How to Fix the Unknown Group (Permissions)

BACKGROUND

Leopard sets up accounts and permissions differently than Tiger did. In Leopard, users belong to the staff group, while in Tiger they each belonged to their own one-member group named with their short name. Leopard's installation script doesn't migrate the accounts, it just leaves them intact. For example, in Tiger, my XYZ account belong to the XYZ group. Leopard didn't correct that to the staff group (20) or define the XYZ group, so my files belonged to an unknown group. That causes problems with Spotlight and a lot of other stuff.

SOLUTION

The solution requires a separate admin account and enough disk space to make a copy of the home folder.

Prepare for this by unregistering your computer from dot Mac and logging out of it. Also, turn off the Time Machine.

1. Create folders in /Users/Shared that correspond to the folders in the home folder (Desktop, Documents, Library, and so forth)

2. Move the contents of each folder in the home folder to the corresponding folder in /Users/Shared. (For example, contents of Documents to Documents). You cannot just move the folders, because you won't be able to open them from another account.

3. Log off, then log into the separate admin account. Delete the troublesome account, and select the option to delete the Home folder. This is necessary because the troublesome account is irredeemable, and it's the only way you can reuse the short name.

4. Create a new account with the same name, short name, and password as the now-deleted troublesome account and log into it.

5. Open two Finder windows, Sharing and the current account's home folder. Move the files to the current account, but don't overwrite the top-level folders (Desktop, Documents, and so on), move their contents. If you cannot overwrite a folder, open it, and move the contents.

6. When you are working on the /Users/Shared/Library folder, move the Mail folder to the desktop so you can import the mail boxes into your new setup.

7. If you have more than one Mac and you have dot Mac, register the computer and sync now.

8. Import the mailboxes from the Mail folder on your desktop.

Now your user account is ready to use, almost indistinguishable from the old one, except all the permissions are correct and everything works well. There may be a few preferences here and there that you might have to reset.

9. I recommend using Disk Utility to erase the Time Machine disk so you can start over.

This isn't easy, but it less painful than erase-and-install followed by installing all your applications.

24" iMac and 15" MacBook Pro, Mac OS X (10.4.10)

Posted on Nov 18, 2007 6:11 PM

Reply
56 replies

Nov 25, 2007 8:02 AM in response to R C-R

I think you are missing the point of my post: there should be no issue other than a Finder info display one if your OS is healthy


On what are you basing this conclusion? Just because the only problem noted so far is Finder does not mean that there are not other problems (It has been reported that when GID = UID, that Time Machine and Spotlight has problems).

Nov 25, 2007 11:04 PM in response to Tony T1

What you quote from the other thread contains some oddities:

1. TextEdit does not "move" files from the temp folder to their final saved location. TextEdit has an automatic backup function useful in the event of an application crash but this has nothing to do with normal saves. Files in the temp backup folder are deleted on a successful save of the file unless you tell it to save them. See the TextEdit help topic "Saving your documents" for more about that.

2. The location of this temp file should be in ~/Library/Autosave Information/ (in the home folder of the account using TextEdit), not in /private/var/folders/ (a systems level directory). There should be one temp file for each open, unsaved TextEdit document, named "Unsaved TextEdit Document," "Unsaved TextEdit Document 2," & so on, plus a pref file named "com.apple.TextEdit.plist" (not to be confused with the main TextEdit pref file of the same name) with an entry for each of these files. On quitting TextEdit the contents of this folder should be deleted, unless you have set the TextEdit pref to retain them. The /private/var/folders/ content is managed by the OS & you should probably let it do so to avoid mis-operation.

3. The "semantics" of UNIX normally require a saved file to take the permissions of its enclosing folder, so if a user has a Desktop folder with a GID of 501 (or whatever), that is what a file saved to the Desktop should have. This is the behavior I see. It doesn't matter what of the autosave options I have enabled, or if the account has a GID of 20, 501, or any other GID.

