Today I ran brew update
and after migrating the repository, it reported that it no longer needed ownership of /usr/local
:
$ brew update
Updated Homebrew from 5371359 to 13f08a2.
...
==> Migrating HOMEBREW_REPOSITORY (please wait)...
==> Migrated HOMEBREW_REPOSITORY to /usr/local/Homebrew!
Homebrew no longer needs to have ownership of /usr/local. If you wish you can
return /usr/local to its default ownership with:
sudo chown root:wheel /usr/local
This change seems a little dubious. How does brew accomplish this new behavior, apparently bypassing security controls?
/usr/local
is not included in SIP. See About System Integrity Protection on your Mac under "Paths and applications that third-party apps and installers can write to include:"/usr/local
is listed./usr/local
and its children are owned byroot:admin
orroot:wheel
and aren't group writeable, then I don't have access to write to those directories (and neither would homebrew, presumably), but if that's the case, how can Homebrew manage installing and removing applications from those locations?/usr/local
and not its decendants. And looking at what a brand new homebrew install does, it does set all of the subdirs to be owned by $USER and group writeable./usr/local
ownership to the user! To not have it have ownership of that is better, not worse. It's not dubious at all to not have ownership of it; but it's dubious that it does need it. Sophos actually writes to that directory too (correctly). Let that sink in.