Do all Mac OS X applications require Admin permissions to 'install'?

Question

I'm new to the whole Mac OS X operating system. I'm trying to learn and I've got myself a MacBook running Mac OS X 10.7.3.

I've created a test user that can not administrate so that I can test out permissions and I've found that I can not do anything in the Applications folder, which includes 'installing' applications (even those drag 'n' drop ones) and creating folders, without entering an Admin name and password.

However, I was under the impression that this wasn't the case and you only needed Admin permissions to write to somewhere like Preferences, so can somebody please clarify why it is asking for Admin when I try to drag 'n' drop applications into the Applications folder.

Solution 1

It depends on which Applications folder you mean. In fact, there can be two:

• /Applications

  This one is owned by root, and reserved for all applications that already come with OS X, like Mail.app, iTunes.app, etc. This root user is not an account you can log into with the graphical interface, but it's still accessible via Terminal.

  Since the folder requires your user to be in the admin Unix group, you can't just drag and drop files there unless you actually have an admin account (enabling this in System Preferences will add your user to this admin group). You can check the groups your user belongs to by typing id -Gn in a Terminal.

• /Users/your-user/Applications

  This one might not even exist in your system, but you can easily create it by opening Finder, clicking Go → Home, then File → New Folder, and naming it "Applications".

  As this folder resides in your home folder, it belongs to you only. So if you need to drag-and-drop an application to install it, put it there instead of /Applications. You don't need admin privileges here.

  

For more info about the OS X user groups, see: Difference between default groups on Mac OSX

Solution 2

The /Applications folder owned by the user root (owner = full access). Additionally every member of the group admin can read and write to it. Everyone else can only read but not write.

Your "user that can not administrate" is not in the group admin thus can only read that folder. When you try to write (the drag n drop installation) to that folder with your unprivileged user, the operating system does not just deny your request but asks you to authenticate with a user account hat has the necessary permissions (root or a member of the admin group).

Comments

[Admin]

Some programs are not distributed as an drag-somewhere-and-use .app but in form of installers (file ending .pkg or .mpkg.) Those usually need admin privileges to install.

[Andy]

@bytesum I realise that some applications have installers - this is why I put install in speech marks. I gathered that those would require admin permissions as you can't really choose where they end up - they're just written to the /Applications folder automatically.

[Andy]

@slhck Thank you for your answer - just what I needed to know! Mac OSX is a completely different animal to Windows to say the least...

[Andy]

Thanks for your answer as well. Just so I'm clear though, what is the difference between the term root and admin?

[slhck]

@Andy root is a user, while admin is a group a user in OS X can belong to. Typically, admin users are in the admin group whereas all "normal" users only are in the staff group.

[slhck]

@Andy I'm afraid so. But its concepts of users, groups and permissions are entirely based on Unix, so you'll also find good documentation of that online.

[Andy]

@slhck I think it will do me a lot of good to read upon permissions (and the like) now, so I will definitely do that when I get chance. Thanks again.