Repairing permission in safe boot

Hi Everyone,

Larry Jordon's Trouble Shooting Guide posted on this forum March 2004, suggests repairing permissions in Safe Boot. When I was at the Apple Store the other day, the tech said NOT to repair permissions in Safe Boot because Disc Utility doesn't affect anything while in Safe Boot.

My gut tells me to follow Larry's advice and that the Apple Store tech person is mistaken, but can someone explain what what the difference is running Disc Utility in Safe Boot vs. not in Safe Boot?



Thanks,

Shelley

Shelley
MacBoo Pro 2015
16 GB Ram
OS X 10.13
Premiere Pro CC

In my opinion, both of these sources are wrong.

A "safe boot" disables kernel extensions. It does other things too, depending on what version of Mac OS X you're talking about. But its real reason for existing is to let you disable kernel extensions, including ones that might be attempting to access malfunctioning hardware.

As such, doing a "safe boot" really has nothing whatsoever to do with file permissions. The two are unrelated.

Now, Disk Utility might depend on a kernel extension that doesn't get loaded during a "safe boot." I don't know. But at least in principle, file permissions and "safe boot" aren't related in any way.

(This could segue into a lengthy discussion about how repairing permissions is not actually a valid troubleshooting step except in specific and incredibly rare cases, and how it's been elevated to the level of a cargo-cult ritual by the same folks who used to think rebuilding your desktop and zapping your PRAM were great troubleshooting techniques in the System 7 days.)

The correct way to do Permissions repair on the boot drive, AFAIK, is to boot from the System CD (holding down C when you turn it on) instead of the boot drive. That's the only way to make sure that all of your system boot files are NOT open, so their permission attributes can be modified. Sounds like someone is getting confused with safe boot, which has a different purpose, as Jeff says.

Scott

Sorry to disagree, Scott, but that's not entirely correct.

Any time you install anything on Mac OS X using the Installer program, the software writes a little file called a "receipt" to a special folder on your system disk. Among other things, the receipt records what all the permissions were supposed to be for all the files installed. "Repair permissions" simply compares the permissions on disk to the ones recorded in the receipt file, and changes them if they differ.

Note that this only applies to programs installed using the Mac OS X Installer. If you manually screw up the permissions on After Effects, for example, "Repair permissions" won't help you, since Adobe doesn't use the Mac OS X Installer.

The other thing to note is that all we're talking about here are file permissions. These are not complicated or fragile little bits of metadata; they're not like resource forks from the Bad Old Days, if that means anything to you. They're really robust little gizmos. Every time the computer accesses a file, the filesystem checks to see if the process doing the accessing has the right kind of permission. Reading permission is different from writing permission ? files can be read-only, or even write-only ? and both of those are different from execute permission ? not just any file on your computer can be run as if it were a program.

Changing file permissions while files are open is absolutely no problem. It couldn't be a problem, because the permissions aren't actually stored in the files themselves. They're actually stored in the directory that contains the files, which is in an entirely different part of the disk. (On Mac OS X, a directory is also a file, just a very specific kind of file.) You can change the permissions of an open file all you want, and nothing bad will happen, because file permissions are checked on each access request. In fact, on Mac OS X, the concept of an "open" file has a really nebulous meaning at best, since you can write to Mac OS X files without ever officially "opening" them.

Anyway, my long-winded point is this: You don't have to boot off another system disk to repair permissions. In fact you shouldn't, because it's always safer to run the version of Disk Utility for Mac OS 10.X.Y while running Mac OS X 10.X.Y.

The other point I'm making here is that "Repair permissions" does a very specific thing, and nothing else, and in fact calling it "repair" was a lousy choice on Apple's part because it implies that it's in some way a diagnostic or troubleshooting tool when it is not. Nine hundred and ninety-nine times out of a thousand, "Repair permissions" does nothing but waste time.

That's all very interesting, Jeff, and thanks for all the detail. I was lamely repeating the conventional wisdom about repairing permissions. It has been the running advice as the thing to do before and after OS upgrades or other major software installs. And to perpetuate what may be misinformation, it often enough seems to clear up problems that had no other clear reason for being.

What's interesting is that when you do run it, it appears to be doing a lot of "necessary" work, except that the files I've seen it "repair" are usually totally unrelated to the problem I'm trying to solve. Another thing that throws people off is that it always begins with a bunch of messages that look like huge problems if you don't actually read and understand them. But the question remains - why is it finding all these things to do if the Installer makes sure they're correct, and Repair Permissions can't fix problems created outside the Installer?

Otherwise unexplainable FCP problems seem to respond to repair permissions, and the logic is that a critical data file is not accessible for the program's current access requirements, so the process dies. I've always found that a little specious from a programming point of view, in that the program ought to be able to handle access conflicts a little more gracefully and verbosely, instead of just crashing. Of course, that's a complaint about a whole raft of FCP errors that give no hint as to what a solution would be.

So what is the best way to proceed, for Shelley's problem and everything else Repair Permissions is supposedly good for?

Scott

Well, that's kind of the thing, Scott. In this particular case, the conventional troubleshooting wisdom is pure bunk.

The concept of "Repair permissions" didn't even exist until one of the dot-updates to Mac OS X 10.1. In those days, Macs could still boot Mac OS 9, and Mac OS 9 had absolutely no concept of POSIX file permissions. Booting a Mac OS X system in Mac OS 9 was a great way to totally hose your permissions, even to the point of rendering your Mac OS X system unusable.

So Apple released a little downloadable utility that could reset the permissions of the system software to their installation defaults, thus fixing catastrophically messed-up permissions.

But those days are long gone. It's been years since a Mac could run anything other than Mac OS X, and the odds that your file permissions will just spontaneously get screwed up are vanishingly small. These days, the only two plausible ways ? not the only ways, just the only not-insanely-unlikely ? ways to mess up your permissions are by manually going in and doing it yourself, or by running a third-party installer that, given administrator-level access to your system, changes permissions to something other than what they should be.

Screwing up your permissions yourself isn't something that can be done by accident. In the Finder, it has to be done by selecting a file, doing a "Get Info" and then messing with the fine print down at the bottom of the window ? and even then, the Finder will demand you type your password before letting you change permissions on any system files. Doing it via the command line requires commands that are so obscure typing them by accident is about as likely as dozing off at your computer and typing out "The Second Coming" by William Butler Yeats through the random mashes of your keyboard with your face.

And when a third-party installer misbehaves, which they sometimes do, they virtually always give files or folders on your computer more liberal access than they have by default. Which is potentially a security problem, theoretically, but is not likely to cause any operational problems with your computer all by itself.

So in this day and age, "Repair permissions" is simply not a useful troubleshooting step. If you're having a problem and you run "Repair permissions" and the problem goes away, the odds are overwhelming that something else happened. What? I don't know. I wasn't standing over your shoulder the whole time. But the odds are microscopic that "Repair permissions" actually had any effect on anything.

True story: One time an associate of mine complained of a recurring problem on his Mac. Late in the day, it kept getting really sluggish, with a lot of "spinning beachballs." His solution, going by troubleshooting advice on the Internet, was to run "Repair permissions" and restart. I asked him to let me see it next time the problem came up. Long story short, he was running out of memory and starting to swap. Running "Repair permissions" did absolutely nothing, but rebooting his computer closed all running programs and freed up all his memory. The long-term fix was simply to buy him more RAM.

(Oh, one more tidbit: You said that invalid permissions could cause "a critical data file" to be inaccessible. Remember that "Repair permissions" only reads the computer's receipts. It does not, and cannot, touch data files, or anything in your home directory. So if that actually were a problem, "Repair permissions" could not fix it.)

Jeff,
Are you the same Jeff who was the (Avid) trouble shooter at Discovery Channel in 1997?

And yet, time and again, when users have trouble, repairing permissions fixes the issue. Maybe it's Mac Voodoo?

Hi Jeff

Am loving your debunk the myth attitude on this! So would appreciate your thoughts on those parts of the conventional wisdom that seem to be firmly lodged in my own brain:

> the odds that your file permissions will just spontaneously get screwed up are vanishingly small...Screwing up your permissions yourself isn't something that can be done by accident...

Its only been a few iterations of the system since running Apple's OS upgrade and app installers, would leave your permissions in a less than pukka state. I'm talking Apple released upgrades of systems and apps, not dodgy third party here.

>invalid permissions could cause "a critical data file" to be inaccessible.... if that actually were a problem, "Repair permissions" could not fix it

Hosed permissions for access to your system files and resources, things that are in your Library, even your system and user level access to your entire directory structure? Not a good thing. These are shared resources, and an incorrect permission bit could prevent a user or an application from being able to access specific files or entire directories. No one is destroying the files or directories themselves, but if an app can't see it it may as well be "broken". Repairing (restoring correct access) permissions "fixes" that.


I think the very fact that it was Apple's own upgrades that oftentimes caused these (potential) issues quickly made repairing permissions a necessary step, and anyone used to maintaining there own system or that of others soon learnt that: Repairing permissions before and after an install = Good.

