28

Today I ran brew update and after migrating the repository, it reported that it no longer needed ownership of /usr/local:

$ brew update
Updated Homebrew from 5371359 to 13f08a2.
...
==> Migrating HOMEBREW_REPOSITORY (please wait)...
==> Migrated HOMEBREW_REPOSITORY to /usr/local/Homebrew!
Homebrew no longer needs to have ownership of /usr/local. If you wish you can
return /usr/local to its default ownership with:
  sudo chown root:wheel /usr/local

This change seems a little dubious. How does brew accomplish this new behavior, apparently bypassing security controls?

Improve this question
4
  • What security controls is it bypassing? The /usr/local is not included in SIP. See About System Integrity Protection on your Mac under "Paths and applications that third-party apps and installers can write to include:" /usr/local is listed. – user3439894 Sep 19 '16 at 13:56
  • 3
    That said, not being a user of Homebrew, as I compile directly from source code the utilities I want that are not included n OS X, nonetheless I'd imaging that Homebrew has be rewritten as needed/necessary to act normally like other apps have done in the past. IMO Homebrew should have been written from the get go not to have to usurp root ownership to begin with! – user3439894 Sep 19 '16 at 13:56
  • I mean, if /usr/local and its children are owned by root:admin or root:wheel and aren't group writeable, then I don't have access to write to those directories (and neither would homebrew, presumably), but if that's the case, how can Homebrew manage installing and removing applications from those locations? – Jason R. Coombs Sep 19 '16 at 17:27
  • 3
    I'm just noticing that the message only references /usr/local and not its decendants. And looking at what a brand new homebrew install does, it does set all of the subdirs to be owned by $USER and group writeable. – Jason R. Coombs Sep 19 '16 at 17:59
20

According to this ruby script: update-report.rb, they've just moved stuff to /usr/local/Homebrew, which is still owned by you.

Improve this answer
2
  • 2
    Doesn't /usr/local need to be writeable by $USER for the creation of /usr/local/Homebrew to take place? What about other directories, like /usr/local/Cellar or /usr/local/opt? Doesn't homebrew still need (non-sudo) access to write to those directories? How can it do that if the dirs are owned by root and not group-writeable? – Jason R. Coombs Sep 19 '16 at 17:34
  • 1
    On first install, they still use sudo to create homebrew repository, see install. The script in my answer for updating, at that point you still owns /usr/local which you chown-ed in old version. – albb Sep 20 '16 at 0:55
7

We now create all the root directories of /usr/local that you need and check ownership on them rather than requiring it on /usr/local itself.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .