Permissions are a fundamental protection for all files and folders in macOS. They’re not sufficient any more to keep your system files safe, though, so Apple introduced System Integrity Protection (SIP), which in Catalina is going to make its new system volume read-only. Permissions occasionally get in the way of your work, when you try to write to a file to which you have only read-only access. Where permissions can cause more significant problems is with preference settings.

Almost every app has its own preference settings, which are generally stored in the Preferences folder of your Home folder Library, ~/Library/Preferences, although general settings for all users are kept in /Library/Preferences. Most apps don’t access those Property List files directly, though: macOS provides a service cfprefsd which handles that for them. That’s why trying to make changes directly in a preferences file is often doomed to failure, as any changes you make are likely to be overwritten by cfprefsd, unless you make them using the command line in Terminal.

When an app or service gets locked out of its preferences, typically by their permissions being changed, that can have troubling side effects. Apple gives the following as examples:

• changes to preference settings, particularly those for System Preferences, do not ‘stick’;
• changes made to the Dock do not ‘stick’;
• you are asked to authenticate when trying to move or alter some folders in your Home folder;
• when trying to save, you are told that the file is locked, or that you don’t have permission;
• Preview, TextEdit, and App Store apps (which are sandboxed) may crash when opened;
• alerts warning that the startup disk has no more space available for app memory;
• Safari or SafariDAVClient use large amounts of resources (memory);
• your Mac runs very slowly;
• iTunes cannot sync a device;
• problems with Photos or iPhoto libraries, including inability to import into the library, or forgetting the library each time the app is opened.

Before Apple introduced SIP, a common way to fix other problems with the system was to repair permissions, which then meant your Mac setting correct permissions on its system files. With SIP, those should never get changed, and traditional repair of permissions ceased.

However, that long list of symptoms arising from changed permissions on your preference files now forms good grounds for a different type of permission repair: repairing permissions in your Home folder instead. Apple details this procedure for Sierra, High Sierra and Mojave in this note, which has recently been updated.

Since Apple has been recommending this, many users have found the new repair of permissions has solved otherwise intractable problems. But if your problem is not one of those listed, don’t have high expectations. Performed properly, it shouldn’t do any harm, as it only sets permissions to what they should be. The diagram below explains what, why, and how.

There are a couple of issues arising from this.

First, if you check permissions on ~/Library/Containers and ~/Library/Group Containers, you’ll always find many items which the current user can’t read or write. This is because these folders contain the sandboxes of apps distributed through the App Store, and other sandboxed apps. Those apps are restricted to their individual sandbox, so within each of those containers is a whole nest of links to other folders, including back to ~/Library itself. If you follow those links, as my utility PermissionScanner does, you will see many files in locations where you shouldn’t have write permissions, for instance. That is perfectly correct, and when repairing permissions any changes shouldn’t propagate out into those containers.

The other issue is also not mentioned by Apple: global preference settings and other key files which are kept in /Library. Incorrect permissions on preferences and other settings files there can also cause problems, such as stuck system keyboard settings which are used when logging in. Apple’s procedure doesn’t cover those, but you can use PermissionScanner to discover problems, then correct them in the Finder or at the command line.

I have two apps to help you repair permissions in this new way, and both have just been updated. They’re PermissionScanner, which checks and reports permissions but doesn’t try to fix them, and RepairHomePermissions, which walks you through Apple’s official fix and saves you having to use the command line.

Important: before using either of these in Mojave, you must add them to the Full Disk Access list in the Privacy tab in the Security & Privacy pane. If you don’t, they won’t be able to work properly.

PermissionScanner 1.4 is a general-purpose tool for checking permissions in the following locations:

• ~/Library/Preferences
• ~/Library/Preferences and individual preferences files in ~/Library/Containers, ~/Library/Group Containers and ~/Library more generally
• ~/Library as a whole
• the whole of your Home folder
• /Library/Preferences

In each folder, you can look for those files for which you don’t have read and write access, or read access. This allows you to correct any stray permissions manually when needed to fix problems.

Version 1.4 now checks it own code integrity, checks for updates automatically, has variable text size, and several other improvements. It’s fully compatible with macOS Sierra, High Sierra, and with Mojave, and is available from here: permscan14
from Downloads above, and from its Product Page.

RepairHomePermissions 1.2 is the tool to step through Apple’s recommended process for repairing permissions on your Home folder without using Terminal.

It starts by showing you how to set and propagate correct permissions in your Home folder. Once you have done that, click on the Repair Permissions button. This automatically works through the sequence of commands recommended by Apple to complete repairing permissions, saving you from having to use Terminal.

This version has code integrity checking and links to its Product Page, but doesn’t support automatic checking of updates (as those are infrequent), and is fully compatible with Sierra, High Sierra, and Mojave. It’s available from here: rhpb12
from Downloads above, and from its Product Page.