Warning: SUID file "_" has been modified and will not be repaired

Question

Level 3

559 points

Warning: SUID file "_" has been modified and will not be repaired

I keep getting these messages when ever I do a "repair disk permissions" in Disk Utility. What do they mean, and should I be concerned?

Repairing permissions for “Macintosh HD”
Warning: SUID file "usr/libexec/load_hdi" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/DiskManagement.framework/Versions/A/Resources /DiskManagementTool" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Reso urces/Locum" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/Install.framework/Versions/A/Resources/runner " has been modified and will not be repaired.
Permissions differ on "private/var/log/secure.log", should be -rw------- , they are -rw-r----- .
Warning: SUID file "System/Library/PrivateFrameworks/Admin.framework/Versions/A/Resources/readconf ig" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/Admin.framework/Versions/A/Resources/writecon fig" has been modified and will not be repaired.
Warning: SUID file "usr/libexec/authopen" has been modified and will not be repaired.
Warning: SUID file "System/Library/CoreServices/Finder.app/Contents/Resources/OwnerGroupTool" has been modified and will not be repaired.
Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired.

Permissions repair complete

Thanks

2GHz Intel Core 2 Duo (1GB), iMac G3 (512MB), iPS, Mac OS X (10.4.9), iPod Video (Gen 5.5) 30GB, Airport Extreme, 2 AP Expresses, 120 & 80GB Externals

Posted on Nov 16, 2007 7:24 AM

Reply

Answer 1

Dona0

Level 1

4 points

Nov 16, 2007 7:44 AM in response to MacKid4854

I am getting the same thing. With tiger I had nothing to repair. When I installed leopard, I had the one sud warning. With the update I am getting all of those. Can anyone help? Thanks

Reply

Answer 2

Arnell

Level 1

4 points

Nov 16, 2007 7:48 AM in response to MacKid4854

Same issue here. Before the update is was just the last error, but with the update, it's all that you have described.

The question is... are these benign as with the original error? I'm assuming this is the case.

Reply

Answer 3

Nov 16, 2007 11:20 AM in response to MacKid4854

As I understand it, the SUID applies to processes. Here's some info from Apple's glossary that comes with Developer Tools:

process UID--The “UID” of a process. Each process has three user IDs: the real user ID (RUID), effective user ID (EUID), and saved user ID (SUID). The RUID is always inherited from the user or process who executes the process. The EUID is normally the same as the RUID but can differ in special circumstances. It is the EUID that BSD checks to determine permissions. The SUID is used by BSD to enable a privileged process to switch in and out of privileged mode.

If you look at the permissions for /usr/libexec/load_hdi using the Terminal, this is what you see:

-r-sr-xr-x 1 root wheel - 43280 Nov 12 22:40 load_hdi

A "regular" executable in the same folder, looks like this:

-r-xr-xr-x 1 root wheel - 38544 Oct 1 21:29 makekey

If you peer closely at them you'll notice there is an "s" instead of an "x" in the line describing the permissions--the "executable" part of permissions. Evidently Apple made a change to allow certain things to be more flexibly run in regard to what they can and can't do (anyway, that is my hazy understanding of what "enable a privileged process to switch in and out of privileged mode" would likely mean). All Disk Utility is doing is informing you that the executable bit has been changed from the normal "x" to an "s" and that it is not going to change it back.

In other words we're back to the overly informative Disk Utility which is telling regular users things they do not need to know. This happened in previous OSes as well, and finally got silenced somewhere along the line in Tiger. These sorts of messages may be some interest and/or use to some programmers, but not to anyone else. Ignore them.
Francine

Francine
Schwieder

Reply

Answer 4

Hardy Geer

Level 4

3,166 points

Nov 16, 2007 11:33 AM in response to Francine Schwieder

Among the security upgrades in OSX10.5.1 are firewall changes. I think these are what is showing up in the permissions report.

Reply

Answer 5

SteveLamb0

Level 5

4,110 points

Nov 16, 2007 12:32 PM in response to MacKid4854

Hi

I had about 9 SUID warning after running the 10.5.1 update through Software Update. I am now back to just the ARD warning after downloading the 110MB updater from the Downloads website:

http://www.apple.com/downloads/macosx/apple/macosx_updates/macosx1051update.html

Steve

Reply

Answer 6

Cambrian

Level 1

4 points

Nov 16, 2007 4:37 PM in response to SteveLamb0

Regarding DU repair permissions. For me at least, I can confirm two things:

1. SteveLamb0's fix: Downloading the 110MB 10.5.1 (non-patch) cures all the SUID messages and the 10.5/10.5.1 "ACL not expected on . . ." messages have also gone away after installing this.
2. Cinephoto's iCal duplications at 10.5.1. At 10.5, iCal sync with .Mac is clean, at 10.5.1, a mess.

However, even though it is now a progress-bar (rather than the snoozing Barber Pole) I'm still getting "Estimated time: less than 1 minute" for 5+ minutes and my cpu is still maxed-out by the installdb_installer process.

Ah, the joys of early adoption. I'm sure they are burning the midnight oil on 10.5.2 as we speak 😉

Reply

Answer 7

Nov 16, 2007 4:51 PM in response to SteveLamb0

All you've done is changed the permissions of some files twice. Disk Utility no longer knows that they've been modified. If permissions were x,y,z before the update, and then changed to a,b,c after the update, Disk Utility is letting you know they've been changed. If you installed it again you have a,b,c before the update and a,b,c after the update, and Disk Utility no longer knows that anything has been changed.

You can get rid of the ARDagent.app SUID warning by doing the same thing—installing the Apple Remote Desktop 3.2 update again.

Reply

Answer 8

Cambrian

Level 1

4 points

Nov 16, 2007 5:10 PM in response to Ralph The Magician

I am not a "tech" so I have to accept your analysis of why this is happening.

However, Apple prides itself on the Mac's "usability" (and no surprises for their client population).

When I do nothing (except to upgrade my system OS) and I find that weird stuff is suddenly happening, I am confused.

These are merely early Leopard teething troubles, but it it still disconcerting nevertheless.

Reply

Answer 9

ojsebi

Level 1

61 points

Nov 16, 2007 5:19 PM in response to MacKid4854

I am having exactly the same warnings !!
do i ignore them ?

Reply

Answer 10

MJWeb

Level 1

125 points

Nov 16, 2007 5:28 PM in response to Francine Schwieder

This is obviously a minor annoyance of no real import. I will wait for Apple to fix it.

Reply

Answer 11

Nov 16, 2007 6:30 PM in response to Cambrian

Nothing weird is happening. SUID just stands for setuid or Set User ID. The files permissions have been modified, via the update, and they will not be repaired by Disk Utility because they don't need to be.

The "fix" for this is to just add this list of SUID modifications to the Disk Utilities exception list so that you never see them. That may or may not come in a future update.

Reply

Answer 12

Nov 16, 2007 8:17 PM in response to Ralph The Magician

Here is what Apple says about the SUID:
http://docs.info.apple.com/article.html?artnum=306925

Don't worry about it.

Pedro

Reply

Answer 13

Nov 17, 2007 9:41 AM in response to Cambrian

you can unclick the "show details" button about midway down on the disk utility window and save yourself the anguish of reading the unimportant details

Message was edited by: Robert Myers8

Reply

Answer 14

Nov 26, 2007 6:31 PM in response to ojsebi

Read the whole post and your concerns will be answered.

Reply

Answer 15

junshy

Level 1

15 points

Nov 29, 2007 2:05 PM in response to MacKid4854

I also have these issues and it is clear that it is not to much of an issue. It is nice to see it explained.

My problem is that it is taking 30 minutes to complete. It used to take ten minutes or less

Reply