Also, note that the Desktop you see on screen is actually a compilation of all the Desktop folders available to the user, not just ~/Desktop. If you have any mounted volumes other than the startup one, you may be seeing items on their Desktop folders, which might have different access privileges.

My suggestion for whatever TextEdit related problems you may be having is to suspect TextEdit, not Finder, & to perhaps try deleting its ~/Library/Preferences/ file as a first step in troubleshooting it.

Nov 26, 2007 10:14 PM in response to R C-R

My suggestion for whatever TextEdit related problems you may be having is to suspect TextEdit, not Finder, & to perhaps try deleting its ~/Library/Preferences/ file as a first step in troubleshooting it.


Yes, it is TextEdit, not Finder (and it is not a preference file issue). If a users GID:501 is changed to GID:20 and all the files in the home directory are changed to GID:20, New files created by TextEdit are given a GID of 501, therefore the 'fix' suggested by MacFixIt does not work. TextEdit is only an example of how this issue does not have an easy fix (which would explain why it was not fixed with 10.5.1)

Nov 27, 2007 2:10 AM in response to Tony T1

Tony T1 wrote:
If a users GID:501 is changed to GID:20 and all the files in the home directory are changed to GID:20, New files created by TextEdit are given a GID of 501 ...


Again, I cannot duplicate this behavior. My account with a UID of 501 has a GID of 20. My Desktop & other home folders (except shared ones) have a GID of 20. TextEdit (or other) files I save to the Desktop (or to ~/Documents/, ~/Pictures, ~/Music/, etc.) all inherit a GID of 20, just as expected. Spotlight has no trouble indexing these files, nor does Finder crash when I unlock their permissions or otherwise manipulate them.

I'm not sure what your problem is or its cause, but I doubt it is the OS itself or its first update. It would help a lot if you would describe in detail the symptoms you yourself have experienced (not those of others from other posts) & what you have done to try to eliminate them or isolate them to some specific behavior of the OS or its applications.

It might also help you to review the rules that govern file access in OS X. One good source for this is OSXFAQ - Users, Groups, and Permissions. Although a bit out of date for Leopard (no longer is a NetInfo app provided), it covers the fundamentals quite well, including inheritance & file modes.

Nov 29, 2007 7:30 AM in response to biovizier

For me, the easiest way to fix the (unknown) group issue was to complete the RealName property of the group. After updating Tiger to Leopard and entering a RealName for each group, I have same UID's and GID's as in Tiger (501, 502...), and Finder and Spotlight works well (thanks to biovizier).

Maybe the similar issue : (null) process displayed in Activity Monitor when working with some applications (Excel, Acrobat...), pointed out in another Apple discussion, can be fixed by a similar patch. What's your opinion ?

Dec 21, 2007 9:24 AM in response to Ken Collins

I believe I have a solution to all the permission problems in a simple update from Tiger to Leopard. You'd have to do this in each account. The account has to be an administrator account, if it is not, make it one temporarily. Someone can probably simplify this or make it into a script.

1. Follow the instructions in http://docs.info.apple.com/article.html?artnum=307128

2. Use MacPilot to remove all ACLs from your Home folder (I can't think of a better way)

Since the ACLs are gone, they can't interfere with the remaining steps.

3. Fix any ownership issues with sudo chown -R shortname:staff *

This not only fixes issues, it eliminates the need for sudo from here on.

4. Fix file permissions with these commands (I've tried alternatives, this seems best. The +X parameter didn't work for me.)

chmod -R u+rwx *
chmod -R go+r *
find . -type d -exec chmod go+x * {} \;

5. To secure the account, put extended attributes back on the top-level folders in Home (but not the contents of those folders or to Home itself.)

chmod +a "everyone deny delete" *

That should do it. Perhaps someone with more expertise can verify that this is correct.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How to Fix the Unknown Group (Permissions)

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.