System Folder Security

One aspect of computer security is the security of system files and folders — files and folders created by macOS to run your computer. The security is primarily controlled by the ownership and permissions of the files and folders that make up macOS and the applications and data on your computer.

Tunnelblick checks the security of itself and of the parts of macOS that it uses. That sometimes results in Tunnelblick complaining that a system folder is not secure, and refusing to connect a VPN. For example, you might see the following message after launching Tunnelblick:

Other problems with system folder security may only appear when you try to connect to a VPN.

Tunnelblick repairs the security of all of its own files and folders, but does not repair files and folders that it does not create, such as system folders.

How System Folders Become Insecure

System folders are secure when macOS is installed, and usually only become insecure as the result of a program installer behaving improperly. System folders could become insecure because of malware, but that is rare:

• In May 2014, Apple's iTunes 11.2 update caused each system boot to set insecure permissions on /Users and /Users/Shared. This was corrected in iTunes 11.2.1.
• There are reports that some older MacPorts installers makes /usr insecure, and that some SPSS and xQuartz installers and some player application installers for Vulkano streaming video make /Applications insecure.

Repairing System Folder Security

On OS X 10.11 and higher, some system folders are protected by "System Integrity Protection". However, other folders are not, and the "Disk Utility" does not include "Repair Disk Permissions". Apple sometimes provides instructions for repairing permissions on items in your home folder, but they frequently change and are very involved.

On OS X 10.6 - 10.10, the ownership and permissions of system folders can be repaired by using the "Disk Utility" application (/Applications/Utilities/Disk Utility). Select the boot volume in the list on the left, and click on "Repair Disk Permissions".

Disk Utility in OS X 10.5 and lower does not fix the ownership and permissions of system folders; they must be repaired manually using the Terminal application (/Applications/Utilities/Terminal).

Correct System Folder Ownership and Permissions

System folder ownership and permissions vary from folder to folder and from one version of macOS to another. The following table lists the standard (secure) ownership and permissions for selected system folders under various versions of OS X and macOS.

For OS X 10.11 and higher (including all versions of macOS):

For OS X 10.7 - 10.10: Use "Repair Disk Permissions" in Disk Utility

For OS X 10.6: Use "Repair Disk Permissions" in Disk Utility

For OS X 10.5:

For OS X 10.4: