Repairing Permissions and ARDAgent

[nagromme]

Here's the latest permissions repair results:

Repairing permissions for “Leidervault”
Warning: SUID file "usr/libexec/load_hdi" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/DiskManagement.framework/Versions/A/Resources/DiskManagementTool" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/Locum" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/Install.framework/Versions/A/Resources/runner" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/Admin.framework/Versions/A/Resources/readconfig" has been modified and will not be repaired.
Warning: SUID file "System/Library/PrivateFrameworks/Admin.framework/Versions/A/Resources/writeconfig" has been modified and will not be repaired.
Warning: SUID file "usr/libexec/authopen" has been modified and will not be repaired.
Warning: SUID file "System/Library/CoreServices/Finder.app/Contents/Resources/OwnerGroupTool" has been modified and will not be repaired.
Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.

I see those too. According to Apple, they are harmless (and I expect the messages will be removed in future):
http://docs.info.apple.com/article.html?artnum=306925

Meanwhile, if you want (most of) those harmless messages to go away, you can download and re-install 10.5.1, supposedly:
http://discussions.apple.com/thread.jspa?threadID=1283962&tstart=15


slick21: your problems may be unrelated to this permissions quirk. (In fact it sounds like your two machines may have two different problems. Maybe a bad Word install on one and a bad Photoshop install on the other? Maybe some third-party util is running that is not Leopard-friendly?) Good luck!

 

[IT2]

Leopard Permissions Repair Fix

What worked for me was what I found on the Apple Support site.

Tried it on my home MacBook Pro, (which at first was getting the SUD and then after the upgrade to 10.5.2 the ACL list) and it worked.

Go to Apple's downloads page, and get the Combo 10.5.2 update.
http://www.apple.com/downloads/macosx/apple/macosx_updates/macosx1052comboupdate.html

Just load it right over the top of the previous 10.5.2 and it works. Did for me anyway.

BUT you STILL have to wait longer for the repair permissions to complete. So I just hit the repair button and go do something else I need to do. When I return. No garbage. Just repair is complete shows.

Hope it works for all of you.

Reminds me of the complaint that when people loaded Leopard they crashed with a Blue Screen. No, you just have to load it and when it reboots or whatever, LEAVE IT ALONE. It has NOT crashed. All computers I have updated to 10.5.2 just hung in the blue for awhile then completed as usual to the log in window.
And if you originally installed Leopard over Tiger you should have use "Archive and Install" for best results. Using "Update" only....I've witnessed problems with that method.

PATIENCE GRASSHOPPERS!

 

[MacDaddi]

Disk Permissions

Thanx

 

[MacDaddi]

Disk Permissions

I thought Disk Utility Didn't repair a disk that was journaled, but if you remove the journaling with something like Cocktail or Tech Tool Pro then it would actually repair the permissions. Is this true? Also if you start up in super-user mode (command + S) and type in the command line " fsck -fy " then would actually be repairing the permisions on a journaled disk. Anyone know the truth?

 

[nagromme]

Disk Repair and Permissions Repair do work on journaled disks (which is how Mac hard disks are by default).

 

[IT2]

I would not recommend removing the Journaling. That's been standard drive formatting for awhile in OSX, that would be risky. We haven't had any problems.

BTW I just fixed all those errors on another Leopard machine by downloading that combo I suggested so I think I'm completely convinced that doing what I posted earlier does work. No errors of any kind whatsoever were listed in the repair.

However, it still takes an abnormally (compared to Tiger) LONG, LONG time to repair them. I make sure I do it when I have something else to do so I don't get impatient. The blue progress bar seems to stall forever about 1/4 of the way through, then after the halfway point it moves along at a normal speed again.

 

[j kilpatrick]

MacOS/ARDAgent" has been modified.....

I got the blessed "Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired." too

irritating... I turned off apple file sharing as I didn't have remote desktop enabled

I have a unibody MBP 17" snow leopard installed.

any new info guys?

JK

 

[eovnu87435ds]

I ran into this problem today on my macbook 13" unibody, running snow leopard. What I did was navigated to the folder, got info on the file, opened the Sharing and Permissions flippy triangle, unlocked it, and set everything to read and write. when I went back to disk utility, i did a verify and repair, and it was like "hey, this is wrong, im going to fix it." and then it did.

If you are real sharp with your mac, and know how to change permissions via terminal, the proper permissions for that file are: -rwsr-xr-x

 

[IT2]

I got the blessed "Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired." too

irritating... I turned off apple file sharing as I didn't have remote desktop enabled

I have a unibody MBP 17" snow leopard installed.

any new info guys?

JK

Apple's most recent reply to this (as of Aug. 10 2009) was found here:
http://support.apple.com/kb/TS1448?viewlocale=en_US

At bottom the "Resolution" is stated:
_______
You can safely ignore these messages. You can also usually ignore any "ACL found but not expected..." message. These messages can occur if you change permissions on a file or directory. These messages are accurate but are generally not a cause for concern.
_______

It's annoying though, esp. for anal people who like to see everything fixed. I had hope that it would be a thing of the past in Snow Leopard.

 

[Slimdude20]

good tip eovnu. fixes the problem easily if you follow what he says.

 

[nigameash]

thanks for the tip man! did it and it got fixed dunno why i got this error though, my mac came with snow leopard factory pre-installed!

 

[Parsa]

Fixes problem with ARDAgent

The solution from eovnu87435ds works. Thanks.

I also had a SUID problem with Locum
(System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/Locum)
This solution worked there too.

 

[LordMelkor]

I ran into this problem today on my macbook 13" unibody, running snow leopard. What I did was navigated to the folder, got info on the file, opened the Sharing and Permissions flippy triangle, unlocked it, and set everything to read and write. when I went back to disk utility, i did a verify and repair, and it was like "hey, this is wrong, im going to fix it." and then it did.

If you are real sharp with your mac, and know how to change permissions via terminal, the proper permissions for that file are: -rwsr-xr-x

I got the error, so I navigated to the file in terminal, and checked the permissions... however it currently has the permissions that you list as the "proper" permissions...

-rwsr-xr-x 1 root wheel 2528064 Aug 10 18:04 ARDAgent

 

[IT2]

I have found in Snow Leopard, the blue progress bar moves along much faster than in Leopard. Though even in Leopard it never stalled to the point of not finishing. It always finished, even if it was 20 minutes, though admittedly, it did not repair much.

Snow Leopard repairs a lot more, thought there are still one, two or 3 it doesn't repair. It varies with individual computers. I hate seeing things not repaired, that bugs me as I am quite anal retentive about fixing everything.

I like a clean end to the repair permissions, but have learned to just not sweat it for now, and I try to ignore it as Apple has said. Guess you just have to trust "The Mothership" once in awhile.

 

[Nighthawk4]

Not sure if this helps but it seems Apple are aware of the issue. See here - http://support.apple.com/kb/TS1448?viewlocale=en_US


The only problem I have with this is that it is preventing SuperDuper from backing up my new installation, although Time Machine is working

 

[Editorguy]

SUID: ARDAgent

I started having the same issue today after doing a repair disk permissions and an IT guy at my company told me to do this:

The term SUID refers to "Super User ID". It signifies that a program tagged with this privilege, will execute as the root (the super-user or the system manager) account on your machine. It gives said program virtually all access to the machine and all its software. This can be a good thing, if the program is friendly, or a bad thing, if it is malware.

In the case of ARDAgent, it is the Apple Remote Desktop Agent which allows a user on the network to remote-control another Mac. At one point in time, there was a vulnerability on the Macs which might allow a 3rd party to install undesirable software on your machine.

The best thing to do, is to deactivate this agent altogether. You can do this, by executing the following command through the Terminal window:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off

 

[ckeilah]

The term SUID refers to

Not quite. SUID is a unix acronym which stands for Set User IDentification, not *necessarily* root. Read up on it if you like: http://en.wikipedia.org/wiki/Setuid

Also, your "solution" of disabling the ARDA service is a non-starter for those who need to have Apple Remote Desktop operational, which would ostensibly be most people in a computing environment being maintained by an IT department, and probably ALL of us who need remote help from Apple. ;-)

IMHO, there should be a way to get a verified good copy of this package directly from Apple, have it installed with the correct permissions that will pass Repair Disk Permissions with flying colors. Ignoring these kinds of messages is leading us down the path to MicroS**t levels of insecurity! Crying "paranoia" to those who show concern is compounding the potential for insecurity. Apple has a responsibility to resolve this.

Here's an example of how this could be VERY bad: You accidentally visit some nefarious web site by clicking on the wrong place in a google page with "ads" (probably you were clicking Save in a TextEdit document and Apple changed focus to S*fari which caused you to click on IloveRussianPorno - please Apple STOP changing focus on us!). The nefarious web site uses Javascript to install a new ARDA package which includes a trojan horse, giving all of Russia and China FULL REMOTE ACCESS to your computer. Some Bad Guy then watches your computer remotely, and when he notices some idle time he takes full control of your Mac, downloads your personal data (which, of course, you haven't encrypted and closed down because this is your "secure Macintosh"). Then he goes on a spending spree with your credit cards and checking accounts, and then he reformats your hard drive... or worse, leaves no trace and comes back occasionally to get more of your personal data.