Point of fact though, and I think this is where you are coming from, is that Apple's installers are much much better now at leaving things the way they were / were supposed to be. Having regularly jumped through the repair permissions hoops myself, and used to reading the list of repairs, its notable that for at least the last two major OS and app releases, irepair permissions has increasing little of consequence, if anything, to report.

However, once bitten twice shy. Just because its less likely doesn't mean it can't/won't/didn't happen. The Installer application is inherently capable of leaving the system in an unstable state, whether by running Apple or 3rd party code. It may be increasing less likely to be the source of any problem these days, but that doesn't mean it should be ignored. When things are not functioning correctly then repairing permissions remains a very valid troubleshooting step.

Is it the first troubleshooting step? No. As you point out. The first step should be a cold boot of the machine. Good medicine indeed.

All that said, I'm more than happy to hear different Jeff, as always we're all here to learn and you clearly have a lot to offer. So feel free to disabuse my ramblings at will!


Re the OP's question of repairing permissions in Safe Boot. Shelly, I think the reason this is suggested is more to do with filesystem diagnosis and repair routines (thats why it takes so long to boot) that are automatically run when you boot up into Safe Boot mode. There's no advantage that I know of to running the Repair Permissions under safe boot in and of itself, although as Jeff noted, neither is there any disadvantage.

Cheers
Andy

No, Tim, that's not me. Must be another guy.

Andy, I have heard stories of Apple system updates creating problems that could be solved by running "Repair permissions." But I've never actually witnessed it myself. It's possible the stories are true. But it's also possible that they're just urban legends propagated by the same people who think "Repair permissions" is more than it is. I honestly don't know, and have no opinion.

Look, "Repair permissions" exists for a reason. It does something. But it's not magic. It's not even complicated. If file permissions on a system file or directory are different from the permissions for that file or directory as specified in the installer's receipt file, it changes them to what the receipt says they should be. That's it.

It's technically correct to say that "an incorrect permission bit could prevent a user or an application from being able to access specific files or entire directories," but it's considerably more complicated than that. Just as an experiment, I just went in and removed execute permission from the Soundtrack Pro executable file in my Applications directory. Then I tried to launch it. To absolutely nobody's surprise, it failed to launch. The dock icon bounced once, and then nothing happened. There was a plain-as-day error message in the Console telling me that permission was denied trying to run Soundtrack Pro.

Okay, so we've simulated a permissions problem. I ran "Repair permissions" to fix it. Guess what? It didn't.

That's right, folks. "Repair permissions" only touches system files, not applications. (This was a tidbit I should have included earlier, but forgot.)

So in order for "Repair permissions" to do something useful, the following things must be true:

1. There must be a file or directory with permissions that differ from those specified by the installer receipt.

2. Those permissions must be excessively restrictive; can't read, can't write, something like that. Excessive liberal permissions aren't enough.

3. The file in question must be a part of the base Mac OS X system, not an installed application or data file or something.

If those three things aren't all true at the same time, "Repair permissions" will do nothing useful. If only 1 and 3 are true, but the permissions are too liberal instead of too restrictive, "Repair permissions" will reset them. But that won't affect any possible problem you're having, since excessively liberal permissions won't cause the kind of problem we're talking about here.

So bottom line: If you're having a problem, check your Console. If you see "permission denied" in there anywhere ? and it's easy to check, via the little search box in the upper right ? running "Repair permissions" may help you, if the file or directory in question is a part of the base Mac OS X system install. If it's not, then the error message in your Console will point you to the exact file or directory with incorrect permissions, and you can try resetting them manually if you've got those kinds of skills.

If you don't see "permission denied" in your Console, then the odds that you're actually having a permissions-related problem, and that "Repair permissions" will help you, are astronomically small. Sure, you can try running it if everything else fails; it certainly won't hurt anything. But it takes time, and thus should not be your first troubleshooting step. In fact, it shouldn't be a troubleshooting step at all, since it in no way helps you identify the cause of your problem or understand what's going wrong.

Calling "Repair permissions" a troubleshooting tool is like suggesting that at the first sign of trouble you should open up your computer and replace all the RAM. Sure, it won't hurt. And one time in a zillion, it might help. But it's not a good way to identify, diagnose or fix a problem.

Jeff, you've made valid points, but comparing your points to my experience, I think you're being a bit too theoretical.

Theoretically, for example, there shouldn't be any reason why a camera lens should affect timecode on a tape. But that's exactly what sank two days worth of dailies on a TV show I assisted on years ago, and the camera department foolishly ruled out my suggestion above and continued shooting with the defective lens, thereby giving us two days of bad footage instead of one day.

Theoretically there's no reason why Media Manager can't deal with speed-changed clips, since no timecodes are being changed. But it consistently fails to do so.

