Let's assume if SIP is disabled and permissions get either maliciously or intentionally, but misguidedly changed. How to restore these permissions to their factory settings?

What is the Current Best Practice to Remedy Such a Situation, Once it has Occured?

It doesn't really matter exactly how a Sierra installation might end up with less than ideal, 'broken' or 'breaking', or simply altered permissions on its system files or directories.

The question from the title is in slightly longer form:

How do you reset the file system permissions in Sierra that are relevant to the systems operation to their default settings?

  • 3
    Best practice is as has been under osx is find which process messed up the permissions and fix that then undo what it did. Repair permissions has never been best practice – user151019 Aug 25 '17 at 21:59
  • 1
    That doesn't address the multi-boot scenario. It could take quite a while to notice that the unprotected volume had its permissions, and only them, messed up. "Reinstall macOS", is then typically said in Apple related forums, even when that would be an overkill 'solution' for this situation. And easily fixed if one had this factory set of permissions to re-apply to the OS files. – LаngLаngС Aug 26 '17 at 8:33
  • 2
    I'm voting to close this question as off-topic because Public complaints and specific questions about what Apple [did|does|thinks|might do] are not helpful in a Q&A setting since they lack a practical problem to be solved as described in the Help Center topic What topics can I ask about here? – Allan Aug 27 '17 at 12:41
  • 1
    It is not a complaint, it's a question starting with an analysis for context. But nice how you read such things. How is this question "Asking how/why Apple does <some thing XYZ>" again? –– This question does not ask why Apple dumbs down XYZ/the user experience. They did what they did, thereby presenting a practical – potential – problem. To spell it out again: The practical problem to be solved is twofold: 1. how to either restore or circumvent/compensate lost functionality or 2. How to restore the file permissions of the system to "factory settings" in Sierra. –– – LаngLаngС Aug 27 '17 at 13:03
  • 2
    @bmike, Very nice edit, you got rid of all the unnecessary noise and it's now a practical question! – user3439894 Aug 27 '17 at 21:52

This is really quite easy.

  1. Make a back up (Just in case, etc..)
  2. Download and install Mac OS on to the volume using a recovery HD / Internet Recovery or booted from a known good OS external (hold option key when booting)
  3. Clean up user account permissions once the system is fixed.

Since all installs are archive and install, the operation to install Sierra drops a proper, SIP protected, proper permissions system and then calls Apple's migration scripts which should migrate all apps and configurations from the old system with proper permissions in place.

Then you can add a new admin user and remove each old user one by one - leaving their home folders alone. When you rename the old user home as a new short name - when you add those users in - that will fix the permissions on a per user basis.

  • That is probably one way to do it. But it is not exactly the efficiency I was hoping to get. Repairing permissions in 10.10: ~5mins, this procedure will take considerably longer. – LаngLаngС Aug 27 '17 at 22:01
  • If you keep SIP in place, things go much faster, @LangLangC - also with Caching Server running on all High Sierra - a recovery boot is cached as are the App Store installers - downloads after the first are at local hard drive speed and not internet speed. We almost don't need bootable installers anymore now that we can cache the installers easily. – bmike Oct 2 '17 at 16:51
  • Please elaborate on 'SIP=*things* much faster' / I do not run High Sierra on production systems. But surely you mean: "at local network speed and not internet speed" (+ saving traffic)? – LаngLаngС Oct 2 '17 at 18:06
  • I was echoing your 5 minute repair is more viable if you keep SIP enabled. – bmike Oct 2 '17 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .