macOS 10.15.4 Beta (19E234g) does not permit sudo su in pkg postinstall

A package contains lot of components. My product launches the main application of the package at the end of installation of the package through postinstall script. Such an application is expected to run in the context of logged in Console user.


But the installer runs the postinstall script in root privilege with uid value 0. Therefore to launch the application in Console user context, the following command has been used so far:


sudo su - $CONSOLE_USER -c open $MAIN_APP_OF_PKG


Where CONSOLE_USER and MAIN_APP_OF_PKG are computed which is not in this scope.


The above way has been working so far good in Mac systems.


In the new macOS Catalina Version 10.15.4 Beta (19E234g), this “sudo” and “su” fail with “Operation not permitted” when run from postinstall.


When installing a test.pkg, this issue is observed in /var/log/install.log:

——————

2020-02-21 17:04:14+02 Testers-Mac-mini package_script_service[4256]: ./postinstall: sudo su - tester -c open "/Applications/HelloWorld.app"

2020-02-21 17:04:14+02 Testers-Mac-mini package_script_service[4256]: ./postinstall: /tmp/PKInstallSandbox.LnPlJo/Scripts/com.senthil.HelloWorld.AmxxUq/post-install: line 4: /usr/bin/sudo: Operation not permitted

——————

1) Will the upcoming macOS update have the same behaviour? Why?

2) What is the alternate way to launch the installed app in console user context?

Accepted Reply

The issue appears to be resolved as of 10.15.4 beta 3 (19E242d).

Replies

I am encountering the same issue. In addition to the su and sudo commands failing, I'm seeing other commands like ps failing too. Hopefully, this is a bug and not intended behavior.

Also experiencing this issue. Submitted feedback to Apple, waiting to hear back.

I am also seeing this issue. We use sudo for the same reasons. We also noticed ps(1) is failing too. I have a forum post about this as well.

I am also seeing the similar behaviour that sudo commands are failing from post or pre install scripts.

The issue appears to be resolved as of 10.15.4 beta 3 (19E242d).