The daemon that Finder uses to “repair” permissions on iCloud files turned out to be willing to repair permissions on anything – including system directories. In this article we’ll look at how DesktopServicesHelper works under the hood and why a single XPC request was enough to get root. But before we get there, let’s cover some macOS internals.