One of the common routines taken after installing software, upgrading the system, or otherwise heavily modifying an OS X installation, is to run a permissions fix on the boot drive. This is generally done with Disk Utility or Terminal commands. However, if you have installed El Capitan, you will notice permissions fix routines are now missing.
Since permissions determine if a file can be read or edited, problems with them can cause programs to hang or otherwise not work. OS X stores default permissions in receipt files, and when a permissions fix is performed, file permissions are compared against receipts and are adjusted accordingly.
As a result of this change, to fix permissions in El Capitan, you simply need to check the status of SIP and ensure it is enabled, which can be done by running the following command in the Terminal:
csrutil status
If System Integrity Protection is enabled (which it should be in most cases), then the command output will indicate so. Being enabled will in turn indicate that permissions have been checked and maintained.
Running this command will output whether or not System Integrity Protection is enabled on a Mac running El Capitan.
Any GUI application to manage all that?
Thanks a lot Topher! Indeed this is a really helpful tip!
Indeed. No other discussion I’ve seen of SIP made it clear that it automatically maintains permissions. All I’ve seen heretofore merely says that Disk Utility no longer offers the option to repair them. What has been explained elsewhere is that SIP locks down the system files that a permissions repair would clean up. Not that it maintains them. This is an important distinction. Because OS X is still a Unix based system and permissions are still central to how it works. They still need to be properly set, whether we can do it manually or not. Of course blocking user access to system files will ensure that there are fewer chances that permissions will be corrupted, but that doesn’t mean they are invulnerable.
It has also been reported by Apple that any System update will automatically repair permissions as needed.
“default permissions [are stored] in receipt files”
And what protects those from corruption? Granted, they are probably seldom read and even less often written, but that doesn’t account for disk corruption, stray cosmic rays, rogue code, etc. I suppose SIP can “phone home” also? 😉
Seems Mr. Lansing and I were typing at the same time! 😉 I hope he is correct.
Ya noticed it was missing when in Command + R this morning.
I don’t care what Apple wants I still want to fix messed up permissions on my Mac and there are many of them.
I get the impression that people or a person at Apple has completely lost the ******** plot. I can’t back up and downgrade to Mavericks as my DPs are totally screwed, and I have been complaining since the release of 10.7 about the changed scroll bar. Try using it if you have Parkinson’s Disease type symptoms due to ataxic cerebral palsy. I have been using computers since 1976 and have never seen a decline in an operating system like we are witnessing. Somebody should be prosecuted for “crimes against computing”.
In utter dispair and disgust,
Sarah
I can understand many of your problems, but I don’t think complaining about the “styles” will make much of a dent in the ‘designers’ understanding of them. I hope you can find some parts of the Accessibility Systems Pref pane useful. It may be keyboard work-arounds, zooming, switch control (which can use the keyboard as switches), etc. Frankly, the Accessibility Prefs are useful for lots of people, I don’t have Parkinson’s, but my aging eyes and the “flat” GUI makes contrast much more important and helped me, literally, see things better. And, as heretical as it sounds, I would encourage you to investigate other hardware makers and what they have to offer. Your personal needs are more important than loyalty to and brand. A letter to Mr. Cook about those needs just might be worth writing, even if it is physically difficult! Remember, however, that he probably doesn’t read this blog on a regular basis (much to his loss). I do wish you well
Applecare support just told me today that in El Capitan Disk Utility’s First Aid routine does in fact repair permissions on files that it can access. For a complete repair of all issues they recommended running Disk Utility from the Recovery partition, which should repair any mis-set permissions even on files protected by SIP, as well as repairing any repairable file system issues.
I just noticed the latest version of Onyx ver. 3.1.1. that fix permissions has returned with this version.
I noticed the same thing in Onyx 3.1.1 & tried its permissions repair. It found & ‘repaired’ dozens of mis-set permissions, but they were almost entirely related to old Canon & Epson printer drivers, & I don’t think any of them actually prevented print functions from working before the repair.
Well, my upgrade to El Capitan today screwed up ALL my permissions (it removed me, the computer administrator from the permissions to all files). Nothing would launch and the error messages generally did not give a clue to the real problem. So much for SIP. It did nothing for me. I had to go to my account and change permissions and push that change to all sub folders. But of course it took hours to figure out that was the real problem. I hate system upgrades. They just get more and more painful.
A quick way to repair file permissions in OSX El Capitan is to manually download the latest OS update from apple, and install it (or re-install it). There’s no need to re-install the whole OS to fix permissions.
Here’s a link to manually download OSX 10.11.1 (Just the update itself)
https://support.apple.com/kb/DL1845?viewlocale=en_US&locale=en_US
I am a Software Engineer who has had need to disable SIP. Therefore, I need to occasionally run a manual permission repair on volumes. Thankfully, the solution is actually very very (very) simple:
For any OSX version after 10.9, Apple has included a built in commandline tool to allow you to run and repair permissions yourself. (One of the great bonuses being that it allows you to a create shell script to run as a Cron job for you (say) once a month).
In order to run it manually, you simply type the or paste the line below into the terminal window and provide your password when prompted. The scan/repair will take some time, but will output information similar to the old style “Repair Disk Permissions” that you’re use to from previous OSX versions. (NOTE: It occurs to me that it might be a fun bonus test to see if this works across SSH as well.)
sudo /usr/libexec/repair_packages –repair –standard-pkgs –volume /
For detailed information and optional switches for this command, check out the Apple Man Page.
https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/repair_packages.8.html