ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] MacOS user on installed files

From: Michael Tuexen <michael.tuexen@xxxxxxxxxxxxxxxxx>
Date: Sat, 10 Mar 2018 09:42:29 +0100
> On 10. Mar 2018, at 06:16, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
> 
> Hi List,
> 
> While digging into https://ask.wireshark.org/question/2023 I stumbled up these entries in my file system
> 
> macOS:~ jaap$ cd /Library/Application\ Support/
> macOS:Application Support jaap$ ls -la
> total 0
> ...
> drwxr-xr-x   3 root  wheel   102 Jul 31  2016 Script Editor
> drwxrwx---   2 root  admin    68 Jun 18  2015 SubmitDiagInfo
> drwxr-xr-x   7 root  wheel   238 Nov 17 17:06 VirtualBox
> drwx------   3 504   wheel   102 Nov 23  2015 Wireshark
> drwx------   3 root  admin   102 Jan 25 22:48 com.apple.TCC
> drwxr-xr-x   3 root  wheel   102 Jul 31  2016 iLifeMediaBrowser
> 
> 
> macOS:Application Support jaap$ sudo ls -la Wireshark/ChmodBPF 
> total 16
> drwxrwxr-x  4 504  staff   136 Oct 18 16:47 .
> drwx------  3 504  wheel   102 Nov 23  2015 ..
> -rwxrwxr-x  1 504  staff  1431 Oct 10 20:17 ChmodBPF
> -rw-rw-r--  1 504  staff   382 Oct 10 20:17 org.wireshark.ChmodBPF.plist
> 
> They question is, why the user 504 on these files? Shouldn’t those be root owned?
504 is the uid of the user doing the build on the Max OS buildbot...

Best regards
Michael
> 
> Is that an left over from an old installer, or is this still happening with the current?
> 
> Thanks,
> Jaap
> 
> 
> 
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe