Permission problems in Monterey 12.5

[amarmot]

I have a weird one. After upgrading from Big Sur to to Monterey 12.5, I can no longer access user folders on an external drive that has custom ACLs. Specifically, if I get info on the relevant external folder X it shows custom permissions as "username (Me): read & write, everyone: No access". Yet the folder has a red minus sign and if I try to open I get an error "The folder “X” can’t be opened because you don’t have permission to see its contents." Yet get info clearly states that I do! If I log back into Big Sur, I don't have this problem.

Machine details: Mac Pro 5,1 running Monterey 12.5 under Open Core.

 

[amarmot]

Self reported solution in case anyone stumbles on this thread. The problem was that I installed the new OS with a single admin user, and then later used migration assistant to transfer the user accounts. This apparently generates new users with the same names but different User IDs (and thus wrong permissions). This problem does not occur if you transfer the user accounts at the time of install.

I am inclined to declare this as a bug of migration assistant, which should anticipate the possibility of a prior set of ACLs on external drives.

 

[Mr Todhunter]

Self reported solution in case anyone stumbles on this thread. The problem was that I installed the new OS with a single admin user, and then later used migration assistant to transfer the user accounts. This apparently generates new users with the same names but different User IDs (and thus wrong permissions). This problem does not occur if you transfer the user accounts at the time of install.

I am inclined to declare this as a bug of migration assistant, which should anticipate the possibility of a prior set of ACLs on external drives.

Very interesting. Thank you!

 

[Fishrrman]

"The problem was that I installed the new OS with a single admin user, and then later used migration assistant to transfer the user accounts."

"I am inclined to declare this as a bug of migration assistant, which should anticipate the possibility of a prior set of ACLs on external drives."

It's the way setup assistant/migration assistant is DESIGNED to work.

This is why, whenever a user asks about migration from an old Mac to a new one, I advise the user to NOT POWER UP THE NEW MAC until after connecting a backup from the old one.

Because... setup assistant will migrate over the existing accounts (with permissions) from the OLD Mac, WITHOUT creating a new, never-before-used NEW account.

Even though the "new" account may have the same name and password, if one uses migration assistant (DIFFERENT FROM setup assistant), MA will leave the "new" account untouched and migrate over all the OLD accounts (even the one with the same name/password).

Same with upgrades, as you found out.
Put on a fresh install, new username/password, and files from the OLD username/password will have permissions problems...

 

[lie2me]

Wished I had read this before migrating over to a new M1 mac mini using a backup drive.
Having similar permission problems.

 

[Weaselboy]

Wished I had read this before migrating over to a new M1 mac mini using a backup drive.
Having similar permission problems.

Here is a workaround. Make yet another account on the Mini then from that account delete the one that you migrated in. That should leave you with just one account that has a user ID of 502 or higher. Your old account on the backup should be user ID 501. So from the new 502 account run Migration Assist and that will bring the original 501 account back in with correct permissions.

You are having the problem because you likely made an account that was 501 then tried to import another 501 account from the backup.

 

[lie2me]

I remember the good old days when we only needed to run Disk Utility to correct permissions.
After weeks of use, I am just now finding out about this because I cannot upgrade the applications in the applications folder. I can install applications just fine onto the desktop outside of the applications folder. The sharing permissions of the applications folder looks just fine too. I am an administrator and cannot fix permissions problems.

 

[lie2me]

Here is a workaround. Make yet another account on the Mini then from that account delete the one that you migrated in. That should leave you with just one account that has a user ID of 502 or higher. Your old account on the backup should be user ID 501. So from the new 502 account run Migration Assist and that will bring the original 501 account back in with correct permissions.

You are having the problem because you likely made an account that was 501 then tried to import another 501 account from the backup.

Thanks. I will look into this.

 

[Fishrrman]

I have done what Weaselboy suggests in reply 6 above, several times.
It works.

In fact, with a new Mac, I deliberately create one or two additional "blank" administrative accounts to occupy the "User ID 502" and "User ID 503" spaces.

Now I have "alternate accounts" that I can log into for temporary or emergency use, if needed.

 

[lie2me]

Here is a workaround. Make yet another account on the Mini then from that account delete the one that you migrated in. That should leave you with just one account that has a user ID of 502 or higher. Your old account on the backup should be user ID 501. So from the new 502 account run Migration Assist and that will bring the original 501 account back in with correct permissions.

