113

I have a Mac that is shared between two engineers. Both have separate user accounts. Both need to run brew update and brew install... occasionally.

How do I set this up without getting errors like: /usr/local must be writable!?

Yeah, I could have UserA take over the permissions of /usr/local every time he wants to use brew (and same with UserB), but that seems like a lot of unnecessary trouble.

2
  • 12
    The answer marked as accepted is ill-advised and poor security practice. @user4815162342 answer below is much more sensible.
    – Wes Modes
    Commented Mar 6, 2018 at 17:31
  • 4
    Please accept a different answer, or at least un-accept the accepted answer, so that it can be deleted. Commented Jul 27, 2021 at 15:46

11 Answers 11

123

Every answer that tries to hack permissions, or use sudo is wrong.

Do not use sudo and do not share a single brew installation across user accounts.

The correct answer per the Homebrew docs is to use zero or one global brew installation on a machine, and for all other users install a local version of brew.

This is especially important on Mac, but works on Linux too.

This can be done by one of the following approaches

  1. Git approach: doing a git checkout of the source repo
  2. Untar-anywhere approach: expanding a tarball into some directory – owned by your user

Git approach

For the git approach you'll need to clone brew.

Arbitrarily choosing my user home directory for my checkout:

cd $HOME
git clone https://github.com/Homebrew/brew.git
./brew/bin/brew tap homebrew/core

Untar-Anywhere Approach

As documented at docs.brew.sh, run this command in your home directory, which will create ~/brew.

cd $HOME
mkdir brew && curl -L https://github.com/Homebrew/brew/tarball/master | tar xz --strip 1 -C brew

Finishing up

For either installation method, you'll need to change your PATH to prefer the new brew bin directory, adding something like this to your shell's dot file.

export PATH=$HOME/brew/bin:$PATH >> ~/.zshrc # or ~/.bashrc

Then running this to reload and test

exec $SHELL
which brew # see that brew is found in your path

Since this is a new installation, you have to install all your desired brew packages (again).

20
  • 2
    This worked for me, but the repo must be cloned with https in my case. cd $HOME; git clone https://github.com/Homebrew/homebrew-core.git; git clone https://github.com/Homebrew/brew.git Commented Nov 14, 2019 at 11:38
  • 1
    @SebMa done, let me know if I got it right
    – jerryb
    Commented Dec 24, 2020 at 22:21
  • 5
    from the docs Pick another prefix at your peril!
    – Clintm
    Commented Jan 22, 2021 at 16:12
  • 6
    I finally found a use case where my solution does not work well: nvm hates to be outside of /usr/local/bin but its been years with this solution with zero trouble otherwise.
    – jerryb
    Commented Apr 4, 2021 at 2:48
  • 10
    One should however mention that this approach is unsupported and you can never raise any concern in their bug tracker, they will be closed without even looking at the issue, says the documentation docs.brew.sh/Installation#untar-anywhere-unsupported, docs.brew.sh/Installation#multiple-installations-unsupported and it comes with one downside, that everything that you install will be compiled and no standard bottles can be used, because the bottles assume the standard brew location /usr/local.
    – user637338
    Commented Mar 20, 2023 at 8:41
122

You can also change the group permissions to admin or another group that both of your users are in:

chgrp -R admin /usr/local
chmod -R g+w /usr/local

Original source: https://gist.github.com/jaibeee/9a4ea6aa9d428bc77925

UPDATE:

In macOS High Sierra you can't change the owner, group or permissions of /usr/local. So you have to change the group and permissions of the subfolders:

chgrp -R admin /usr/local/*
chmod -R g+w /usr/local/*

UPDATE September 2018, High Sierra 10.13.6

  1. Determine the path of the brew prefix, ie. the path that will be used to store files related to working with homebrew
  2. Check that all users on the system who need access to brew are in the admin group
  3. Optional Add a user to the admin group if a user needs access to brew

    Will require access / privileges to use the sudo command

  4. Set the brew prefix path to be recursively owned by the admin group
  5. Set the brew prefix path to be recursively writable by all users who are in the admin group
  6. Verify the permissions of the brew prefix
  7. brew 🍻

echo $(brew --prefix)
echo $(groups $(whoami))
sudo dseditgroup -o edit -a $(whoami) -t user admin
sudo chgrp -R admin $(brew --prefix) 
sudo chmod -R g+rwX $(brew --prefix)
ls -lah $(brew --prefix)
12
  • 1
    I had to add sudo otherwise I would get Operation not permitted error messages
    – FooBar
    Commented Sep 10, 2018 at 10:19
  • 16
    Do not add sudo to avoid Operation not permitted. add /* to the command, ie: sudo chgrp -R admin $(brew --prefix)/*. source Commented Nov 5, 2018 at 17:10
  • 6
    This solution is sound, however some packages might refuse to work with such permissions. Postgres, for example, throws: FATAL: data directory "/usr/local/var/postgres" has group or world access DETAIL: Permissions should be u=rwx (0700). Commented Nov 14, 2018 at 20:03
  • 2
    This answer could use some cleaning up... What is the code block at the end? Another update?
    – n1000
    Commented Feb 11, 2019 at 17:26
  • 3
    zsh also complains when owner and perms are tweaked like this; compaudit errors every new shell.
    – jerryb
    Commented Mar 6, 2019 at 11:02
56

Install homebrew for each user

According to the brew documentation you can install it inside each User Home folder

That way all packages are going to stay inside your user folder, and will not be visible or affect other users. As a good side effect if you delete that user, no trash is left behind on your system. So system wide pollution is minimised.

This comes at the cost of more storage being used, if you install the same package for multiple users. Just something to be aware if you have a very small SSD.

Instructions

  1. If you currently have brew installed on your system globally, I recommend uninstalling brew first. (You can see where brew is installed running which brew)

  2. If you don't have Command Line Tools installed, you have to run this first:

    xcode-select --install
    
  3. Open terminal and Run:

    • MacOS Catalina 10.15 or newer:
      cd $HOME
      mkdir homebrew && curl -L https://github.com/Homebrew/brew/tarball/master | tar xz --strip 1 -C homebrew
      echo 'export PATH="$HOME/homebrew/bin:$PATH"' >> .zprofile
      
    • MacOS Mojave 10.14 or older:
      cd $HOME
      mkdir homebrew && curl -L https://github.com/Homebrew/brew/tarball/master | tar xz --strip 1 -C homebrew
      echo 'export PATH="$HOME/homebrew/bin:$PATH"' >> .bash_profile
      
  4. Close the Terminal window

  5. Open Terminal again, and run this to ensure your installation is correct:

    brew doctor
    
  6. Done!


Disabling auto update

This is not required I also find useful to disable brew to update all packages before every time you install something.

  • MacOS Catalina 10.15 or newer
    echo 'HOMEBREW_NO_AUTO_UPDATE=1' >> $HOME/.zprofile
  • MacOS Mojave 10.14 or older
    echo 'HOMEBREW_NO_AUTO_UPDATE=1' >> $HOME/.bash_profile
5
  • 4
    That is the only answer that actually 1. installs brew only for this current user and 2. correctly sets the PATH so it's useable also after reboot! Thanks Vitim!
    – Sliq
    Commented Dec 17, 2020 at 2:58
  • 1
    As noted on the Homebrew installation documentation: "do yourself a favour and install to /usr/local on macOS Intel, /opt/homebrew on macOS ARM, and /home/linuxbrew/.linuxbrew on Linux" and goes on to say "Pick another prefix at your peril!" so I'm not sure this method would be advisable.
    – Benji
    Commented Apr 13, 2021 at 14:42
  • 5
    I like this answer as it keeps brew local to the user (not shared). But brew doctor returns the following. Is this expected? Warning: Your Homebrew's prefix is not /usr/local. Some of Homebrew's bottles (binary packages) can only be used with the default prefix (/usr/local). You will encounter build failures with some formulae. Please create pull requests instead of asking for help on Homebrew's GitHub, Twitter or any other official channels. You are responsible for resolving any issues you experience while you are running this unsupported configuration.
    – hdsenevi
    Commented Jul 4, 2021 at 5:20
  • as great as this answer is, it does have its limitations. 1. if using a multi user homebrew install isolated within a $HOME dir for particular install, and one wants to use such install with github actions, ie. homebrew's test-bot will be unable to perform actions with the standard setup. this can be seen as a limitation of the actions runner provided by homebrew, but using a vanilla github actions with test-bot brew needs to be installed in /usr/local
    – ipatch
    Commented Aug 17, 2021 at 19:27
  • 1
    I like that you include the xcode step for git, and the brew doctor.
    – jerryb
    Commented Dec 12, 2021 at 23:17
15

EDIT: Please use the answer by Vitim, it's the correct one :)

Hacky workaround solution for macOS Mojave 10.14

This is a edited version of user4815162342's answer, which didn't work for me out-of-the-box.

  1. In System Preferences, go to Users & Groups, click the lock symbol in the bottom left corner to unlock user/group creation, then create a new group called brew-usergroup. Add all users who work with brew to the group (like in the attached screenshot from a german macOS).

enter image description here

  1. In terminal, do this:

     echo $(brew --prefix)
     echo $(groups $(whoami))
     sudo dseditgroup -o edit -a $(whoami) -t user brew-usergroup
     sudo chgrp -R brew-usergroup $(brew --prefix)/*
     sudo chmod -R g+rwX $(brew --prefix)/*
     ls -lah $(brew --prefix)
    

Note that this doesn't change rights of brew folders anymore (like in other answers), it changes subfolders/files of brew folders. brew install should now work fine without errors.

