Might Have Unpermissioned Myself on Mac (resolved)

TidBITS Talk
1

I’m in a bit of a panicky mode… I was trying to access a file on my Mac from another laptop (without properly researching first) and the laptop could see the Mac and could open a couple of its folders, but other folders wouldn’t open.

I went into the Macs File Sharing details and started turning settings on kind of randomly, alas, including one for my user folder which said to ‘apply to enclosed items’. Didn’t help so I went to un-apply but only the apply option was there. Removed myself from File Sharing and turned File sharing off. Gave up on getting it to work until I read more, but tried to get back to doing things on the Mac.

Tried to update an entry in a 3rd party password app, wouldn’t save as I ‘don’t have permission’. Moved to another task, tried to open a 3rd party app, there was the shadowy animation of an app opening, but it didn’t. Moved to another task in Numbers, entered data and tried to save and… no permission to save!

So… I sort of can’t get much done on the Mac.

I’ve gotten by for many years without knowing lots of these details but now I’m in trouble. I went to the main ‘HD’ icon’s Get Info, it shows system (r/w), wheel (read only) and everyone (read only) but not me. The user account main folder has two entries for me (r/w), one for everyone (custom) and one for everyone (read only).

I unlocked the Get Info on both of those and in user folder, plus and minus don’t work, the three dots options are grayed out, so I can’t remove apparent duplicates. Tried to add myself in the main HD Get Info, no permission. Minus button not active, three dots options shows apply to enclosed items’ for system, wheel, everyone.

Restarted Mac a few times. No change.

So… I suppose troubleshooting this could get tricky, surely I’ve not included important details above for those who know this stuff, but am wondering if there is a quick-ish way to undo whatever I fouled up. For now I’ll stop using the Mac except for TBT and browsing until this gets fixed. I hope I don’t have to do something extreme like erasing and starting over…

Thanks in advance for patience and mercy.

2

What version of macOS are you running, and what Mac model do you have?

FWIW, the default permissions of “Get Info” on a macOS home directory are user (read/write), staff (read only), everyone (read only). Unfortunately, the “apply to enclosed items” option can be very troublesome.

1 Like
3

Thank you @josehill ,

26.5.2, updated Monday morning. M2 MBAir from 2022.

I should also add that I’m not even sure what keywords this falls under, in order to start online research to troubleshoot. I need to go back to my computer fundamentals so I get the terminology right.

Possibly help would found be under the keywords of ‘users, groups, permissions in unix-based computers’. That should be something to do anyway, as I’m trying to set up a mac mini as a home network file server and so far it’s not going as expected.

4

Google: macos repairing permissions.

It leads to Should you repair permissions? from October 2025, but it doesn’t look good. The article lists the deprecated methods from prior macOS versions, that you should not try since Big Sur. And apparently there is no solution anymore?

I hate to say it, but you may need to restore from a backup.

1 Like
5

Thanks @mschmitt . Those keywords should help me in the search for a solution.

One of the links found suggested changing ownership of the main HD in Get Info > Sharing & Permissions but I tried to add myself and was told I don’t have the permissions to do so.

There was an Apple support page listed in results that was about renaming the home folder and gave detailed instructions. This was not related to the issue but indicates to me that there might be an authoritive page with detailed steps somewhere on Apple.

In the bigger picture, when I get this solved (in the event of restoring or otherwise) I should find out how to set all these up ‘properly’ (‘best practices for average mac os users’) as well, to avoid future issues. I might actually start using a Standard user account instead of an Admin like I have (unadvisably) for many years…

Which makes me wonder if I could set up a new Admin account, use that to set up a Standard account, somehow transfer my System Settings and everything over to it, and delete the Admin account I’m using now. Opinions?

For now I’m afraid to log out of the account or backup or reboot or anything.

(edited with added data point: an online article explained how to list permissions in Terminal and I got the list but noted the name of the computer seems to have changed, that is, in Terminal there is username @ computer name (possibly wrong terminology) and the part after the @ changed itself to something I didn’t knowingly create…)

6

@mschmitt’s advice is solid. I’d refine the googling to macOS Tahoe repair home directory permissions. I also agree with his referral to the EclecticLight article.