Theory is great, as is knowledge about the nuts-and-bolts workings of computers, but computers don't always work logically. This is why Apple techs almost always suck at trying to help editors fix Final Cut Pro problems. They have no empirical knowledge of how the application actually works when you use it 12 hours a day.

> Calling "Repair permissions" a troubleshooting tool is like suggesting that at the first sign of
> trouble you should open up your computer and replace all the RAM

Nobody's suggesting that Repair Permissions can fix everything. But it fixes a lot of problems that can't be traced. And the fact is, it's also a troubleshooting step with very little inherent cost -- it almost never makes any problem worse; the worst it can do is not fix the problem. Which makes it, in my experience, a good step for fixing problems you can't nail down, ranking alongside clearing out more drive space, repairing the disk directory, copying clips to a new project, media disconnect/reconnect, dumping preferences, dumping render files and so on. And then there are more drastic steps like reinstalling OS or FCP, reformatting a drive, recapturing media, and other steps that would stop your work dead in its tracks.


www.derekmok.com

Thanks Jeff, interesting stuff .. well I think its interesting anyway <grin>
Your example is excellent and illustrates your point very well.

FWIW I have many many times in the past witnessed the Repair Permissions report scrolling by with hundreds and seemingly thousands of repairs after an OS X upgrade or application install. Its no urban myth by any stretch if the imagination... but was the system unstable, critically or otherwise? I've no idea, I never really waited to find out. I always preferred to address these permissions inconsistencies before trying to find out what would happen if I didn't!

And thats the point really. Good system maintenance and preventative medicine. I guess when someone is suffering from issues unknown, then yes, its a very trite and easy directive to trot out. It may or may not be likely to directly resolve the issue, but couselling folks that its a pointless actively that almost certainly won't help seems somewhat counterintuitive.

Consider this scenario. Incorrect permissions in a system level directory cause a component part of a tool or utility to install or upgrade incorrectly. As a consequence the tool fails to work as expected, or at all. Everything else continues to work just fine. Peer groups suggest it works perfectly well on everyone else's machine ... so the unfortunate would be user tries the delete receipts / reinstall shuffle. The permissions issue is/was not resolved though, and the second install is no more or less successful. Lets try Repair permissions. Hmmm. It appears to fix some permissions that we didn't know were bad, but the tool still doesn't work. Everything else still works fine though. Ok, sod it, try to reinstall again. And now it works. What was the fix?

Ok. I realise thats a pretty darn contrived scenario but not, I think, an invalid one. Permissions issues are nothing new. I've been working in and around unix oses for about 20 years give or take, and whilst things have not stood still in that time, the basic capacity for bad permissions to ruin ones day has not changed!

We may just have to disagree on this one ... so if you see me suggesting folks with troubles try repairing there permissions as part of the troubleshooting, just turn a blind eye eh?!

On another note, I still didn't run those reference movie tests yet... too busy arguing the toss on these damn forums I reckon :-)

Thanks for helping me understand.

I have had "repair permissions" fix weird problems sometimes and then again sometimes not.

Now the question becomes, from a "preventative maintenance" perspective, is repairing permissions even useful?

I have "Disc Warrior" and have heard that running that once a month is recommended. I also have Mac Janitor. (I shut my computer down every night). Should I run those both these utilities once a month to keep my system running smoothly? Or "don't fix it, till it's broke."

In other words, I would like to know what is recommended for routine maintenance for OSX and the Final Cut Studio applications.

Shelley
MacBoo Pro 2015
16 GB Ram
OS X 10.13
Premiere Pro CC

Shelly, you'll get about a zillion responses to this (whether actually typed out or just recited mentally) that say the exact opposite, but my answer is that your Mac requires no preventative maintenance whatsoever.

Now, there's a caveat: You shouldn't turn off your Mac at night. As you almost certainly know, your Mac is configured by Apple to run certain tasks in the middle of the night and weekends. Now, I think I remember hearing that Leopard has become smart enough to run missed scheduled tasks when the computer next wakes up, but I don't know for a fact that that's true.

But if we assume your computer is taking care of itself the way it's designed to, then no, I don't believe any preventative maintenance is necessary or advisable.

Look at it this way: In your car, parts wear out. Bearing erode over time, fluids become tainted with metal shavings or whatever. It's possible for your car to be almost ready to break, without actually breaking.

Computers don't work like that. They don't have moving parts that wear out ? well, except for the actual moving parts, like hard drives and fans and stuff. But in software terms, there's no friction. Nothing happens spontaneously; things continue to be exactly the way they are until something changes them. Final Cut Pro can mess up one of your render files, for example, and that file will have to be removed and recreated. But if you leave your system alone, a render file won't just go bad all by itself.

