Avoid sudo for user-local cask app groups #24011

brew doctor output

Your system is ready to brew.

Verification

• [x] I ran brew update twice and am still able to reproduce my issue.
• [x] I have supplied my brew doctor output above and it seems unrelated to my issue.
• [x] This issue's title and/or description do not reference a single formula e.g. brew install wget. If they do, open an issue at https://github.com/Homebrew/homebrew-core/issues/new/choose instead.
• [x] I did not use AI/LLM to create this issue, or I disclosed the tool and model used; I will answer maintainer questions myself without AI/LLM.

brew config output

HOMEBREW_VERSION: 7.0.2-19-g0cf81cb
ORIGIN: https://github.com/Homebrew/brew
HEAD: 0cf81cb0ad8e3a05e14e69168765b093dd5362e2
Last commit: 2 hours ago
Branch: main
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.7/bin/ruby
CPU: octa-core 64-bit arm_firestorm_icestorm
Clang: 21.0.0 build 2100
Git: 2.54.0 => /Applications/Xcode.app/Contents/Developer/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.7-arm64
CLT: 27.0.0.0.1788430756
Xcode: 27.0
Metal Toolchain: N/A
Rosetta 2: false

What were you trying to do (and why)?

brew install --cask sublime-text
brew install --cask whatsapp

What happened (include all command output)?

ls -la /Applications/ | grep -i sublime
drwxrwxr-x@  3 lucky  staff     96 May 21  2025 Sublime Text.app

ls -la /Applications/ | grep -i whatsapp
drwxrwxr-x@  3 lucky  admin     96 Sep 14 07:08 WhatsApp.app

What did you expect to happen?

ls -la /Applications/ | grep -i sublime
drwxr-xr-x@  3 lucky  staff     96 May 21  2025 Sublime Text.app

ls -la /Applications/ | grep -i whatsapp
drwxr-xr-x@  3 lucky  admin     96 Sep 14 07:08 WhatsApp.app

Step-by-step reproduction instructions (running brew commands)

Lets install `Sublime Text`


brew install --cask sublime-text


What we have


ls -la /Applications/ | grep -i sublime
drwxrwxr-x@  3 lucky  staff     96 May 21  2025 Sublime Text.app


As we can see `Sublime Text.app` has write `w` permission for group `staff`. The `staff` group is a group that every mac user will be in, not admin users will have this group too. To test this we can create new standard user (not admin) and check, lets name it `user1`.


groups user1
staff everyone localaccounts com.apple.sharepoint.group.2 com.apple.sharepoint.group.1 _lpoperator


What it can give to standard user?

Having writable group permission, every user that is in group `staff` can modify files inside `/Applications/Sublime Text.app/`. For example there is a executable file `/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl` that was linked to `/opt/homebrew/bin/subl` on install.


ls -la "/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl" 
-rwxrwxr-x@ 1 lucky  staff  8114144 May 21  2025 /Applications/Sublime Text.app/Contents/SharedSupport/bin/subl

ls -la /opt/homebrew/bin/subl 
lrwxr-xr-x  1 lucky  admin  62 Sep 16 16:38 /opt/homebrew/bin/subl -> /Applications/Sublime Text.app/Contents/SharedSupport/bin/subl


This binary `subl` is used to open `Sublime Text` from terminal pointing to some file or directory. We can try to change it to trick another user that will use it.

The good here is that modern macOS has `App Management` TCC permission, that has to protect `/Applications/` folder from such modifications. But it was not forever, and it can has it own problems.
Older macOS, before `App Management`, are affected by such modifications.

Mitigation is very simple, we have to remove group-writable permission from such app bundles.


chown -R go-w "/Applications/Sublime Text.app/"


There is one more app with similar problems that I found `WhatsApp`.


ls -la /Applications/ | grep -i whatsapp
drwxrwxr-x@  3 lucky  admin     96 Sep 14 07:08 WhatsApp.app


As you can see that `WhatsApp.app` has group `admin` instead of `staff`. It is much better, because only users in group `admin` can modify files inside it.

Why it happened?

`Sublime Text` is provisioned in `.zip` archive. `zip` archives may preserve permission bits of files. This upstream `zip` archive contains `775` permission bits on executable files. We can look it up like this:


curl -LO https://download.sublimetext.com/sublime_text_build_4200_mac.zip
zipinfo -l sublime_text_build_4200_mac.zip | grep rwxrwx

-rwxrwxr-x  2.1 unx 27716208 bX  9695722 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/sublime_text
-rwxrwxr-x  2.1 unx  1644160 bX   513382 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/libssl.1.1.dylib
-rwxrwxr-x  2.1 unx  2073264 bX   584390 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/update_installer
-rwxrwxr-x  2.1 unx 18935488 bX  6545360 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/plugin_host-3.3
-rwxrwxr-x  2.1 unx  2002448 bX   997890 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/libsqlite3.dylib
-rwxrwxr-x  2.1 unx  6930768 bX  2514782 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/libcrypto.1.1.dylib
-rwxrwxr-x  2.1 unx  3301584 bX   980121 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/crash_handler
-rwxrwxr-x  2.1 unx 23212048 bX  8250665 defN 25-May-21 08:39 Sublime Text.app/Contents/MacOS/plugin_host-3.8
-rwxrwxr-x  2.1 unx  8114144 bX  2625218 defN 25-May-21 08:39 Sublime Text.app/Contents/SharedSupport/bin/subl


Another question is why some apps has `user:staff` and the others `user:admin` on them?