MacOS – How to figure out what is causing the ownership of /usr/local to change from the-username to root

homebrewmacospermission

I use homebrew as a package manager for certain web development app. To keep brew up-to-date I run update brew every couple of days and also run brew doctor. Usually, this is fine and brew tells me I'm ready to brew.

Every now and then, however, I get the following error:

Warning: /usr/local/etc isn't writable.

This can happen if you "sudo make install" software that isn't managed by
by Homebrew. If a formula tries to write a file to this directory, the
install will fail during the link step.

You should probably chown /usr/local/etc

Warning: The /usr/local directory is not writable.
Even if this directory was writable when you installed Homebrew, other
software may change permissions on this directory. Some versions of the
"InstantOn" component of Airfoil are known to do this.

You should probably change the ownership and permissions of /usr/local
back to your user account.

It's easy enough to reset the permissions back to my username. Afterwards brew seems to be fine.

But what is causing this to happen?

Is there a log that shows what is causing the permissions to change?

Best Answer

I had this exact same issue, and it turns out Sophos auto-update was to blame. I figured this out by running: sudo fs_usage | grep "usr/local"

It took a while, but eventually I saw Sophos's helpfully named "Installation" daemon messing with /usr/local's permissions.

I'm still trying to figure out an appropriate work around for this behavior.

EDIT: I believe Sophos has fixed this issue, see the link in the comments of this answer. It seems to be fixed for me at least!

Related Question