 

[fase15]

how to write this permission on the terminal (step by step)

I ran into this problem today on my macbook 13" unibody, running snow leopard. What I did was navigated to the folder, got info on the file, opened the Sharing and Permissions flippy triangle, unlocked it, and set everything to read and write. when I went back to disk utility, i did a verify and repair, and it was like "hey, this is wrong, im going to fix it." and then it did.

If you are real sharp with your mac, and know how to change permissions via terminal, the proper permissions for that file are: -rwsr-xr-x

i got the path and unlocked the permissions but dont know how to do the next step on terminal ...please can u tell me how to change this permission on terminal step by step ,please help me my comp. is getting struck aa lot and had the same message ,i tried reinstalling osx ,i repaired permissions but still having trouble

 

[Hal Itosis]

i got the path and unlocked the permissions but dont know how to do the next step on terminal ...please can u tell me how to change this permission on terminal step by step ,please help me my comp. is getting struck aa lot and had the same message ,i tried reinstalling osx ,i repaired permissions but still having trouble

Chances are, every single post in this thread is unnecessary... because Disk Utility is referencing outdated information, and simply doesn't realize that a Software Update has modified that file. [i.e., the message itself is wrong, and is due a bug which Apple needs to fix.]

The safe, proper first step (if one wishes to double check on the status) is to simply *list* the item, and compare that with a known good listing.

Here is my (good) Mac OS X 10.6.5 listing:

[COLOR="Blue"]ls -l /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent[/COLOR]
-rwsr-xr-x  1 root  wheel  1829056 Feb 11  2010 /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent

[if you don't have 10.6.x then yours may look different... i can post a good 10.5 file later if needed.]

 

[rayeza]

heres mine.. dont really know what to make of it.. mac is running fine :/

Permissions differ on "System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Classes/jconsole.jar", should be lrwxr-xr-x , they are lrw-r--r-- .
User differs on "System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/lib", should be 0, user is 95.
User differs on "System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Libraries", should be 0, user is 95.
Permissions differ on "System/Library/Java/Support/Deploy.bundle/Contents/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/deploy.jar", should be lrwxr-xr-x , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Classes/jconsole.jar", should be -rw-r--r-- , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/Contents/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/deploy.jar", should be lrwxr-xr-x , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/deploy.jar", should be -rw-r--r-- , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/libdeploy.jnilib", should be -rwxr-xr-x , they are lrwxr-xr-x .
Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.

i repair them and it says all has been successful apart from the ARDAgent.. i then run the permission verify again and they all reappear... i love apple but this **** jus pisses me offfff.

 

[pliez]

HD Upgrade

I have the same warning message- Warning:SUID file "system/library/coreservices/remotemanagement......has been modified and will not be repaired" I use Snow Leopard.
I am about to install my new momentus xt hd using carbon copy cloner but wondered if this error will transfer. I know a clean install is always ideal but is this going to be a problem?
does this error message actually matter?
I get the same result when trying to repair disk permissions as rayeza

Pliez

 

[racerxnyc]

This is what I get...Snow Leapord 10.6.6

Permissions differ on "System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Classes/jconsole.jar", should be lrwxr-xr-x , they are lrw-r--r-- .
User differs on "System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/lib", should be 0, user is 95.
User differs on "System/Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Libraries", should be 0, user is 95.
Permissions differ on "System/Library/Java/Support/Deploy.bundle/Contents/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/deploy.jar", should be lrwxr-xr-x , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Classes/jconsole.jar", should be -rw-r--r-- , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/A/Resources/Deploy.bundle/Contents/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/deploy.jar", should be lrwxr-xr-x , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/deploy.jar", should be -rw-r--r-- , they are lrw-r--r-- .
Permissions differ on "System/Library/Frameworks/JavaVM.framework/Versions/1.6.0/Resources/JavaPluginCocoa.bundle/Contents/Resources/Java/libdeploy.jnilib", should be -rwxr-xr-x , they are lrwxr-xr-x .
Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.


Anyone find a fix?

 

[IT2]

I've had to learn to ignore it, not easy. It's been going on since Leopard and the forums said basically not to sweat over it so nothing to do but trust that.

 

[Ripy]

Repairing Permissions

In order to manually repair permissions use finder to look up "System/Library/CoreServices/RemoteManagement/ARDAgent.app".
Once you have done this select the tab below the app that says "more info," then go to the bottom of the new screen and unlock the padlock. You will then add a user with the plus button at the bottom of the screen and add your own user name. Once you have done this make sure the permissions are set to read/write and your done.

 

[cj Major]

Repairing Permissions

I've been looking for this info for a long time.