22

The initial problem

I have been encountering a sporadic problem where my Mac seems to "forget" where my home directory is.

The first clue (because this is something I do very frequently) is always that Google Chrome can't open a new tab. I get the "oh snap" error screen. This leads me to quit Chrome and restart it, which in turn leads to this error dialog, after which Chrome does not start:

Screenshot of dialog: "Google Chrome cannot read and write to its data directory: /var/empty/Library/Application Support/Google/Chrome"

Other symptoms

Many other things that require knowledge of the home directory also fail:

  • When I open some Apple apps (e.g. Preview, Notes, Messages), I get prompted with a dialog that says it needs to repair my home directory and requires me to authenticate. Entering my password here causes /var/empty/Library's owner to be changed to me (which is bad in the long term, but allows some things to begin working).
    • Screenshot of dialog: "macOS needs to repair your Library to run applications."
  • Safari simply doesn't open when clicked -- it appears briefly in the dock and then disappears, with no Crash Report dialog (although I can't say whether the system in this state is aware of my preference to see those dialogs).
  • Even after "repairing my Library", many apps cannot open:
    • Preview: a Finder dialog appears: The application "Preview" can't be opened.
    • Chrome: same error dialog as before, pictured above
    • Notes: the dock icon appears and then disappears.
  • After repairing my Library, some apps that couldn't open before now can, and many of these have forgotten my settings:
    • Safari (which I'm using now to write this question while I research)
    • BBEdit
    • Pixelmator
    • Notes
  • Some apps appear to be unaffected regardless of the Library permissions:
    • Console
    • System Preferences
    • Keychain Access
  • I can't take screenshots unless I use Grab or hold Control to write the screenshot to the clipboard (because it doesn't have write access to /var/empty/Desktop, which is correctly owned by root).
  • In Open and Save dialogs, it doesn't show my home directory in the sidebar, nor any of the common destinations within (Desktop, Documents, etc).
  • When the screen saver activates, the system default (Flurry) appears instead of my usual (Classic pointed at a directory of photos I've selected).
  • Terminal uses default settings for color/font/etc instead of my customized settings.

Still other things appear to be working fine:

  • Time Machine
  • Spotlight
  • Hot Corners

This has happened three times so far since upgrading my work machine to High Sierra a couple days after it was released.

The research

Research seems to indicate that macOS doesn't think my home directory is /var/empty, but rather that it doesn't know that I have a home directory, and there's some fallback logic somewhere that causes the system to use /var/empty for any user who doesn't have a home directory. (Source: Is it possible to create a user without a home directory?)

Further research indicates that /var/empty exists as a "security jail" for users who shouldn't have access to anything (which is why it's bad to change permissions or symlink it elsewhere). (Source: https://serverfault.com/questions/116632/what-is-var-empty-and-why-is-this-directory-used-by-sshd)

Based on past occurrences, rebooting fixes the problem (until the next time it happens). Once I've submitted this question, I'm going to try disconnecting/reconnecting my network cable and logging out to see if either of those help; I'll come back and edit this paragraph accordingly. Update: I disconnected and reconnected my network cable, then restarted Finder. Chrome works again, and all other symptoms appear to have been resolved as well! This certainly reduces the pain when this issue occurs, but I would still very much like to understand and prevent the root cause.

Nothing I can see from Terminal seems to exhibit the problem:

Last login: Mon Nov 13 13:21:18 on ttys000
jrobb@oke-jrobb-mb: ~ % pwd
/Users/jrobb
jrobb@oke-jrobb-mb: ~ % cd /var/empty
jrobb@oke-jrobb-mb: /var/empty % ls -la
total 24
drwxr-xr-x   8 jrobb  staff   256B Oct 20 16:32 ./
drwxr-xr-x  27 root   wheel   864B Oct 20 14:49 ../
-rw-r--r--@  1 root   staff    10K Oct 20 16:32 .DS_Store
drwx------   2 root   staff    64B Oct 14 05:52 .ssh/
drwx------   4 root   staff   128B Oct  9 13:22 Desktop/
drwx------   3 root   staff    96B Sep 25 15:46 Documents/
drwx------   3 root   staff    96B Sep 25 15:46 Downloads/
drwx------+ 28 root   staff   896B Nov 13 13:37 Library/
jrobb@oke-jrobb-mb: /var/empty % whoami
jrobb
jrobb@oke-jrobb-mb: /var/empty % echo $HOME
/Users/jrobb
jrobb@oke-jrobb-mb: /var/empty % 

