Do all Mac OS X applications require Admin permissions to 'install'?

Question

I'm new to the whole Mac OS X operating system. I'm trying to learn and I've got myself a MacBook running Mac OS X 10.7.3.

I've created a test user that can not administrate so that I can test out permissions and I've found that I can not do anything in the Applications folder, which includes 'installing' applications (even those drag 'n' drop ones) and creating folders, without entering an Admin name and password.

However, I was under the impression that this wasn't the case and you only needed Admin permissions to write to somewhere like Preferences, so can somebody please clarify why it is asking for Admin when I try to drag 'n' drop applications into the Applications folder.

Answer 1

It depends on which Applications folder you mean. In fact, there can be two:

• /Applications

  This one is owned by root, and reserved for all applications that already come with OS X, like Mail.app, iTunes.app, etc. This root user is not an account you can log into with the graphical interface, but it's still accessible via Terminal.

  Since the folder requires your user to be in the admin Unix group, you can't just drag and drop files there unless you actually have an admin account (enabling this in System Preferences will add your user to this admin group). You can check the groups your user belongs to by typing id -Gn in a Terminal.

• /Users/your-user/Applications

  This one might not even exist in your system, but you can easily create it by opening Finder, clicking Go → Home, then File → New Folder, and naming it "Applications".

  As this folder resides in your home folder, it belongs to you only. So if you need to drag-and-drop an application to install it, put it there instead of /Applications. You don't need admin privileges here.

  

For more info about the OS X user groups, see: Difference between default groups on Mac OSX

Answer 2

The /Applications folder owned by the user root (owner = full access). Additionally every member of the group admin can read and write to it. Everyone else can only read but not write.

Your "user that can not administrate" is not in the group admin thus can only read that folder. When you try to write (the drag n drop installation) to that folder with your unprivileged user, the operating system does not just deny your request but asks you to authenticate with a user account hat has the necessary permissions (root or a member of the admin group).