MacOS – Sharing & Permissions has two “everyone” entries, only for applications by Apple

applicationsmacospermissionsharing

OS X 10.12.6, Sierra

My Sharing & Permissions says "You have custom access" and it's showing two entries for "everyone" where the first is set to "Custom".

  • This only seems to be affecting every single one of Apple's applications in the Applications and Utilities folders. I have no idea what other files are affected but a random search only turned up all Apple applications. All third-party applications are unaffected.

  • I did permissions repair using Onyx but it had absolutely no affect on these applications.

  • I cannot manually change permissions as the minus sign is grayed out after unlocking (see picture). Even if I could, it would take a very long time to manually find/repair.

  • I do not know what triggered this problem as I just discovered it today. However, I recently cloned my hard drive over to a new solid state drive using Carbon Copy Cloner.

  • I've already followed this official Apple procedure for fixing my Home folder permissions and I don't seem to have any problems there.

  • Everything appears to be operating, however, I'm seeing some strange problems like my ICC color profile will not stick after a reboot (permissions seem fine in the Library), but the ColorSync Utility instantly crashes when I click the "Repair" or "Verify" button.

enter image description here

I've already found and followed this thread, but the answer did not help.

Best Answer

This is a normal behavior of the Sharing & Permissions Info window in macOS systems protected by SIP.

The three latter are the POSIX permissions:

rwxr-xr-x@  3 root      wheel  restricted   102 Jul 22  2017 Activity Monitor.app
    com.apple.rootless

rwx read/write(/traverse(execute)) for the user root/system
   r-x read(/traverse(execute)) for the group wheel
      r-x read(/traverse(execute)) for everyone

The first entry (everyone > Custom) is a result of the restricted flag/com.apple.rootless attribute and can be interpreted as an ACL: group:everyone deny delete and the ACL can't be modified!

An (older) list of all restricted/SIP protected files and folder can be found here: System Integrity Protection – Adding another layer to Apple’s security model

Related Question