3
  • 3
    this looks like as an elegant solution, but unfortunately it's not better than simply doing the same for admin (without creating an extra group). either way, i'm getting these error messages: cp: utimes: /usr/local/Cellar/readline/.: Operation not permitted cp: chmod: /usr/local/Cellar/readline/.: Operation not permitted Commented Mar 13, 2019 at 5:50
  • 1
    I agree, I think the best would be to push the brew developers to fix this entire issue at the core!
    – Sliq
    Commented Mar 13, 2019 at 10:26
  • I just now had the same cp: utimes: /usr/local/Cellar/XXX/.: Operation not permitted error, found that it was caused by a folder with group "staff" instead of "admin", although I ran chgrp -R admin /usr/local/... strange, but fixed :) find /usr/local/ -not -group admin -ls may be of help...
    – DrPsychick
    Commented Sep 4, 2019 at 20:13
15

Homebrew is not designed to be used by different Unix users. From the FAQ:

If you need to run Homebrew in a multi-user environment, consider creating a separate user account especially for use of Homebrew.

The chmod solution is not viable unless you ensure that every newly created file in the Homebrew prefix also has the group write permission, which is not the case with the default umask – or unless you keep running that chmod command every time a program writes to the Homebrew prefix.

Maintaining separate Homebrew installations for each user do sort the permissions issues but will create a number of other issues, which is why it's not recommended by Homebrew:

However do yourself a favour and use the installer to install to the default prefix. Some things may not build when installed elsewhere. One of the reasons Homebrew just works relative to the competition is because we recommend installing here. Pick another prefix at your peril!


To ease the official recommendation of using a dedicated account for Homebrew, you can use sudo to easily impersonate that user account. Assuming you named that user homebrew:

sudo -H -u homebrew brew update
  • -H makes sure HOME is set to the homebrew user home (e.g. /Users/homebrew) so that Homebrew can do its housekeeping there.
  • -u homebrew tells sudo to impersonate the homebrew user account instead of the default of root.
3
12

The above works fine, but if you want new files to automatically inherit those permissions, set an ACL which gets inherited (otherwise only the user that pours a bottle can remove it). Found hints how to do this here: https://gist.github.com/nelstrom/4988643

As root run once (assuming all users of group "admin" should have access):

cd /usr/local
/bin/chmod -R +a "group:admin allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextattr,writeextattr,readsecurity,file_inherit,directory_inherit" Homebrew Caskroom Cellar bin
/usr/bin/chgrp -R admin Homebrew Caskroom Cellar bin
/bin/chmod -R g+rwX Homebrew Caskroom Cellar bin
ls -lae .

the -e on ls shows ACLs.

Update: now I use specific directories (see above) as it failed (sth. like out of memory)

2
  • might want to prepend /bin/chmod for those of us who installed GNU coreutils for macOS
    – ipatch
    Commented Nov 7, 2019 at 3:09
  • This is great! I'm trying it out for a bit. Curious why you may not have included some of the other ACLs, like writesecurity(which appears to be required to, say, make a script executable). I ended up doing chmod -R +a 'group:admin allow readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,list,search,add_file,add_subdirectory,delete_child,read,write,append,execute,file_inherit,directory_inherit' * against all /usr/local directories after a fresh Homebrew install.
    – Mattie
    Commented Sep 5, 2021 at 3:21
6

Here is the official answer of one of the Homebrew maintainers.

Create a third admin user (e.g. homebrew), then:

sudo chown -R homebrew:admin /usr/local/*

Then all further write operations (i.e. install, update, upgrade, etc.) should be done by everyone else as that user, by the power of su or sudo, depending on your preference:

su homebrew -c 'brew update'

In this respect, there's only one difference between Homebrew and a system package manager: the former lets you decide which user to grant ownerships to, while the latter fixes it as root.

My own suggestion

Suppose you already have an admin user niki who owns the /usr/local/* dir and you are logged in as another admin user niki_at_work. In this case you don't necessarily need to create a new account for homebrew.

  1. Create ~/brew.sh with these contents:
#!/bin/bash
comm="brew $@"
su niki -c "$comm"
  1. chmod +x ~/brew.sh
  2. Add this alias to .zshrc or equivalent: alias brew="~/brew.sh"

Now you can brew from niki_at_work like always (it will ask for niki's password):

brew update
brew install swiftlint

If you do want to use a dedicated admin user for brew ex. brewadmin you should first chown brew dirs: sudo chown -R brewadmin:admin /usr/local/*

2
  • 1
    I don't see evidence that the person who replied to you is an official maintainer. But this strategy is also similar to a tool I used to maintain: github.com/brewdo/brewdo It worked well for most cases, but I stopped maintaining it some years back due to occasional incompatibilities and the fact that Homebrew itself uses OS sandboxing to stop changes outside the Homebrew installation—an early reason why I started this tool. In any event, based on experience, I think this answer is overly simplistic and may work most of the time, but may be problematic down the road.
    – Mattie
    Commented Sep 4, 2021 at 13:10
  • Regarding the comment "I don't see evidence that the person who replied to you is an official maintainer" by @Mattie: the commentor on the externally linked GitHub issue is in fact listed as part of the Homebrew org on GitHub as of August 2023: github.com/orgs/Homebrew/people
    – Ville
    Commented Aug 21, 2023 at 11:22
2

The best solution is to add a sudoers record to allow unprivileged user 'joe' to execute any 'brew' related command as the administrative user.

Create a file at /etc/sudoers.d/joe with following content:

joe ALL=(administrator) NOPASSWD: /usr/local/bin/brew

Then you can run brew like this:

sudo -Hu administrator brew install <smth>
2
  • That sounds dangerous. What if 'joe' creates a Homebrew package that does bad things?
    – Suragch
    Commented May 12, 2019 at 2:19
  • 4
    @suragch I guess you can't avoid that danger if you're allowing joe to install any system wide packages not only this way, but in any way. Commented May 12, 2019 at 2:26
2

Other answers shared here (especially with higher scores) are basically flawed.

Bad: Shared group writable permissions

The approach with shared group writable permissions is bad, as Homebrew is not designed to be used by multiple Unix users. A given Homebrew installation is only meant to be used by a single non-root user.

  • By giving write access to a given group, that is shared by all the users you want to call brew from, you get the illusion that you allowed brew to be used by multiple users.
  • But the default umask that brew uses doesn't add group write access, meaning that as you use brew, more and more parts of the state will not be writable by the other users in your group.
  • This means that if you install packages from different users, brew update will very quickly fail to run on any of those users because none have access to everything anymore; and you will need to run the chmod hack again and again.

Bad: Separate Homebrew installations

The approach with separate Homebrew installations is bad, because first of all, you will need to build all packages from sources. Secondly, and more importantly many packages will simply not build when installed to a custom prefix instead of the default global one. This method is completely unsupported an discouraged by the HomeBrew team, they even put a disclaimer out:

Building from source is slow, energy-inefficient, buggy and unsupported. The main reason Homebrew just works is because we use bottles (binary packages) and most of these require using the default prefix. If you decide to use another prefix: don't open any issues, even if you think they are unrelated to your prefix choice. They will be closed without response.

Solution: Dedicate a single user account to Homebrew

This is what is recommended for multi-user systems in the Homebrew FAQ!

If you need to run Homebrew in a multi-user environment, consider creating a separate user account specifically for use of Homebrew.

Because Homebrew is not designed to be used by multiple users, and it's not designed to be installed anywhere else than the default location, what you want to do instead is to install Homebrew in its default location with a dedicated user that you switch to in order to use it.

2

All the other answers that mess with chmod permissions add a lot of unnecessary complexity. If both users are admins, then the simplest way to install brew is in its default location (/opt/homebrew on Apple Silicon), with its default perms, and then use sudo to impersonate the owner (not root) of /opt/homebrew to run brew commands.

You can do this with a simple Zsh alias (replacing 'username' with the actual user):

# ${ZDOTDIR:-$HOME}/.zshrc
alias brew='sudo -Hu "username" /opt/homebrew/bin/brew'

If you want to make it a bit more dynamic, you can call stat to detect the owner:

# ${ZDOTDIR:-$HOME}/.zshrc
source <(brew shellenv)
brew_owner=$(stat -f "%Su" $HOMEBREW_PREFIX)
if [[ $(whoami) != $brew_owner ]]; then
  alias brew="sudo -Hu '$brew_owner' brew"
fi
unset brew_owner

EDIT For Zsh users: One other important thing to note is that if you install Zsh via homebrew on a multi-user system and have it set up this way, the completions system will likely give you the error:

zsh compinit: insecure directories, run compaudit for list.
Ignore insecure directories and continue [y] or abort compinit [n]?

This is because directories in your $fpath like /opt/homebrew/Cellar/zsh/*/share/zsh/functions and /opt/homebrew/share/zsh/site-functions will be owned by the primary homebrew admin. You can ignore those "insecurities" by calling compinit with the -u flag rather than playing chmod-whack-a-mole.

0
-4

The above solutions didn't work for me. But running the command below worked for me.

sudo chown -R $(whoami) $(brew --prefix)/*

Source: https://github.com/Homebrew/brew/issues/3228#issuecomment-333858695

2
  • 3
    This is not actually a solution if you want to use multiple users. You would have to execute that command on each user switch.
    – maniexx
    Commented Sep 2, 2018 at 22:32
  • This would not work in a multi-user environment.
    – Exploring
    Commented Sep 24, 2021 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.