diff --git a/packaging/macosx/osx-app.sh.in b/packaging/macosx/osx-app.sh.in
index f5a10cc5d5..bdf40b6c88 100755
--- a/packaging/macosx/osx-app.sh.in
+++ b/packaging/macosx/osx-app.sh.in
@@ -563,4 +563,11 @@ else
 	echo "Code signing not performed (no identity)"
 fi
 
+# File permission sanity check.
+if ! badperms=$( find "$bundle" ! -perm -0444 -exec ls -l "{}" + | grep . ) ; then
+	echo "Found files with restrictive permissions:"
+	echo "$badperms"
+	exit 1
+fi
+
 exit 0