You are having the problem because you likely made an account that was 501 then tried to import another 501 account from the backup.

Ok. I can create new accounts but I cannot even log into them. Something is really messed up worse than I thought. I tried running in recovery mode and using the terminal command repairHomePermissions. That did not help. I tried reinstalling Monterey in recovery mode. That did not help. I tried running Disk Utility in recovery mode, that did not help. It looks like I am going to have to start from scratch. I have been using a Time Machine backup and now wonder if that is an issue. I will make a super duper backup tomorrow and do a clean install. All I need to migrate is the data but for some reason I did not see options with the migration assistant. Maybe that is only with the setup assistant. I ran an Etre-Pro report so I can study it to see what software might be an issue. I can't help but wonder if Monterey 12.5.1 did something strange too.

 

[lie2me]

I likely had two accounts that I created initially, assuming that I wanted both to be active on the new M1 Mac Mini. My main user account and an administration account. Double whammy. It seems that SIP is keeping me from administering the Applications folder as I would like with either account. User data seems like it is accessible but not the Shared User Application folder. Since I don't have access to the System side of things, that might explain why I cannot create a valid new user and login. That might explain why I cannot save the changes of permissions on folders because I lack permission. I guess I am just limping along with the User Applications. I am now avoiding any updates to Applications for Apple Silicon because it will not likely be saved. I need Superduper to work. Funny, SIP did allow me to change the check box to allow Superduper to work under Rossetta until I can purchase the new Apple Silicon version.

 

[Fishrrman]

lie2me wrote:
"I have been using a Time Machine backup and now wonder if that is an issue. I will make a super duper backup tomorrow and do a clean install."

My recommendations:
1. Use SuperDuper to do a complete backup (DO NOT USE time machine)
2. Disconnect backup (for now)
3. Boot the m1 Mini to recovery.
4. Open Startup Security (if you can, messed-up permissions may interfere) and DISABLE EVERYTHING (select "the lowest button" for each option).

Now I think you could go one of two ways:
FIRST WAY (faster)
a. Open system preferences
b. Go to system preferences in menu bar and select "erase all content and settings". Then enter your password.
c. This will invoke something called the "erase assistant".
d. Follow through and erase everything on the "Macintosh HD Data" volume. THIS DOES NOT TOUCH the "Macintosh HD" volume where the OS is kept.
e. When erase assistant is done, I believe you will see the initial setup screen "choose your language".
f. AT THIS POINT, RE-CONNECT THE SUPERDUPER BACKUP
g. start clicking through the setup
h. When setup assistant asks if you wish to migrate data from another drive, YES, you want to do this
i. Give setup assistant time to "digest everything" on the SD cloned backup
j. I would just "accept all the defaults" and try a migration that way.
k. When it's done, log in and "look around".
DO THINGS WORK THIS WAY?

If they DON'T...
SECOND WAY:
You'll need to do a complete erase and OS re-install on the internal drive.
Again, you need to boot to recovery to do this.
I've not yet tried it, so not sure of all the steps, but I believe you'll first need to go to disk utility.
In disk utility, YOU MUST go to the "view" menu and choose "show all devices".
Once you do this, click on "the topmost line" on the left that represents the physical drive and erase it to APFS, GUID partition format.
Then open the OS installer and run that...

FINALLY ...
I suggest that you refrain from fooling with permissions in the future...
Good luck.

 

[Slartibartfast42]

Similar issue here. However with the following differences:

1. I upgraded to Monterey but didn't migrate accounts/move to new computer. Just a simple OS upgrade.
2. On external APFS SSD drive which I used before and since, I wanted to make it so only my account (a non-Admin one) could access 2 folders. I have a separate Admin account.
3. On external drive I have 2 folders at the top level. Both set to me: R&W, everyone: No access.
4. BUT - one folder with the above permissions lets EVERY user access it, and the other folder has a 'No entry' sign and NOBODY can access it. - not even my account. Not consistent!!!

Would wiping the computer and re-installing the OS & then data solve this?
I'm actually inclined not to bother as I've had my fingers burnt with permissions before, but I thought the Apple front-end to the permissions would be understandable and consistent!