High Sierra's integrated logging makes Console.app a nightmare to peruse, but I've nonetheless spent a large amount of time looking for relevant messages. I found several that seem to be errors caused by the problem, but none that appear to be the problem. I suspect this is caused by the fact that you can't scroll the endless stream of all messages from all subsystems back to earlier than whenever you opened Console, and there is also no apparent way to search more than one file at a time, unless you want to search the aforementioned forward-only stream. I didn't have Console running when things went south, so I guess I'm out of luck? (I'd very much appreciate any help/advice here.)

I've seen a number of other cases where people have the same problem, going back as far as 2014 (10.9 Mavericks). Here are some links to other people experiencing the same or related problems, for which no satisfactory solution presents itself:

It appears that, for those that have "solutions," they are really band-aids that expose significant security holes:

  • symlink /var/empty to the correct home directory
  • chown _user_ /var/empty
  • and so on

The context

I'm using a Late 2013 iMac (Core i7 3.9GHz, 32GB RAM, 1TB SSD) running High Sierra (always the latest patched version; this began with 10.13.0 and is now affecting 10.13.1). It's a Jamf-managed device, and I authenticate to an Active Directory domain. My profile in the Users and Groups prefpane is labeled "Admin, Managed, Mobile".

We began using Jamf where I work right after I upgraded to High Sierra, so this could be a Jamf problem or a High Sierra problem (or, really, anything else).

There are numerous other Mac users, numerous other High Sierra users and numerous other Jamf users; to my knowledge, no other users are experiencing this problem. I am the only iMac user -- all other Macs here are laptops. (I struggle to imagine that my iMac is the problem -- just being thorough.)

This problem starts happening in the middle of a user session. Everything's fine, until suddenly it's not. As such, I don't think it has anything to do with login or Active Directory.

What I'm looking for

I'm looking for an answer which prevents macOS from getting into this state in the first place, and hopefully explains when and how it happens.

  • 1
    Thanks for the details regarding your environment, it makes it easier to understand the complexity here. – nohillside Nov 13 '17 at 19:48
  • Having said that: Did you verify that "everything" looks good at the Jamf side of things (i.e. compared your profile with that of another user)? What happens if another user (with a jamf profile) uses your iMac for some time? – nohillside Nov 13 '17 at 19:49
  • @patrix I will investigate further and edit as more detail becomes available on the Jamf side. I don't have access to our Jamf admin stuff and have to work through our sysadmin, who is new to Jamf and less of a Mac expert than I am. – JakeRobb Nov 13 '17 at 19:58
  • I just saw with our sysadmin for a few minutes and we looked over my Jamf profile. Nothing jumps out, but he's going to do some further research. – JakeRobb Nov 13 '17 at 20:25
  • 3
    Interestingly, disconnect/reconnect of my Ethernet cable plus a Finder restart has eliminated all symptoms and restored normal behavior. Weird! I've updated the question to reflect that. – JakeRobb Nov 13 '17 at 20:25
5

Open a bug with Apple on this. I have an open case, but they need to hear from more people on this. I see this on rare occasion, but only on my computer connected to Active Directory with my managed, mobile account (so my guess is it's just another of the many AD bugs in 10.13 that remain unfixed.)

I find that if I generate a sysdiagnose (to update my case), the problem goes away while the sysdiagnose is generating, too.

But, it's nothing I can force to happen, so I don't know what causes this.

  • 1
    Thanks! I've never filed a bug with Apple; not sure how to do it. Do I need to register as a developer? (I'm a dev who uses a Mac, but I make webapps.) – JakeRobb Dec 21 '17 at 16:15
  • 1
    I should google things before asking. :) developer.apple.com/bug-reporting Given that I don't have steps to reproduce, I'm not hopeful. But I'll submit something. – JakeRobb Dec 21 '17 at 16:17
  • 2
    Yeah, please submit something even if you can't reproduce it. I've been told numerous times that it's the number of bug reports about an issue that gets attention. I can open a bug and say "8000 Macs here have this problem", but that does not get the same attention as 8000 bug reports on the same issue. – maser Dec 22 '17 at 16:41
3

The long term answer is to not bind any Mac to AD and get a tool to loosely couple the user permissions and leverage kerberos to authenticate.

  • Apple Enterprise Connect - you pay for a professional services engagement to discover / configure and document the solution for your environment. https://www.apple.com/support/professional/
  • NoMAD and/or NoMAD Pro - https://nomad.menu - open source tools with paid support and consulting options as well from the vendor.

Binding is painful, and that pain grows the longer you let it fester and constrict. Your question is solid and I hope someone has a quick fix for you, but I've seen several organizations walk (or run) away from the bind once they pilot NoMAD and commit to AEC or NoMAD at scale. Having JAMF Pro in place will really help you deploy either tool.

  • Do you have any concrete reason to believe that the problem is linked to AD binding? I have heard many horror stories, but I'm disinclined to just accept that as the cause without proof. – JakeRobb Dec 27 '17 at 21:45
  • Only my experience managing many macs @JakeRobb - You might just have a one off corruption and need to wipe the OS - make your user accounts again and then restore your data. Hard to know without hands on the machine. – bmike Dec 28 '17 at 15:41
3

I found the following to "correct" the issue.

  1. Open System Preferences > Users & Groups
  2. Unlock the pane
  3. Right click on the effected user account > Advanced Options...
  4. Next to Home directory: click Choose...
  5. Click Open
  6. Click OK

This seems to have re-written the home directory path and allowed functionality to return.

In my case, logging out and back in resulted in a black screen with a cursor - though after a soft reboot able to log back in, long progress bar then everything was back to normal.

Hope this helps! Good luck!

  • 1
    This is useful, but does not answer the actual question I posed. Thanks, though! :) – JakeRobb Jan 18 '18 at 19:35
2

Are you guys mapping UID's to different attributes? In the past when I've seen this in OS X / MacOS it's because we mapped UID's to a universal ID internally (it was the same across UNIX and AD) and it barfed when trying to do that translation. Users lost permissions to their home directories and showed the symptoms you're seeing in Finder, etc.

In Directory Utility you can see "Map UID to attribute:" in the Mappings tab under Active Directory.

  • None of the three mappings checkboxes are checked on my system. – JakeRobb Dec 21 '17 at 18:57
1

This happens to my work computer (AD attached) whenever Chrome needs to update and I quit and restart the application. I'm guessing that it's some kind of issue with the updater (which is basically silent) trying to rewrite to the user directory when uids and such are not locally managed.

What worked for me was simply to reset all internet connections; e.g., unplug ethernet and turned off WiFi

  • Interesting theory! FWIW, this hasn't happened to me again since I posted this question almost a year ago, and I've certainly updated Chrome more than once in that period. – JakeRobb Sep 27 '18 at 18:49
0

FWIW, this isn't a Chrome issue. When this issue occurs, it affects other apps as well. Not to suggest this as a fix, but if you follow the Jamf Nation URL, you'll see my post at the bottom of the thread. We manage a rather large environment of Macs. We have a policy to un-bind a Mac from Active Directory, and another to bind a Mac to Active Directory. For some strange reason, unbinding then rebinding seems to "fix" the problem. I put "fix" in quotes because it is nothing more than a hail mary that probably has nothing to do with the root issue at all. ¯\_(ツ)_/¯

  • Note that my question doesn't present it as a Chrome issue. Chrome has just been the first app to fall victim to the problem the small handful of times it has happened to me. But thanks for the extra context! – JakeRobb Mar 15 '18 at 13:49
  • Understood, my apologies my post implied that. Opening a ticket with Apple Enterprise Support today. – donmontalvo Mar 30 '18 at 14:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .