How to solve zsh compinit: insecure directories issue on MacOS (other solutions failed)

Question

I'm aware there are many copies of this question here, but all of their answers recommend adding

ZSH_DISABLE_COMPFIX="true"

to the top of my ~/.zshrc file. I have done this and still every time I open zsh I am greeted with

zsh compinit: insecure directories, run compaudit for list.
Ignore insecure directories and continue [y] or abort compinit [n]?

It seems that others asking this question didn't have the quotes around the true in the first sample, but I have added that. I have also run source ~/.zshrc Which as far as I can tell reloads the zshrc configuration. This still gives me the above warning. I'm not sure if any of these details could be relevant but I'll include them:

• This is a new zsh installation on an M1 Macbook running Big Sur
• I also have Oh My Zsh installed on top of zsh
• I earlier ran several export commands to set my nvm directory but I don't think that would be relevant

Any idea how to resolve this permissions issue? Thanks

Edit:

compaudit returns

/usr/local/share/zsh/site-functions
/usr/local/share/zsh

Also, here are the other nonstandard entries in my ~/.zshrc file (in order, but there is some built-in stuff inbetween):

ZSH_DISABLE_COMPFIX="true"
export NVM_DIR=~/.nvm
source $(brew --prefix nvm)/nvm.sh
export PATH="/usr/local/opt/icu4c/bin:$PATH"
export PATH="/usr/local/opt/icu4c/sbin:$PATH"
export PATH=$HOME/bin:/usr/local/bin:$PATH
plugins=(git)
source $ZSH/oh-my-zsh.sh
zstyle :compinstall filename '/Users/jonahsaltzman/.zshrc'
# End of lines configured by zsh-newuser-install
# The following lines were added by compinstall
autoload -Uz compinit
compinit

Washedout

Did you run compaudit? What output does it give? – Semantic

@MarlonRichert just added to the question, but compaudit gives the insecure directories as /usr/local/share/zsh/site-functions and /usr/local/share/zsh – Washedout

Does this help? – Mortmain

Answer 1

First of all, one problem here is that you’re running compinit twice: Once through Oh My Zsh (OMZ) – when you do source $ZSH/oh-my-zsh.sh – and once manually. You have two options to fix this:

• If you want to keep using OMZ, then you should remove the bottom 3 lines from your .zshrc file.
• If you want to stop using OMZ, then instead, you should remove both plugins=(git) and source $ZSH/oh-my-zsh.sh instead.

Secondly, note that $ZSH_DISABLE_COMPFIX is specific to OMZ and is not used by compinit itself. It has no effect when you call compinit manually. You can remove it from your .zshrc file.

Finally, compinit doesn’t show that warning for nothing. Rather than suppress it, you should instead do chmod g-w,o-w on the directories listed by compaudit. That will fix the problem and make the warning go away.

Caveat: If you've installed zsh through Homebrew and you have multiple users on the same Mac, then, unfortunately, you cannot make this go away for anyone else than the user that installed Homebrew. This is a known flaw in how Homebrew manages permissions and there is currently no workaround for it. In this case, the only solution is to make the other users bypass the security checks by passing the -u flag to compinit.

Semantic

Fantastic, thank you! I removed the manual compinit from my ~/.zshrc (what I gather from your answer is that OMZ runs its own compinit and thus it's unnecessary in my ~/.zshrc), and ran chmod g-w,o-w on the two directories returned by compaudit, now the warning is gone. A new message did appear, that oh-my-zsh.sh doesn't exist, and I removed source $ZSH/oh-my-zsh.sh from ~/.zshrc as well. Now zsh starts clean as a whistle, although I'm not sure what that oh-my-zsh.sh was or why it was in there. – Washedout

I started seeing this in my terminal after I ran this command curl -s https://get.sdkman.io | bash. Reading this answer, I check my .zshrc file and the last three lines were for skin, which I didn't want to use. After removing it, I no longer get that question in my terminal. – Cementite

Answer 2

You want to use:

compinit -u

To disable the annoying permissions test. It doesn't add any security on macOS. See the documentation at zshcompsys(1).

Homunculus