Skip to content

Conversation

@liuxy600
Copy link

  • Have you followed the guidelines in our Contributing document?
  • Have you checked to ensure there aren't other open Pull Requests for the same change?
  • Have you added an explanation of what your changes do and why you'd like us to include them?
  • Have you written new tests for your changes? Here's an example.
  • Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

Follow-up to Homebrew discussion: https://github.com/orgs/Homebrew/discussions/6617.

This PR updates the newly added FAQ section "What is the default ownership and permissions used by Homebrew" (introduced in #20946) to avoid two misleading statements:

  • Clarifies that Homebrew-installed binaries run with the invoking user's privileges. Removes and adjusts wording implying binaries "inherit" admin permissions or can read/modify system locations by default.
  • Fixes wording that discourages a dedicated Homebrew user account, aligning it with existing FAQ guidance that recommends a dedicated account for multi-user environments (see "Why does Homebrew say sudo is bad?": https://docs.brew.sh/FAQ#why-does-homebrew-say-sudo-is-bad).

* Align multi-user guidance with recommended dedicated brew account
* Correct runtime privileges: no implicit admin rights
Copy link
Member

@MikeMcQuaid MikeMcQuaid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good except recommendation change.

Ownership on Linux, all subdirectories and files default to the current user and the user group that executed the installation.

Permissions for all subdirectories and files use `0755 (u=rwx,g=rx,o=rx)` on both macOS and Linux, permitting only the current user to replace binaries (avoidance of malicious changes) while allowing all users to execute binaries. Note: Although, Homebrew is single-user design and it is not advised to execute using a separate user account specifically for use of Homebrew.
By default, permissions for Homebrew-managed directories and files are `0755 (u=rwx,g=rx,o=rx)` on both macOS and Linux. This means that only the owning user (typically the installing user) can modify or replace files within the Homebrew prefix, while all users are allowed to read and execute installed binaries. On multi-user systems, Homebrew recommends managing the installation from a dedicated user account rather than running `brew` as multiple users.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
By default, permissions for Homebrew-managed directories and files are `0755 (u=rwx,g=rx,o=rx)` on both macOS and Linux. This means that only the owning user (typically the installing user) can modify or replace files within the Homebrew prefix, while all users are allowed to read and execute installed binaries. On multi-user systems, Homebrew recommends managing the installation from a dedicated user account rather than running `brew` as multiple users.
By default, permissions for Homebrew-managed directories and files are `0755 (u=rwx,g=rx,o=rx)` on both macOS and Linux. This means that only the owning user (typically the installing user) can modify or replace files within the Homebrew prefix, while all users are allowed to read and execute installed binaries. On multi-user systems, Homebrew does not recommend using a dedicated user account specifically for Homebrew.

Keep this text as-is, you're changing the recommendation to be the opposite.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants