All my browsers crash constantly! Need help to keep my sanity

The security problem is that with /usr/local owned by "$(whoami)" that leaves all third party software open to be modified by the owner. So a malware developer could easily substitute a fake component of ClamXav or other 3rd party software (including brew) for malicious purposes.

Since my standard user, from which I normally run, doesn't own anything there, just my admin user, and only for the items I already mentioned above (which requires elevated privileges), do I run the same, or at least, any risk by leaving it set the way it currently is?

And since brew and smartmontools are already installed, what's to prevent me from changing the ownership, recursively, if needed, for those admin account items to root? Wouldn't that prevent anyone from getting in there with malware? Or would doing so mess up the current installation of brew or smartmontools? Or, perhaps much better, what about locking everything up currently owned by the admin account in /usr/local/ with sudo chflags uchg, and just leaving the admin account as the owner? Or just lock up the entire /usr/local/ and unlock when needed?

Btw, probably used brew only this one time just to get smartmontools, so don't think I'll be updating it.

Apologies to Seanothon for continuing this off topic disscusion.

Update: I've looked more closely at the permissions for various items in /iusr/local. It's a mix. TextWrangler there has my standard user as owner; Brew and smartmontools show my admin user as owner; everything else, including the enclosing directory /usr/local, show root:admin. I doubt that any bad actor is going to want to bother with the very limited target of TextWrangler users. And since I'm running standard, I don't see how, without getting elevated privileges, anything is going to be able to write to the admin user there. In fact, when I try to update brew, I get an error that brew can't write to Cellar, which is owned by my admin user.

In short, I think I will leave things as they are, unless you think that would be a mistake.

WZZZ wrote:

everything else, including the enclosing directory /usr/local, show root:admin.

Which is close to what it should be (root:wheel). As I said, the only issue arrises when Brew needs to update. They say they need /usr/local to be owned by <whoami> and fails when it's not. If you follow their troubleshooting instructions, they tell you to change everything in /usr/local, recursively to be owned by <whoami>. That breaks ClamXav and perhaps other third party software. It also opens then entire directory for an installation to take place without asking for an admin password. I don't see any reason to have the chown command run recursively at all, but even changing /usr/local is a security risk. That's why the ClamXav scan engine installer will change both /usr and /usr/local back to factory settings 0755 (rwxr-xr-x) root:wheel.

when I try to update brew, I get an error that brew can't write to Cellar, which is owned by my admin user.

Exactly the problem. Brew wants you to change it to be owned by your current (standard) user in order to update it. That's fine, but they should not be saying in their troubleshooting instructions to change the entire /usr/local directory.

I think your permissions are just fine the way they are now. You might want to see if changing only Celler to be owned by <whoami> will allow updates by your standard user without having to change /usr and/or /usr/local.

Thanks for reminding me to update my TextWrangler Command Line Tools.

Not sure where I was seeing root:admin for /usr/local. It is root:wheel. The several TextWrangler items are located inside one of these, and then maybe inside a sub-directory. Forget now which one. Not worried about updating brew right now. Will wait until I need to install something that may need a later version. Thanks for the help with this.

Also some interesting information on user "24561" owner of lib: https://github.com/nodejs/node-v0.x-archive/issues/2427

http://superuser.com/questions/444567/what-is-user-owner-24561

ls -la /usr/local

total 96

drwxr-xr-x 21 root wheel 714 Feb 18 14:43 .

drwxr-xr-x@ 11 root wheel 374 Oct 4 2013 ..

-rw-r--r-- 1 admin acct admin 428 Aug 4 2015 .gitignore

-rw-r--r-- 1 admin acct admin 296 Aug 4 2015 .yardopts

-rw-r--r-- 1 admin acct admin 3161 Aug 4 2015 CODEOFCONDUCT.md

-rw-r--r-- 1 admin acct admin 1103 Aug 4 2015 CONTRIBUTING.md

drwxr-xr-x 3 admin acct admin 102 Sep 10 13:48 Cellar

-rw-r--r-- 1 admin acct admin 1241 Aug 4 2015 LICENSE.txt

drwxr-xr-x 10 admin acct admin 340 Aug 4 2015 Library

-rw-r--r-- 1 admin acct admin 2319 Aug 4 2015 README.md

-rw-r--r-- 1 admin acct admin 23801 Aug 4 2015 SUPPORTERS.md

drwxr-xr-x 15 root wheel 510 Feb 11 15:13 bin

drwxr-xr-x 14 root wheel 476 Feb 18 14:43 clamXav

drwxr-xr-x 5 admin acct admin 170 Aug 4 2015 etc

drwxrwxr-x 3 root admin 102 Jul 9 2015 include

drwxr-xr-x 20 root wheel 680 Jun 29 2014 knockknock-master

drwxrwxr-x 4 24561 admin 136 Jul 9 2015 lib

drwxr-xr-x 3 admin acct admin 102 Aug 4 2015 opt

drwxrwxr-x 3 root admin 102 Oct 4 2013 sbin

drwxr-xr-x 6 root wheel 204 Sep 7 11:19 share

drwxr-xr-x 4 admin acct admin 136 Aug 4 2015 var

@ Seanothon: if you're still around, think we're all done now. Please let us know how you are making out.