Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Basically, it looks like a bunch of permissions had been changed from rwx------ to rwxrwxrwx (or pretty close to that); some of which involve Java for Mac, I think. I recently did an Archive & Install of OS X 10.5.

Does this indicate any tampering with my system or any malware infection?

Here are the repairs:

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/DVD.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/FRSettings.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/FRSources.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Movies.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Music.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Photos.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/Podcasts.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Front Row.app/Contents/PlugIns/TV.frappliance/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/PrivateFrameworks/BackRow.framework/Versions/A/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Permissions differ on "System/Library/CoreServices/Menu Extras/RemoteDesktop.menu/Contents/CodeResources", should be -rw-r--r-- , they are lrwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/CodeResources", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/CodeResources", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Info.plist", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Info.plist", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS/JavaPluginCocoa", should be -rwxrwxr-x , they are -rwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/MacOS", should be drwxrwxr-x , they are drwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources/Localizable.strings", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources/Localizable.strings", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/Resources", should be drwxrwxr-x , they are drwxr-xr-x .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/version.plist", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents/version.plist", should be -rw-rw-r-- , they are -rw-r--r-- .

Group differs on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents", should be 80, group is 0.

Permissions differ on "Library/Internet Plug-Ins/JavaPluginCocoa.bundle/Contents", should be drwxrwxr-x , they are drwxr-xr-x .

Permissions differ on "System/Library/Frameworks/AppKit.framework/Versions/C/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/Resources/DotMacSyncHelper.app/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacSyncManager.framework/Versions/A/Resources/dotmacsyncui.app/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/PrivateFrameworks/DotMacLegacy.framework/Versions/A/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeDirectory", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/Extensions/IOUSBMassStorageClass.kext/Contents/_CodeSignature/CodeSignature", should be ?--------- , they are -rw-r--r-- .

Permissions differ on "System/Library/SystemProfiler/SPDisplaysReporter.spreporter/Contents/_CodeSignature/CodeResources", should be ?--------- , they are -rw-r--r-- .
share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

In my experience most of those are Apple's own patches not being very clean. You'll find that the symlinks are to a versioned tree for the plugin, much as with the frameworks that have Versions/A subtrees.

I'm not sure what to make of the should be ?--------- ones, though; that suggests garbage in BOM files. I'd use pkgutil --file-info to find the right package file and then examine it with other pkgutil commands and/or lsbom to see what's messed up, but you'd have to know something about Apple's package format to make sense of it.

share|improve this answer
    
Mac OS X: Disk Utility's Repair Disk Permissions messages that you can safely ignore: support.apple.com/kb/ts1448 –  eL01 Oct 17 '11 at 12:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.