna be 'debug the magic errors forever' (for instance, this caused iTunes to tell me my iPhone backup was corrupt, except there were no backups at all) or 'screw the ACLs' and I chose the latter :) – Nate Apr 17 '14 at 16:13
  • In that case, yeah, recursive reset's the best option. I looked around a little, and I don't see any of the "standard" ACLs that actually look important. – Gordon Davisson Apr 17 '14 at 16:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .