I used OSX's Disk Utility to Verify Disk Permissions and found a lot of system files had incorrect permissions. I'd say all of them were more open, allowing others to read or write. Also, many had the wrong group assigned. How does this happen?
My first guess would be: In most cases it's just lack of care from the programmer's side. Either because they are not thinking about it in the first place, or if something doesn't work, they might try to broaden permissions, even if it doesn't help. Consider applications that require you to enter the superuser password. What can they do with it, what will they do with it?
Well, let's see what we can find.
The official position:
Apple has a guide on Troubleshooting Permissions Issues, in which they say:
Here's another reason:
Some applications might deliberately want to modify permissions in order to be able to "do more" on the system:
In general, it's not a bad idea to repair permissions on a regular basis. Can't hurt. Especially if you experience sudden troubles without apparent reason. Or if you want to make safe you don't accidentally modify or delete essential system files.
Then again, what are "correct permissions" anyway? Just because the Repair Permissions dialog says they're wrong, do they actually harm anything? Is there an increased security risk from wrong permissions? Probably not in 95% of all cases. Correct permissions are defined by the applications that are installed using "Receipts", which you can find under
There are even some people who seem to be against repairing, but I'd not believe everything they say. There are a few reasons for incorrect permissions mentioned in the post:
So, any third party app can modify permissions and somehow incorrectly set them.
Basically what I said: Programming errors. In daily usage, a program might change file permissions. But imagine an installer or a program would actually set wrong permissions that cause serious trouble on the whole system – don't you think they'd fix this ASAP?
I haven't tried it, but go ahead, repair permissions, restart the Mac, then verify them. I'm sure something will need to be repaired again. Maybe people should not worry too much about it, unless they have a very specific security concern where they know which files are affected.
Home that shed some light on the subject.
Unsorted reading material:
Apple's PackageMaker has a reputation for not applying the permissions specified in its package design UI (see for example "Re: insufferable PackageMaker permissions defects", and Google for more). So if you trust Apple's developer software to work, your installer has a good chance of getting things wrong.
Older versions of PackageMaker expected the developer to build the entire directory hierarchy containing their application, and the installer would then apply the permissions that were on the Applications directory that the developer created. (For a how-to targeting an older version of PackageMaker that calls out precisely this problem, see WhiteBox's "PackageMaker How-To".) This was also easy to get wrong.
The correct permissions for various system files has also changed over time. For one minor example, see "Re: Permissions on Snow Leopard". This can render previously correct installers incorrect.