MacOS – Can’t write to ~/Library, even though permissions look OK

aclmacospermissionunix

I'm totally stumped on this one — a Macbook Air, 10.9.2. As far as I can tell, I should be able to write to my Library directory. Everything I can see suggests I should be able to:

[njvack@zot Library]$ sw_vers | grep ProductVersion
ProductVersion: 10.9.2
[njvack@zot Library]$ id -a
uid=503(njvack) gid=20(staff) groups=20(staff),403(com.apple.sharepoint.group.3),12(everyone),61(localaccounts),402(com.apple.sharepoint.group.2),100(_lpoperator),401(com.apple.sharepoint.group.1)
[njvack@zot Library]$ pwd
/Users/njvack/Library
[njvack@zot Library]$ ls -ld@ .
drwx------@ 58 njvack  staff  1972 Apr 14 16:06 .
    com.apple.metadata:_kTimeMachineNewestSnapshot    50 
    com.apple.metadata:_kTimeMachineOldestSnapshot    50 
[njvack@zot Library]$ touch foo
touch: foo: Permission denied

And then for some reason I can work in ~/Library/iMovie, even though the permissions should be effectively identical:

njvack@zot Library]$ cd iMovie/
[njvack@zot iMovie]$ pwd
/Users/njvack/Library/iMovie
[njvack@zot iMovie]$ ls -ld@ .
drwx------+ 4 njvack  staff  136 Apr 16 08:41 .
[njvack@zot iMovie]$ touch foo

What else could be causing this? What can I check? FWIW, Disk Utility's Check Permissions doesn't complain about anything.

EDIT: As suggested, here's the ACL entries:

[njvack@zot Library]$ ls -led .
drwx------@ 58 njvack  staff  1972 Apr 14 16:06 .
 0: group:everyone deny add_file,delete,add_subdirectory,delete_child,writeattr,writeextattr,chown

… and as ACLs override UNIX permissions, removing the ACLs was the trick:

[njvack@zot Library]$ pwd
/Users/njvack/Library
[njvack@zot Library]$ chmod -RN .
[njvack@zot Library]$ touch foo

How did I get such screwy ACLs on my ~/Library? I have no idea.

Best Answer

To see the rest of the permissions (ACLs and file flags), add -e and -O to the ls command. I habitually use ls -leO@ as a "tell me everything" version of ls.

In this case, the problem was a "deny" access control entry, which will override the regular POSIX permissions. I have no idea how that might've gotten added to your ~/Library folder, but you can remove it with chmod -N ~/Library.

It's a bit late, but I would not have recommended using -R (apply recursively to all contents) on that chmod command, since there are some items inside ~/Library that are supposed to have ACLs (mostly to prevent accidental renaming or deletion of important items). But I don't think removing everything will to any actual harm, and if you're worried about other spurious ACLs, the recursive reset makes sense.

Related Question