New MBP with Sierra, /usr/local/bin no longer accessible unless root

bashpathpermissionsudoterminal

I just got a brand new MBP with a fresh macOS Sierra install. I installed Elm, which simply puts 5 files in /usr/local/bin. However, when I try to run any of those files, they aren't found:

Scotts-MacBook-Pro:~ scott$ elm-make --version
-bash: elm-make: command not found

I search for them in /usr/local/bin and I don't have permission:

Scotts-MacBook-Pro:~ scott$ ls -lh /usr/local/bin
ls: bin: Permission denied

I have to use sudo and I see they are all owned by root:wheel:

Scotts-MacBook-Pro:~ scott$ sudo ls -lh /usr/local/bin
Password:
total 85536
-rwxr-xr-x  1 root  wheel   2.0M Nov 10 18:46 elm
-rwxr-xr-x  1 root  wheel    15M Nov 10 18:46 elm-make
-rwxr-xr-x  1 root  wheel    11M Nov 10 18:46 elm-package
-rwxr-xr-x  1 root  wheel   7.2M Nov 10 18:46 elm-reactor
-rwxr-xr-x  1 root  wheel   7.0M Nov 10 18:46 elm-repl

I can list the contents of /usr/local without being root:

Scotts-MacBook-Pro:~ scott$ ls -lh /usr/local
total 0
drwx------  7 root  wheel   238B Nov 19 22:33 bin

I just migrated from a MacBook with macOS Sierra also and /usr/local/bin was accessible from my user account. Elm assumes that to be the case on all Macs.

Why was this changed? What should I do? Are we not supposed to use /usr/local/bin like this anymore? Should I change permissions on /usr/local/bin? I assume there's a reason /usr/local/bin has been changed in this way… Should I move the Elm files to /usr/bin?

Best Answer

In my almost default install of macOS (10.12.0 > updated to 10.12.1) the directories have the following owners and permissions:

drwxr-xr-x   4 root  wheel  sunlnk            136 Oct  2 22:42 . #/usr/local
drwxr-xr-x@ 13 root  wheel  restricted,hidden 442 Oct  3 01:01 .. #/usr
    com.apple.FinderInfo     32 
    com.apple.rootless    0 
drwxr-xr-x  26 root  wheel  -                 884 Oct 17 03:36 bin
drwxr-xr-x   5 root  wheel  -                 170 Oct 17 03:35 share

There is no obvious reason why the permissions are set that tight - Apple explicitly states that third-party apps and installers can continue to write to /usr/local. If a normal user wouldn't be able to read or execute files there, the directory would miss its point.

So simply change the permissions of /usr/local/bin (and /usr/local if necessary) to 755.

Related Question