The main complication from my view is from the “apply to enclosed items” step that you performed earlier. In the hidden directories where settings and preferences are stored (for example, within ~/Library), there can be thousands of files, some of which properly may have different permissions, including different access control lists (ACLs). The “apply to enclosed items” command probably clobbered those.

If you have a backup of your home directory (or system) that was taken after you updated on Monday, the simplest, most reliable step would be to make a backup copy of any important, new files you worked on since taking the backup (preferably to external media), restoring from backup, and then copying over the new files.

That said, there are sufficient reports of people using diskutil’s “resetuserpermissions” directive to get a system back in operation that I’d consider giving that a try before attempting to restore from backup. Open a terminal, determine your numeric user id by typing id -u, which will give a numeric result like 501 or 502, and then run the diskutil command via sudo as shown:
sudo diskutil resetUserPermissions / 501 , assuming 501 was the result of “id -u”. If 502 or some other number was the result, use that instead.

If you don’t want to muck around on the command line, Marcel Bresink’s excellent TinkerTool System app is a good option. An extremely detailed explanation of how it attempts to repair permissions is included in its documentation. Visit the documentation page, and click on The Pane ACL Permissions link. On the ACL Permissions page, scroll down to the instructions to “Set permissions in a user folder to defaults”. You can launch TinkerTool System in a fully functioning evaluation mode six times.

1 Like
7

Thanks @josehill . OK seems like a big goof I made!

Thanks too for the details on the Terminal commands. I had the Take Control ebooks on Terminal and File Sharing open but now Preview only appears to launch, its icon is in the Dock but no windows appear. I do generally prefer GUIs but for specific commands that are clearly what I want to do I have no issue opening a Terminal and typing.

Tinker Tool System I have also, its guide was also open in Preview, now inaccessible and the App doesn’t launch either.

One new brain wave I had is that the name of the computer (if that’s what it is, the part after @) in Terminal I now recognize as the Mac Mini I was starting to set up, which is currently shut down. Perhaps I gave it ownership of the MBAir somehow, as the username and User might very well be the same.

Is there a way to undo that, if that’s what happened? ie, connect the Mini to the Air, with File Sharing on, and from the Mini change the ownership on the Air in the Get Info Permissions section?

8

Exactly how are you proposing to connect the two Macs? Sometimes it sounds like you are connecting via file sharing, sometimes it sounds like by ssh in Terminal.app, and sometimes it sounds like you are connecting via screen sharing. I’m particularly surprised by the statement that you are seeing the name of the mini in terminal, even though it is now shut down. Normally, if you logged in remotely via the terminal, and the remote host shut down, you’d get a warning that the system was shutting down and was no longer available.

All things being equal, I would only try to work directly on the affected machine. Don’t complicate things by involving a second machine if you can avoid it.

If you are doing system setups or major configuration changes, especially anything involving permissions or command-lines, log everything you do. I go as far as keeping an actual paper notebook and writing things out by hand for important changes. It seems like overkill, but it can be a life saver when things don’t go according to plan.

1 Like
9

I believe in simple solutions that work. Even if they may seem “simplistic” to others.

Here’s what I suggest you do:
Get a USB flashdrive.
Copy the file in question to the flashdrive.
Now bring the flashdrive to the Mac you want to open the file on.

Connect the flashdrive and let its icon mount on the dekstop.
Don’t open it yet.
Instead, bring up the “get info” box for the flashdrive (you can type “command-i”).

At the bottom of get info, click the lock icon and enter your password.
Now put a checkmark into “ignore ownership on this volume” (sharing and permissions).
Close get info.

Next, copy the file in question from the flashdrive to your Mac.
Try to open it now.

WHY I suggested this:
When you use the “ignore ownership” workaround, many files (most?) you copy from the flashdrive to your Mac will now “fall under the ownership” of the account you’re using (regardless of how they were first created).

