MacOS – Homebrew permissions & multiple users needing to brew update

EDIT: The problem is now fixed in Homebrew:

• https://github.com/mxcl/homebrew/commit/8aa4f9dd3bbd885350776171d3d9403d381e1a59

If you still experience the problem, update Homebrew like this:

brew update

If you want to know what the problem was, I have kept my original answer below.

Ignore the permisson issue for now

I am experiencing the exact same problem and in my opinion the problem is in brew doctor rather than in your and my installation.

I think you should ignore the issue rather than changing the ownership of /usr/local. Alternatively, you could fix your local brew doctor script until a fix is released. See below.

I don't consider it correct to make /usr/local owned by a specific user. I have more than one admin user on this machine. You should leave /usr/local owned by root:admin as owner and group.

My investigation

Like for you I have a /usr/local that is perfectly writable by my user which is also a member of the admin group:

$ ls -ld /usr/local/
drwxrwxr-x  14 root  admin  476 22 Jun 23:33 /usr/local/
$ whoami
mgd
$ dscl . -read /Groups/admin GroupMembership
GroupMembership: root mgd rgd

Let's test that the dir is really writable:

$ ls -l /usr/local/newfile
ls: /usr/local/newfile: No such file or directory
$ touch /usr/local/newfile
$ ls -l /usr/local/newfile
-rw-r--r--  1 mgd  admin  0 23 Jun 14:52 /usr/local/newfile

Further investigation into the brew doctorcode led my to the conclusion that the use of the ruby function Pathname.writable? is causing the problem. Consider this interactive Ruby session:

$ irb
>> require 'pathname'
=> true
>> Pathname('/usr/local').writable?
=> false

Function Pathname.writable? says /usr/local is not writable even though we know it is.

Using Pathname.writable_real? instead gives the correct result – it says that the dir is writable:

>> Pathname('/usr/local').writable_real?
=> true

This should be fixed in /usr/local/Library/Homebrew/cmd/doctor.rb. You can fix it in your own installation while waiting for a fix.

The difference between the two functions are (according to the Ruby docs here and here):

writable?(file_name) → true or false: Returns true if the named file is writable by the effective user id of this process.

writable_real?(file_name) → true or false: Returns true if the named file is writable by the real user id of this process.

This can work if you also then make /usr/local/ and everything under it group-writable with chmod. The current permissions have them writable only by localadmin.

Yes, you will need to do something about the umask for users running brew. Otherwise users won't be able to modify stuff brewed by other users, even if they're both in the brewers group. You probably don't want to change their default umask, because then all the files they create would be group-writable, which is probably not what you want. You might use a custom wrapper script around the brew command which sets the umask to 002 for just the duration of that command, e.g. by doing the umask and brew calls in a subshell.