82

I'm using Homebrew to manage package installs on Lion (Lion Server actually but this shouldn't matter).

Homebrew was installed under one user. Now a different user would like to add a package and Homebrew isn't happy:

$ brew update
fatal: Unable to create '/usr/local/.git/index.lock': Permission denied
Error: Failure while executing: git checkout -q master

Is this considered bad? I thought one of the advantages of using /usr/local/ for your installs was that you don't need sudo. But clearly we do.

All users who would need to modify Homebrew are members of admin group. So, I could chmod -R g+w /usr/local/ but afraid this will bork something or create security issues?!?

Advice?

$ ls -al /usr/local/.git/
total 432
drwxr-xr-x  14 ladmin  admin     476 Feb 24 11:48 .
drwxrwxr-x  14 root    admin     476 Feb  9 15:27 ..
-rw-r--r--   1 ladmin  admin      94 Feb 24 11:48 FETCH_HEAD
-rw-r--r--   1 ladmin  admin      23 Feb 24 11:48 HEAD
-rw-r--r--   1 ladmin  admin      41 Feb  9 15:28 ORIG_HEAD
drwxr-xr-x   2 ladmin  admin      68 Feb  9 15:27 branches
-rw-r--r--   1 ladmin  admin     218 Feb  9 15:27 config
-rw-r--r--   1 ladmin  admin      73 Feb  9 15:27 description
drwxr-xr-x  12 ladmin  admin     408 Feb  9 15:27 hooks
-rw-r--r--   1 ladmin  admin  200272 Feb 24 11:48 index
drwxr-xr-x   3 ladmin  admin     102 Feb  9 15:27 info
drwxr-xr-x   4 ladmin  admin     136 Feb  9 15:27 logs
drwxr-xr-x   4 ladmin  admin     136 Feb  9 15:27 objects
drwxr-xr-x   5 ladmin  admin     170 Feb  9 15:27 refs

5 Answers 5

103

Is this considered bad? I thought one of the advantages of using /usr/local/ for your installs was that you don't need sudo. But clearly we do.

Homebrew, by default, sets itself up for single-user access to /usr/local. So you need to open up the permissions on the directory tree for it to be administered by more than one person.

People don't need to run sudo here to administer homebrew. You just need to change some permissions. Since you already have:

All users who would need to modify Homebrew are members of admin group.

You need to do two more things:

  1. Make sure everything under /usr/local belongs to the group admin; and
  2. Make sure anyone from the group admin can write to anything under /usr/local.

In this case the changes to make are:

chgrp -R admin /usr/local
chmod -R g+w /usr/local
chgrp -R admin /Library/Caches/Homebrew
chmod -R g+w /Library/Caches/Homebrew

And any user from the admin group should be able to manage the homebrew installation on the machine. If you need to add a user to the admin group this can be accomplished like this:

 dseditgroup -o edit -a <username> -t user admin

(that user will need to login again to have the privileges granted).

For sanity on the machine, you may want to consider creating your own fork of Homebrew and have your local homebrew git repository point to the local fork. That lets you customize Homebrew for your environment and control the versions of packages that people are able to install with the brew command. With multiple people doing installs you could run in to version issues or dependency issues.

6
  • 1
    I have the same problem and have changed group ownership and group permissions as suggested. brew doctor still complains that e.g. /usr/local/include is not writable even though I manually can verify that I can write to a file here (e.g. using echo "hello" > /usr/local/include/testfile). I am member of the admin group. Any ideas for debugging?
    – mgd
    Jun 22, 2012 at 21:40
  • 2
    This solution worked for me, but it doesn't address Homebrew's local cache. I also suggest running: chmod -R g+w /Library/Caches/Homebrew May 8, 2013 at 15:57
  • I found a blog post on it blog.strug.de/2012/06/my-homebrew-multi-user-setup and adapted a script from that raw.githubusercontent.com/steshaw/shelly/master/bin/… Oct 11, 2015 at 23:28
  • 2
    Looks like Homebrew has now transitioned cache to current user's directory. Just saw: ==> Migrating /Library/Caches/Homebrew to /Users/bluechain.admin/Library/Caches/Homebrew... when doing an brew update. If I'm interpreting this correctly, this means we no longer need to worry about having a globally writeable cache dir for Homebrew.
    – Endareth
    Aug 23, 2017 at 0:17
  • 1
    Will new installs also have g+w persmission by default? Do I need to run these commands over and over again?
    – cubuspl42
    Nov 7, 2019 at 11:38
7

You can enable homebrew permissions for more than one user via the admin group, or via any other user group. Here is a slightly expanded recipe to configure this:

The group needs to administer the local homebrew install directory. So assign /usr/local to admin group (or your preferred group) and enable group write permissions:

chgrp -R admin /usr/local
chmod -R g+w /usr/local

The group also needs permissions for homebrew's local cache of formulae and source files at /Library/Caches/Homebrew:

chgrp -R admin /Library/Caches/Homebrew
chmod -R g+w /Library/Caches/Homebrew

If you run into further similar permissions issues while using homebrew from multiple accounts, note the offending path and consider trying the same approach.

Leif Hanack has blogged a similar solution, where he creates and configures a dedicated user group brew for the purpose.

--Update 2015-08-20

I recently used this answer again to set up a guest account with homebrew access. In order to use Cask from the second admin account I had to also run the following commands:

chgrp -R admin /opt/homebrew-cask
chmod -R g+w /opt/homebrew-cask
0
4

I was just going to comment on the accepted answer (but don't have the reputation for that yet.)

As a user of Caskroom.io, I would also recommend adding:

sudo chown -R admin /opt/homebrew-cask
sudo chmod -R g+w /opt/homebrew-cask
sudo chmod -R g+w  /Library/Caches/Homebrew/

since cask, an extremely useful extension to homebrew, puts all its files in /opt/homebrew-cask

2
  • 1
    By /opt I guess you mean /usr/local? As /opt doesn't exist on recent OS X installs, even after a homebrew install.
    – forquare
    Aug 17, 2015 at 6:50
  • In June of 2016, Homebrew-Cask (a brew extension) moved the default location for its Caskroom folder to /usr/local (or more accurately $(brew --prefix)) from /opt/homebrew-cask so this answer is now moot, but was valid when it was written. See Move default caskroom location #21603
    – zen
    Aug 19, 2016 at 14:34
1

You need to give permission to the path. run this in command line and you will be fine to go. It worked for me:

sudo chown -R $USER /usr/local

-1

I would vote for setting the group permission - and to me it seems that's just what it's there for and should not create a security problem.

  • Don't use sudo.

tl;dr Sudo is dangerous, and you installed TextMate.app without sudo anyway.

Homebrew is designed to work without using sudo. You can decide to use it but we strongly recommend not to do so. If you have used sudo and run into a bug then it is likely to be the cause. Please don’t file a bug report unless you can reproduce it after reinstalling Homebrew from scratch without using sudo.

2
  • So, your advice would be to sudo chmod -R g+w /usr/local/?
    – Meltemi
    Feb 29, 2012 at 21:03
  • Yes, but you may want to ask for a second opinion using one of these: IRC (irc://irc.freenode.net/#machomebrew) ; Mailing List ([email protected]) ; Twitter (twitter.com/machomebrew)
    – iolsmit
    Feb 29, 2012 at 22:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .