Pull Request Overview

Opened on September 17, 2026
Status Merged
Commit count 1 with first commit September 17, 2026

Total Delta

50 Total Diff Delta

Open Days

Open 1 weekdays

Test Delta

0 Diff Delta in Test Files

Breakdown by Phase

How long has this pull request spent in each phase of its lifecycle?

Fraction of total time	Business days	Phase
N/A	0.1 days	Issue creation to work beginning
	0.0 days	Authoring 1 commit before pull request opened for review
	0.0 days	Awaiting first review
	1.9 days	Merge to deploy (still awaiting deployment)

Total time for pull request 0.0 business days from first commit authored to merge
Still awaiting deployment

Avoid sudo for user-local cask app groups

Preserve existing groups outside system directories so personal app installs and upgrades do not need sudo to change groups.

Keep removing group and other write permissions for all apps and normalising group ownership for system installations.

Fixes https://github.com/Homebrew/brew/pull/24003#issuecomment-5705286140

[x] Have you followed our Contributing guidelines?

[x] Have you checked for other open Pull Requests for the same change?

[x] Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.

[x] Have you explained why you'd like these changes included, not just what they do?

[x] For bug fixes, have you given step-by-step brew commands to reproduce the bug?

[x] Have you written new tests (excluding integration tests)? Here's an example.

[x] Have you successfully run brew lgtm (style, typechecking and tests) locally?

[x] I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at xhigh effort, with local review and testing.

This work implements [Security] Homebrew preserves upstream group-writable permissions in application bundles installed into a shared system application directory (closed)

`brew doctor` output

Your system is ready to brew.

Verification

[x] I ran brew update twice and am still able to reproduce my issue.
[x] I have supplied my brew doctor output above and it seems unrelated to my issue.
[x] This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.
[x] I did not use AI/LLM to create this issue, or I disclosed the tool and model used; I will answer maintainer questions myself without AI/LLM.

`brew config` output

HOMEBREW_VERSION: 7.0.2-19-g0cf81cb
ORIGIN: https://github.com/Homebrew/brew
HEAD: 0cf81cb0ad8e3a05e14e69168765b093dd5362e2
Last commit: 2 hours ago
Branch: main
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.7/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 21.0.0 build 2100
Git: 2.54.0 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.7-arm64
CLT: 27.0.0.0.1788430756
Xcode: 27.0
Metal Toolchain: N/A
Rosetta 2: false

What were you trying to do (and why)?

brew install --cask sublime-text
brew install --cask whatsapp

What happened (include all command output)?

ls -la /Applications/ | grep -i sublime
drwxrwxr-x@  3 lucky  staff     96 May 21  2025 Sublime Text.app

ls -la /Applications/ | grep -i whatsapp
drwxrwxr-x@  3 lucky  admin     96 Sep 14 07:08 WhatsApp.app

What did you expect to happen?

ls -la /Applications/ | grep -i sublime
drwxr-xr-x@  3 lucky  staff     96 May 21  2025 Sublime Text.app

ls -la /Applications/ | grep -i whatsapp
drwxr-xr-x@  3 lucky  admin     96 Sep 14 07:08 WhatsApp.app

Step-by-step reproduction instructions (running `brew` commands)

Lets install `Sublime Text`


brew install --cask sublime-text


What we have


ls -la /Applications/ | grep -i sublime
drwxrwxr-x@  3 lucky  staff     96 May 21  2025 Sublime Text.app


As we can see `Sublime Text.app` has write `w` permission for group `staff`. The `staff` group is a group that every mac user will be in, not admin users will have this group too. To test this we can create new standard user (not admin) and check, lets name it `user1`.


groups user1
staff everyone localaccounts com.apple.sharepoint.group.2 com.apple.sharepoint.group.1 _lpoperator


What it can give to standard user?

Having writable group permission, every user that is in group `staff` can modify files inside `/Applications/Sublime Text.app/`. For example there is a executable file `/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl` that was linked to `/opt/homebrew/bin/subl` on install.


ls -la "/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl" 
-rwxrwxr-x@ 1 lucky  staff  8114144 May 21  2025 /Applications/Sublime Text.app/Contents/SharedSupport/bin/subl

ls -la /opt/homebrew/bin/subl 
lrwxr-xr-x  1 lucky  admin  62 Sep 16 16:38 /opt/homebrew/bin/subl -> /Applications/Sublime Text.app/Contents/SharedSupport/bin/subl


This binary `subl` is used to open `Sublime Text` from terminal pointing to some file or directory. We can try to change it to trick another user that will use it.

The good here is that modern macOS has `App Management` TCC permission, that has to protect `/Applications/` folder from such modifications. But it was not forever, and it can has it own problems.
Older macOS, before `App Management`, are affected by such modifications.

Mitigation is very simple, we have to remove group-writable permission from such app bundles.


chown -R go-w "/Applications/Sublime Text.app/"


There is one more app with similar problems that I found `WhatsApp`.


ls -la /Applications/ | grep -i whatsapp
drwxrwxr-x@  3 lucky  admin     96 Sep 14 07:08 WhatsApp.app


As you can see that `WhatsApp.app` has group `admin` instead of `staff`. It is much better, because only users in group `admin` can modify files inside it.

Why it happened?

`Sublime Text` is provisioned in `.zip` archive. `zip` archives may preserve permission bits of files. This upstream `zip` archive contains `775` permission bits on executable files. We can look it up like this:


curl -LO https://download.sublimetext.com/sublime_text_build_4200_mac.zip
zipinfo -l sublime_text_build_4200_mac.zip | grep rwxrwx

-rwxrwxr-x  2.1 unx 27716208 bX  9695722 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/sublime_text
-rwxrwxr-x  2.1 unx  1644160 bX   513382 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/libssl.1.1.dylib
-rwxrwxr-x  2.1 unx  2073264 bX   584390 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/update_installer
-rwxrwxr-x  2.1 unx 18935488 bX  6545360 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/plugin_host-3.3
-rwxrwxr-x  2.1 unx  2002448 bX   997890 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/libsqlite3.dylib
-rwxrwxr-x  2.1 unx  6930768 bX  2514782 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/libcrypto.1.1.dylib
-rwxrwxr-x  2.1 unx  3301584 bX   980121 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/crash_handler
-rwxrwxr-x  2.1 unx 23212048 bX  8250665 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/plugin_host-3.8
-rwxrwxr-x  2.1 unx  8114144 bX  2625218 defN 25-May-21 08:39 Sublime Text.app/Contents/SharedSupport/bin/subl


Another question is why some apps has `user:staff` and the others `user:admin` on them?

PR was closed without comments.

Avoid sudo for user-local cask app groups #24011