Several times over the last years I've done a mirror backup to an external FireWire hard drive, reinstalled Mac OS X on my PowerBook internal drive, restored, and found that none of the applications will launch.

It happened today, and rather than reinstall from the 'net or CDs, I decided to investigate and solve this vexing problem.

To make a long story short, the problem lies with invalid permissions. (Unfortunately, the canonical response of asking Apple's Disk Utility to repair permissions does not solve the problem.)

Here's what's going wrong

A short technical detour. If you're not so inclined, please just skip to the solution.

First, several technical terms: "application" means "program", "execute" means "to run" (as in running a program).

A Mac OS X application is not a single file (even though it looks and behaves as it were), but actually a hierarchy of folders and files within.

Take, for example, Apple's Safari web browser. When you see it in the Finder it looks like an executable file. Double-click it and it starts executing, rather than opening up like a folder. You have to bring up the contextual menu to see a Show Package Contents action, which, when selected, results in something like the window at right.

There you'll see what a Mac OS X application is made of: a nested hierarchy of folders and files within. Of special interest for us are the contents of the MacOS subfolder.

It seems that even if the top-level folder, in this case Safari, has the proper UNIX permissions to be executed it still won't work because the contents of the MacOS subfolder don't have the proper permissions.

Why this is so isn't clear to me. I'm guessing that one of the backup programs I'm using - Synchronize X and SuperDuper! - isn't properly remembering the permissions. Or perhaps they're both using some common element provided by Mac OS X, and that's not working. I haven't exhaustively tested all backup options, even though I have Carbon Copy Cloner and Retrospect handy. I will send an email to the authors of the packages I use to see whether this rings a bell (or causes something to be fixed).

Here's how to fix the problem

The following are the commands I type at a Terminal.app prompt. WARNING: I'm not sure that you're suffering the same woes as I, and there's always a chance that by mistake or by typo these instructions will cause bad things to happen. These worked for me, but I take no responsibility for what this may do on your system. Make sure you have a good backup and a bootable CD before you start mucking about. I'm not actually so worried, but there's always one person who is sloppy, has no backups, and unprepared for the unexpected. I'm sure that's not you.

% tcsh
% find /Users/YOUR_SHORT_NAME -type d -name MacOS | grep Contents/MacOS | sed -e's, ,\ ,g' -e's,^,chmod +x ,' -e's,$,/*,' >! ~/dothis
% more ~/dothis
% source ~/dothis
% ^D (Control-D)

The first line starts up tcsh, a command interpreter shell. I do this because that's the shell in which I have the most experience, and the syntax I use for the commands I'll be showing you.

The second line generates a file in your home directory called dothis which, when executed, will fix the broken permissions. (This is explained in greater detail below.)

The third line shows you that file a screenfull at a time, so you can sanity-check the results.

The fourth line executes that file.

The fifth line terminates the tcsh shell and returns you to the shell you had been using.

An explanation of that long command

Now let's examine in detail the commands used to create that file of instructions. Here it is again:

find /Users/YOUR_SHORT_NAME -type d -name MacOS | grep Contents/MacOS | sed -e's, ,\ ,g' -e's,^,chmod +x ,' -e's,$,/*,' >! ~/dothis

At a high level, I can summarize that command as

find something | winnow out inappropriate finds | turn finds into commands > put into a file for examination

Quick technical guide: The | is a "pipe" action, using the output of one command as the input to the next command. The >! is a "redirect" action, and writes the output of the last command into a file, replacing a file of the same name if it already exists.

From left to right, then, let's examine each part of the pipeline.

find /Users/YOUR_SHORT_NAME -type d -name MacOS

Find, in your home directory, all items of type directory (folder, which you now know all applications really are) which are named MacOS. It's somewhat important that you use an absolute path to specify where to find; /Users/mickey is absolute because it starts at the top of the UNIX file hierarchy and works downward to a user's directory, while ~ (the tilde character) is relative rather than absolute, and will not generate more foolproof output for our purposes.

That output looks something like this:

/Users/m/apps/firefox.app/Contents/MacOS
/Users/m/apps/firefox.app/Contents/MacOS/plugins/Default Plugin.plugin

we pipe that output into the input for our next command, grep (global regular expression parser):

grep Contents/MacOS

which passes through all the lines which contain "Contents/MacOS" to our next command. (While I was researching this I thought I'd seen package contents which were called MacOS but were not within Contents folders, and this command winnows those out. When writing this explanation I tried to find such examples, but couldn't. So it seems as though this step might be unnecessary, but it does no harm.)

The next command is sed (stream editor):

sed -e's, ,\ ,g' -e's,^,chmod +x ,' -e's,$,/*,'

sed edits the stream of characters passing through it, applying expressions (or transformations, in this case) to that stream. Let's examine the three expressions we're using.

This expression says substitute all instances of " " with "\ " globally (everywhere on the line). I need two backslashes to denote one backslash, given that the shell consumes them. Too much information :-)

-e's, ,\\ ,g'

This expression says substitute the beginning-of-line (^) with "chmod +x ".

-e's,^,chmod +x ,'

This expression says substitute the end-of-line ($) with "/*".

-e's,$,/*,'

And our last command:

>! ~/dothis

takes the output of the last command and writes it into a file called dothis in your home directory (~), overwriting a file of the same name, should it exist.

The original output, above, now appears in the dothis file looking like this:

chmod +x /Users/m/apps/firefox.app/Contents/MacOS/*
chmod +x /Users/m/apps/firefox.app/Contents/MacOS/plugins/Default\ Plugin.plugin/*

The command chmod +x (change mode) makes things executable.

The "\ " in-between each and every word of a multi-word folder name means that UNIX commands can properly work. (UNIX expects file and folder names to be sans spaces: whereas MyFishingTrip, my_fishing_trip, and my_fishing_trip are acceptable, My Fishing Trip will cause most UNIX commands to have fits.)

The "/*" at the end says do that action on the contents of this folder. Now, as it happens, this works for me, but I'm not actually sure whether it's only the higher Contents/MacOS items whuch must be changed, or whether anything with a Contents/MacOS folder is fair game to be executed at some point in time by the application. Someday someone will authoratatively tell me, and I'll tell you.