Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically, it looks like a bunch of permissions had been changed from rwx------ to rwxrwxrwx (or pretty close to that); some of which involve Java for Mac, I think. I recently did an Archive & Install of OS X 10.5.

Does this indicate any tampering with my system or any malware infection?

Here are the repairs:

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/DVD.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/FRSettings.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/FRSources.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Movies.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Music.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Photos.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Podcasts.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/TV.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/PrivateFrameworks/BackRow.framework/Versions/A/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/CodeResources", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/CodeResources", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Info.plist", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Info.plist", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa", should be -rwxrwxr-x , they are -rwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS", should be drwxrwxr-x , they are drwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources/Localizable.strings", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources/Localizable.strings", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources", should be drwxrwxr-x , they are drwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/version.plist", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/version.plist", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents", should be drwxrwxr-x , they are drwxr-xr-x .

Permissions differ on "System/Library/Frameworks/AppKit.framework/Versions/C/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/Resources/DotMacSyncHelper.app/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/Resources/dotmacsyncui.app/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacLegacy.framework/Versions/A/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeDirectory", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeSignature", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/SystemProfiler/SPDisplaysReporter.spreporter/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
share|improve this question
up vote 3 down vote accepted

In my experience most of those are Apple's own patches not being very clean. You'll find that the symlinks are to a versioned tree for the plugin, much as with the frameworks that have Versions/A subtrees.

I'm not sure what to make of the should be ?--------- ones, though; that suggests garbage in BOM files. I'd use pkgutil --file-info to find the right package file and then examine it with other pkgutil commands and/or lsbom to see what's messed up, but you'd have to know something about Apple's package format to make sense of it.

share|improve this answer
    
Mac OS X: Disk Utility's Repair Disk Permissions messages that you can safely ignore: support.apple.com/kb/ts1448 – eL01 Oct 17 '11 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .