Homebrew: change name of group ownership in /usr/local/ so admins and standard users can brew

administratorhomebrewpermission

I have a local admin user and a few "network" mobile users (without admin privileges) who need to be able to brew on a Mac. So, these 'network' users are not members of the group admin and probably shouldn't be.

$ ls -l /user/local

-rw-r--r--   1 localadmin  admin   491 Jan 21 18:04 CONTRIBUTING.md
drwxr-xr-x   6 localadmin  admin   204 Jan 21 18:23 Cellar
drwxr-xr-x   8 localadmin  admin   272 Jan 21 18:06 Library
-rw-r--r--   1 localadmin  admin   789 Jan 21 18:04 README.md
drwxr-xr-x  44 localadmin  admin  1496 Jan 23 23:44 bin
drwxr-xr-x   3 localadmin  admin   102 Jan 21 18:06 etc
drwxr-xr-x  27 localadmin  admin   918 Jan 21 18:24 include
drwxr-xr-x  98 localadmin  admin  3332 Jan 21 18:24 lib
drwxr-xr-x   6 localadmin  admin   204 Jan 21 18:24 opt
drwxr-xr-x   9 localadmin  admin   306 Jan 21 18:24 share
drwx------   3 localadmin  admin   102 Jan 21 18:37 var

My question is would there be a problem with, say, changing the group from admin to something like brewers for /usr/local -R (recurseively)? Then add root, localadmin and each network user to the brewers group. Would each network user now be able to brew?

I have read that I might need to change the umask for each network user to 0002?

Best Answer

This can work if you also then make /usr/local/ and everything under it group-writable with chmod. The current permissions have them writable only by localadmin.

Yes, you will need to do something about the umask for users running brew. Otherwise users won't be able to modify stuff brewed by other users, even if they're both in the brewers group. You probably don't want to change their default umask, because then all the files they create would be group-writable, which is probably not what you want. You might use a custom wrapper script around the brew command which sets the umask to 002 for just the duration of that command, e.g. by doing the umask and brew calls in a subshell.

Related Solutions

MacOS – Homebrew permissions & multiple users needing to brew update

Is this considered bad? I thought one of the advantages of using /usr/local/ for your installs was that you don't need sudo. But clearly we do.

Homebrew, by default, sets itself up for single-user access to /usr/local. So you need to open up the permissions on the directory tree for it to be administered by more than one person.

People don't need to run sudo here to administer homebrew. You just need to change some permissions. Since you already have:

All users who would need to modify Homebrew are members of admin group.

You need to do two more things:

Make sure everything under /usr/local belongs to the group admin; and
Make sure anyone from the group admin can write to anything under /usr/local.

In this case the changes to make are:

chgrp -R admin /usr/local
chmod -R g+w /usr/local
chgrp -R admin /Library/Caches/Homebrew
chmod -R g+w /Library/Caches/Homebrew

And any user from the admin group should be able to manage the homebrew installation on the machine. If you need to add a user to the admin group this can be accomplished like this:

 dseditgroup -o edit -a <username> -t user admin

(that user will need to login again to have the privileges granted).

For sanity on the machine, you may want to consider creating your own fork of Homebrew and have your local homebrew git repository point to the local fork. That lets you customize Homebrew for your environment and control the versions of packages that people are able to install with the brew command. With multiple people doing installs you could run in to version issues or dependency issues.

MacOS – Mavericks: User no longer owner of Home folder and content

An erroneous extended attribute has been applied to this directory somehow, but it can only be removed using the xattr Terminal command. You should take a look at a brief explanation here. A more detailed question and answer can be found at this StackOverflow page.

Best Answer

Related Solutions

MacOS – Homebrew permissions & multiple users needing to brew update

MacOS – Mavericks: User no longer owner of Home folder and content

Related Question