This is a very simple operation which will take about 2 minutes.
Try it and get back…

2 Likes
10

Good Question, thanks @josehill . I just thought, as it appeared to me in Terminal on the Air, as a newbie at CLIs, that since the name of the Mini was shown, Terminal was thinking that the Mini is the ‘owner’ or ‘admin’ of the Air. I was thinking of connecting the two by a cable, turning on File Sharing, and then from the Mini trying to readjust the Sharing & Permissions in Get Infos of the Air. I’ve heard of ssh but not tried or read about it yet.

Excellent idea, I often do that and should have on this. Sometimes I’m too focused on the goal and impatient for no good reason. In this case I do recall that the Air started acting odd after I did the ‘enclosed items’ step, possibly for the wrong user.

I’ve used Macs mostly as independent devices all these decades, need to relearn the basics of networking, file sharing etc and come up with some naming convention such that I don’t confuse the accounts.

(edit: ok duh, file sharing is file sharing, not remote control of another mac, so that didn’t work)

11

I wanted to try that now, @j.albert , but the Air has stopped accepting letter inputs from built in, wired or bluetooth keyboards, so I can’t even unlock the thing to do that.

:man_facepalming:

(edited: shut down with power button, waited, restarted and now Air accepts input and am logged in. Transferred files to USB stick and plugged into the other laptop, which shows the stick’s ownership as the other laptop, with read and write permissions. Maybe originally I formatted it with that machine)

12

@mschmitt , if it comes to this, and I restore from a CCC (non bootable, data only) backup, will the restored data have the old permissions do you know, or will they be migrated in under the new system’s settings?

13

OK, I just ran the reset Home to defaults and am getting ready to check if things work normally now in that account.

My concern is that the main Macintosh HD might have wrong permissions on it. How can I check/fix that, or would that be solved by using Recovery, migrate from CCC data backup, adding the files modified since last backup?

Finally, would these steps bring in the old permissions on migrated data or adopt the fresh ones?

14

Bombich is very responsive to inquiries, sometimes going to great length to spell things out, so you might try them regarding the permissions issue.

15

@tidbits41 right on. I just sent the request, thanks for the reminder.

16

I use SuperDuper!, not CCC, but it should work the same: it restores the data volume to be identical to what it was when it was backed up. Including all file attributes, such as permissions and access control lists. Which means, it would be the old permissions.

If you have created a new user with a new UID that could be a problem. Maybe CCC can migrate from one UID to another.

17

Well I seem to be on the road to recovery from this. Thank You Big Time to all who offered help and those who read and thought about it!

The source of my goof may have been misidentifying the User and getting confused about multiples of same names in Users & Groups and File Sharing, then rashly changing settings while uninformed.

As I am just embarking on the Home Network adventure, would appreciate any feedback on following plans for MacBook Air (everyday usage), Mac Mini (file server) and a Linux (Ubuntu) laptop (everyday usage) to happily file and screen share, wired or wifi. My experiences with File and Screen Sharing to date have been hit or miss, very unsatisfying.

  • assign unique Full Name, Account Name, and User name to each device so they are identifiable in File Sharing/Users & Groups settings
  • add an Administrator account and change my everyday accounts to Standard
  • read and follow guidance in Take Control of File Sharing and related ebooks
  • learn the terminology of all this somewhere
  • never again select ‘apply to enclosed items’ ;-)

Finally, a frustration I have with multiple User Accounts is that each one has its own System Settings and am wondering if there is a way to copy them from one account to another or if I have to plonk through all the levels making adjustments.

18

Thanks @mschmitt , I recieved a quick reply from Bombich saying they expected the migrated files would acquire the permissions and attributes of the fresh system. Recovery is reinstalling Tahoe now, estimates several more hours to go, then the migration.

I’ll post a follow up when it’s done.

19

It doesn’t matter where “previous ownership” is.
Use the “ignore ownership on this volume” workarouond to… well… work AROUND that.
Did you give this trick a try after restarting?

20

Maybe I misunderstood, I went through startup in Recovery and reinstalled macOS Tahoe over a couple of hours and when it finished I was back to my usual assortment of open windows with no need to restore from my CCC backup, so I’m not confident I did it right.

Were you (and others) suggesting erasing then restoring from backup?