I know my opinion isn't a popular one. I won't even swear to you that it's a correct one. But it comes from years of working with systems like Fire and Flame that used to run on big SGI systems that, apart from hardware stuff, neither required nor offered any maintenance features whatsoever. There was no "repair permissions" and no "Disk Warrior" or any of that stuff. Those system just continued to work until something went wrong with them, and when something was wrong, you fixed it and went on.

> Now, there's a caveat: You shouldn't turn off your Mac at night

That's not completely true. You can do those late-night tasks on your own, either by using Terminal ("sudo periodic daily weekly monthly" or by using MacJanitor. Half of Mac users turn their computers off, half don't. The half that do aren't exactly doomed. I myself turn my G5 off every night -- because I don't like the actual moving parts (drives, fan, DVD drive) and electronic components (boards, wiring) to have to work 24/7.

> But if we assume your computer is taking care of itself the way it's designed to, then no, I
> don't believe any preventative maintenance is necessary or advisable.

That's also not true. Periodic DiskWarrior and Disk First Aid checks are advisable as long as you don't overdo it.

> But in software terms, there's no friction. Nothing happens spontaneously; things continue to
> be exactly the way they are until something changes them.

But the fact is that the computer is always working, changing things. It's like saying your body will be healthy as long as you don't do anything to it. But "not doing anything to it" is an impossibility.

Your computer is being changed every single day. Just running it means your hard drive will wear; Software Updates; hell, just e-mail and web browsing will change the information on your computer.

> But if you leave your system alone, a render file won't just go bad all by itself.

The only way to truly "leave your system alone" is to not use it at all. And even then -- hard drives have been known to die by just sitting on a shelf unused, untouched.

I'm going to argue that Jeff's points are taking the laissez-faire approach to way too far an extreme. If computers really did "operate fine if you leave them alone", then all those amateur editors out there who don't know what drive format is would all be completely trouble-free. Maintenance routines are essential. Just don't overdo them -- for example, some people run DiskWarrior every day, which I don't consider a good idea.


www.derekmok.com

Good thread all. Love the back and forth. This debate however has been an ongoing one for along time. No one is going to win this one. The psychology of troubleshooting a system in which most of us have not a clue on how it works is we have to do something. That something is usually something simple like repair permissions. Yeah, maybe its rubbish and maybe it's not. Damn if I know. I still cant wrap my head around sand being an ingredient in a computer chip.

But ya'll make real good arguments here. Thanks for taking the time.

Michael Horton
-------------------

Thank you all for the input.

It sounds like the jury is still out on the need for preventative maintenance.

Since I do shut down every night, I think I'll run Mac Janitor a few times a month and Disc Warrior every six months or so. Sounds like it won't hurt anything. And I can feel like I'm taking care of my system, even if it's just psychological. Then I'll have a nice sense of security -- even if it's false -- and hopefully all that good Ju Ju will prevent system problems

Shelley
MacBoo Pro 2015
16 GB Ram
OS X 10.13
Premiere Pro CC

And speaking of shutting down your computer, I am a big proponent of that despite the fact Macs are supposed to be running this maintenance thing late at night. We all got to do our parts here and lets face it, if the Mac is on, it's wasting electricity, pure and simple. Turn it off if you know you wont be back for several hours. And turn that monitor off too. And that plug you got it all plugged into.

Michael Horton
-------------------

Not to be all Disagreey McDisagreeable here, but the wear and tear on a hard drive by spinning it up and down is far greater than the wear and tear of constant use. And modern Macs are so energy-efficient that the power consumed by a Mac Pro at idle is around 150 watts (bit more if you've got PCI cards or what have you), or comparable to a couple-three light bulbs. A fridge, by way of comparison, consumes around 500 watts on average. Not counting the freezer.

But if you do decide to turn off your Mac at night, I'd run the automated maintenance tasks a lot more often than a few times a month. Some of those tasks are set to run every single day. It's nothing super-mysterious; it's stuff like deleting old log files and whatnot. But if you're going to run them manually anyway, it's probably best to at least approximate the schedule on which they're meant to run.

Agreed all-around, though, that it's been a good discussion.

But put several million macs using 150 watts together and that's a lot of watts. Same principle applies to turning off the lights when leaving a room. Every little bit helps. Might not seem like anything if one person does it, but if everyone?

Michael Horton
-------------------

Here a link to the FAQ Wiki on maintenance : [www.lafcpug.org] - Jeff won't like the 'repair permissions' step, but it's a basic guide to what you can do.