Hands-On Report--Multiple SUID Warnings in Mac OS X 10.5.1 Permissions Check

[11/19] [Updated] Hands-On Report--Multiple SUID Warnings in Mac OS X 10.5.1 Permissions Check

It appears that if you installed Mac OS X 10.5.1 via Software Update, then using Disk Utility to verify or repair permissions results in many SUID warning reports being listed in Disk Utility's window. We have checked all of our Mac OS X 10.5.1 installations with Disk Utility and they all display the multiple warnings. However, we have not noted any issues with Mac OS X 10.5.1 in extensive use on multiple Macs since 10.5.1 was installed on them last Thursday and Friday.

The warning reports do not go away with multiple runs of repair permissions in our experience, although that has been suggested by some Mac Web sites. What does make all but one of the warnings disappear on all of our Macs is reinstalling Mac OS X 10.5.1 using the stand-alone file available from these Apple Web pages for the client or the server editions.

The one SUID warning that does not go away is:

Warning: SUID file "System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" has been modified and will not be repaired.

We do not know what caused these warnings. Perhaps, it is due to an incomplete revision or listing of permissions by the installer using Software Update. We do not use Apple Remote Desktop so whatever triggers the remaining warning is unlikely to cause us any problems. And, as we previously noted, we've experienced no issues at all since installing Mac OS X 10.5.1 which leads us to believe that the warnings are benign even if a bit unsettling.

[Update: Reader William Smith pointed out that Apple has posted a technical article on the ARDAgent SUID error warning indicating that it is benign. Another reader, Ken, thought that it is due to an Apple Remote Desktop update that occurs right after installing Leopard.] [Bill Fox & Dana Baggett]