El Capitan Permissions Set Back

[majorsl]

Not sure if anyone has seen this, but I run Homebrew on El Capitan w/OS X Server, upgraded from Yosemite.

As expected, brew doctor says I don't own:

/usr/local/bin
/usr/local/bin/share
/usr/local/share/man
/usr/local/share/man/man1

Fair enough, I set them as they should be and brew works as expected. For a time...

However, they keep getting reset back such that I'm still the owner but brew will fail, a run of brew doctor confirms I don't own as well as a permission denied with a simple 'touch test.txt'

Reset back, works as expected for awhile, rinse, repeat 3 times now.

I'm...confused.

[DomT4]

Is Sophos Anti-Virus installed?

[liul85]

https://github.com/Homebrew/homebrew/blob/master/share/doc/homebrew/El_Capitan_and_Homebrew.md

[majorsl]

@liul85 I know, please re-read my post carefully.

@DomT4 why yes! Yes it is, please tell me more!

Edit: Ah... https://community.sophos.com/products/free-antivirus-tools-for-desktops/f/17/t/10029

[DomT4]

@majorsl Aye, you found the right link. They've agreed to change it, so hopefully within a few weeks this problem will be resolved.

We're aware of the SIP situation but the lack of clarity/documentation/experience of how SIP is going to change things over time makes it rash to rush to a decision that would have such a wide & invasive impact, IMO. Homebrew will happily work outside of /usr/local if people prefer to install it elsewhere.

[majorsl]

I agree, I'll wait and see before thinking about moving my 'brew stuff out of /usr/local. Admittedly, a small part of me wants to do it just to be safe from Apple adding another wall to their garden.

[DomT4]

The only thing you lose by moving is usage of 665 of the 2231 binary packages (bottles) we supply.

Those 665 bottles remember which prefix they were built for and break if you stick them somewhere else, but brew handles that by triggering an automatic from-source installation if the bottle isn't usable.

The really nice thing about being built off a git backend is anyone can go to any prefix on the system they own and can write into and do a git clone https://github.com/Homebrew/homebrew.git and that's about as complicated as initial installation gets.

[DomT4]

Closing here as question answered, but let us know if anything else pops up. May add a brew doctor warning about Sophos potentially resetting permissions so it's easier for people to track.