Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Disk Utility - Permissions Repair

After successfully installing Snow Leopard, I ran the Disk Utility to repair permissions. I received this message:

Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAg ent" has been modified and will not be repaired.

Can I just go in and DELETE this file? Is there a solution?

--Josué

PowerBook G4, Mac OS X (10.6)

Posted on Aug 30, 2009 7:57 AM

Reply
15 replies

Aug 30, 2009 8:22 AM in response to Josue Rosado

Josue Rosado wrote:
Is there a solution?


The solution is to understand that a warning is not -- of & by itself -- a positive indication of an error or anything that needs fixing. (By definition, a warning just indicates a possible danger or problem.) Here, all it means is the database entry of default info about the file created during its installation doesn't agree with the file's actual information.

Since this same warning appears in Mac OS X 10.5: Disk Utility's Repair Disk Permissions messages that you can safely ignore, it is probably safe to assume you can ignore it for 10.6 as well.

Aug 31, 2009 5:55 AM in response to Josue Rosado

I did a complete wipe and install of 10.6 this weekend. After moving my personal files back and tweaking other things like Bookmarks, etc., I ran the Repair Disk Permissions routine and got this same message. I'm used to seeing innocuous errors here however, I did a quick Google search and found this article right off the bat: http://www.macosxhints.com/article.php?story=20080620052233168 ==> "+ARDAgent runs when you use Screen Sharing in 10.5, and if you've enabled Remote Management in the System Preferences panel, but this exploit actually works when ARDAgent isn't running.+"

Even though this article was written in June of 2008, it refers to a security hole associated with this file "ARDAgent.app" and seeing the Apple Support Article #TS1448 - then the words, messages that you can safely ignore... I'm not so sure. This article refers to release 10.5 and not 10.6 and while the previous article from June last year may be relating to yet an earlier 10.5 release, its still gives me pause for concern. I've seen many times when a previous bug recurs after a new release due to an oversight but I just don't know.

I'm not one that can simply dismiss an alert because Apple says "you can safely ignore" particularly when previously there was a security hole associated with this very file.

We all know that Mac's are very secure and reliable however, I'm concerned none the less.

Aug 31, 2009 8:40 AM in response to JimN

JimN wrote:
Even though this article was written in June of 2008, it refers to a security hole associated with this file "ARDAgent.app" and seeing the Apple Support Article #TS1448 - then the words, messages that you can safely ignore... I'm not so sure.


The warning message doesn't indicate anything one way or the other about this potential security exploit. In fact, if it still exists & you used some of the methods mentioned in the Mac OSX Hints article to close it, you would either still get a warning message (because you changed the file's metadata) or if not, the repair might actually undo what you had done to close the threat.

Aug 31, 2009 9:47 AM in response to R C-R

R C-R wrote:
The warning message doesn't indicate anything one way or the other about this potential security exploit. In fact, if it still exists & you used some of the methods mentioned in the Mac OSX Hints article to close it, you would either still get a warning message (because you changed the file's metadata) or if not, the repair might actually undo what you had done to close the threat.


You're right. I didn't want to do anything to the file for repercussions down the road with other interdependencies of files. Its something thats just nagging at me and I'm sure we'll get a fix at some point (maybe 10.6.1) but that doesn't make me any less concerned.
Thanks

Aug 31, 2009 11:37 AM in response to Josue Rosado

This particular Repair Disk Permissions warning surfaces only after one installs the Remote Desktop software update from System Preferences/Software Update. In other words, if you install Snow Leopard, run Software Update and choose to NOT run the Remote Desktop update listed under "Show Details", then you do not get this particular Repair Disk Permissions error.

Seems like the warning is a non-event anyway, so this is not to say you should not run the Remote Desktop update listed under System Preferences/Software Update. Just providing some color on when I noticed this particular Repair Disk Permissions warning had surfaced.

Disk Utility - Permissions Repair

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.