29

Today I ran brew update and after migrating the repository, it reported that it no longer needed ownership of /usr/local:

$ brew update
Updated Homebrew from 5371359 to 13f08a2.
...
==> Migrating HOMEBREW_REPOSITORY (please wait)...
==> Migrated HOMEBREW_REPOSITORY to /usr/local/Homebrew!
Homebrew no longer needs to have ownership of /usr/local. If you wish you can
return /usr/local to its default ownership with:
  sudo chown root:wheel /usr/local

This change seems a little dubious. How does brew accomplish this new behavior, apparently bypassing security controls?

Improve this question
5
  • What security controls is it bypassing? The /usr/local is not included in SIP. See About System Integrity Protection on your Mac under "Paths and applications that third-party apps and installers can write to include:" /usr/local is listed.
    – user3439894
    Sep 19, 2016 at 13:56
  • 4
    That said, not being a user of Homebrew, as I compile directly from source code the utilities I want that are not included n OS X, nonetheless I'd imaging that Homebrew has be rewritten as needed/necessary to act normally like other apps have done in the past. IMO Homebrew should have been written from the get go not to have to usurp root ownership to begin with!
    – user3439894
    Sep 19, 2016 at 13:56
  • I mean, if /usr/local and its children are owned by root:admin or root:wheel and aren't group writeable, then I don't have access to write to those directories (and neither would homebrew, presumably), but if that's the case, how can Homebrew manage installing and removing applications from those locations?
    – Jason R. Coombs
    Sep 19, 2016 at 17:27
  • 3
    I'm just noticing that the message only references /usr/local and not its decendants. And looking at what a brand new homebrew install does, it does set all of the subdirs to be owned by $USER and group writeable.
    – Jason R. Coombs
    Sep 19, 2016 at 17:59
  • It's a security vulnerability to change /usr/local ownership to the user! To not have it have ownership of that is better, not worse. It's not dubious at all to not have ownership of it; but it's dubious that it does need it. Sophos actually writes to that directory too (correctly). Let that sink in.
    – Pryftan
    Dec 7, 2021 at 16:29

2 Answers 2

Reset to default
20

According to this ruby script: update-report.rb, they've just moved stuff to /usr/local/Homebrew, which is still owned by you.

Improve this answer
2
  • 2
    Doesn't /usr/local need to be writeable by $USER for the creation of /usr/local/Homebrew to take place? What about other directories, like /usr/local/Cellar or /usr/local/opt? Doesn't homebrew still need (non-sudo) access to write to those directories? How can it do that if the dirs are owned by root and not group-writeable?
    – Jason R. Coombs
    Sep 19, 2016 at 17:34
  • 1
    On first install, they still use sudo to create homebrew repository, see install. The script in my answer for updating, at that point you still owns /usr/local which you chown-ed in old version.
    – albb
    Sep 20, 2016 at 0:55
7

We now create all the root directories of /usr/local that you need and check ownership on them rather than requiring it on /usr/local itself.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .