Failure to install updates that require administrator privileges

[jspahrsummers]

Even though we prompt for a password, it apparently still fails. See atom/atom#2860 (comment) and later comments for some example logs.

[faddah]

+1 on this really needs to be fixed. this has been a problem with squirrel and auto-updates on Mac OS X since Mac OS X 10.9.4 & atom 0.110.0, and we're now on Mac OS X 10.11.1 El Capitan and Atom 1.2.3.

[erikmellum]

+1 Needs to be fixed. Running into this in Zurbs new Yeti Launch app.

[jspahrsummers]

Please do not +1 issues. If you would like to see this fixed sooner, consider submitting a pull request instead.

[AnAtomUser]

Temporary workaround for end-users: Install the app you are trying to use to `~/Applications' rather than '/Applications' and set the app to 'Keep-in-dock' so you can easily find it. It's not a great workaround since most other apps install to '/Applications', but it will at least enable a normal end-user to use the original app (such as Atom) and get access to auto-updates.

[hhff]

Everyone - thankyou so much for the hard work on Squirrel - it's been effortless to setup and I love the simplicity of it.

This issue is a big snag for us - we're shipping a cross platform electron app that mostly runs invisibly as a daemon, and unfortunately isn't a fit for the MAS. Given it's invisibility, autoupdates seemed like a no-brainer - but this is a hard stop for us.

I've scoured the existing threads and I can't seem to find a solution as of yet, the ~/Applications work around isn't quite ideal, at least from my initial testing, doesn't seem to rectify the issue.

For posterity, the issue is a crash during the "update" step of autoupdate from the logs:

Installation error: Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied" UserInfo={NSLocalizedDescription=Permission denied}

I'm not an Obj C expert - but given no-one is championing this at the moment, I'd love to do what I can to help. If someone on Squirrel team could potentially point me in the right direction to fixing this, my team can take a stab at it!

Thanks again for all the hard work everyone...! ❤️

[jspahrsummers]

@hhff Thanks for the very nice comment! Unfortunately, neither @keithduncan nor I really actively work on this anymore (and we don't really have the time to do so).

@paulcbetts has suggested that this is because a root-privileged app will write a root owned ShipIt folder (where Squirrel saves its downloaded updates). It's unclear to me why privilege escalation of the installer process doesn't solve this, but maybe a potential fix could be to always write ShipIt folders with the permissions of the running user, not the app?

[hhff]

Gotcha - thanks @jspahrsummers !

Where in the codebase would you recommend starting out?

[anaisbetts]

@hhff I'd try to track down the place that is writing Installation error: Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied" UserInfo={NSLocalizedDescription=Permission denied}

[hhff]

Thanks @paulcbetts - I'm operating in an Electron environment - any tips for tracking that down in Node world?

[anaisbetts]

@hhff oof, good question. Do you have the entire log?

[hhff]

@paulcbetts yup - for me it's in Application Support/Caches/org.develar.ElectronReact.ShipIt/ShipIt_stderr.log

That folder:

That /update.2nPCfRh folder is empty, fwiw.

2017-01-07 22:23:42.954 ShipIt[9406:173559] Beginning installation
2017-01-07 22:23:43.362 ShipIt[9406:173560] Installation error: Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied" UserInfo={NSLocalizedDescription=Permission denied}
2017-01-07 22:23:43.362 ShipIt[9406:173560] ShipIt quitting
2017-01-07 22:23:43.391 ShipIt[9408:173591] Resuming installation attempt 2
2017-01-07 22:23:43.787 ShipIt[9408:173593] Installation error: Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied" UserInfo={NSLocalizedDescription=Permission denied}
2017-01-07 22:23:43.787 ShipIt[9408:173593] ShipIt quitting
2017-01-07 22:23:45.816 ShipIt[9409:173653] Resuming installation attempt 3
2017-01-07 22:23:46.170 ShipIt[9409:173660] Installation error: Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied" UserInfo={NSLocalizedDescription=Permission denied}
2017-01-07 22:23:46.170 ShipIt[9409:173660] ShipIt quitting
2017-01-07 22:23:48.204 ShipIt[9410:174112] Too many attempts to install, aborting update
2017-01-07 22:23:48.269 ShipIt[9410:174117] Application launched at file:///Applications/My%20App.app
2017-01-07 22:23:48.269 ShipIt[9410:174117] ShipIt quitting
2017-01-07 22:24:32.968 ShipIt[9424:175474] Beginning installation
2017-01-07 22:24:33.356 ShipIt[9424:175762] Installation error: Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied" UserInfo={NSLocalizedDescription=Permission denied}
2017-01-07 22:24:33.356 ShipIt[9424:175762] ShipIt quitting

...snip

[hhff]

I'm also noticing that /update.123abc folder does actually receive the update during the update process - I can see it present during during the Beginning installation phase.

It's deleted after the third attempt fails:

[jspahrsummers]

Looks like these would be the places to adjust permissions for writing:

• -[SQRLDirectoryManager storageURL] creates the temporary directory for the downloaded update
• -[SQRLZipArchiver unzipArchiveAtURL:intoDirectoryAtURL:] unpacks the zip archive into that directory

Unfortunately, I don't have time to dig much more than this. Hopefully this is helpful!

[anaisbetts]

How would ShipIt receive permissions issues if it's explicitly running as root 🤔

[hhff]

Thanks @jspahrsummers & @paulcbetts !

It appears the issue on my end is not "writing to ShipIt logs / cache directories" (the Update is downloaded and unzipped to the correct place no problem) but, (I suspect) the issue stems from actually "applying" the newly downloaded package to the existing app.

This may be a red herring, but as an experiment, I did chown root:wheel /Applications/My App.app (it was my user / admin originally), and relaunched.

Now the log is:

2017-01-11 12:20:10.554 ShipIt[65366:4874518] Installation error: Error Domain=SQRLShipItRequestErrorDomain Code=2 "Could not read update request" UserInfo={NSLocalizedDescription=Could not read update request, NSUnderlyingError=0x7faa1372c450 {Error Domain=NSCocoaErrorDomain Code=260 "The file “ShipItState.plist” couldn’t be opened because there is no such file." UserInfo={NSFilePath=/var/root/Library/Caches/org.develar.ElectronReact.ShipIt/ShipItState.plist, NSUnderlyingError=0x7faa1372c2d0 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}}}
2017-01-11 12:20:10.554 ShipIt[65366:4874518] ShipIt quitting
2017-01-11 12:20:12.575 ShipIt[65368:4874940] Installation error: Error Domain=SQRLShipItRequestErrorDomain Code=2 "Could not read update request" UserInfo={NSLocalizedDescription=Could not read update request, NSUnderlyingError=0x7fc7fa703190 {Error Domain=NSCocoaErrorDomain Code=260 "The file “ShipItState.plist” couldn’t be opened because there is no such file." UserInfo={NSFilePath=/var/root/Library/Caches/org.develar.ElectronReact.ShipIt/ShipItState.plist, NSUnderlyingError=0x7fc7fa703010 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}}}
2017-01-11 12:20:12.575 ShipIt[65368:4874940] ShipIt quitting
2017-01-11 12:20:14.601 ShipIt[65370:4875295] Installation error: Error Domain=SQRLShipItRequestErrorDomain Code=2 "Could not read update request" UserInfo={NSLocalizedDescription=Could not read update request, NSUnderlyingError=0x7fee1a6262c0 {Error Domain=NSCocoaErrorDomain Code=260 "The file “ShipItState.plist” couldn’t be opened because there is no such file." UserInfo={NSFilePath=/var/root/Library/Caches/org.develar.ElectronReact.ShipIt/ShipItState.plist, NSUnderlyingError=0x7fee1a626140 {Error Domain=NSPOSIXErrorDomain Code=2 "No such file or directory"}}}}
2017-01-11 12:20:14.602 ShipIt[65370:4875295] ShipIt quitting

I've since closed My App.app, but we're still seeing those logs get written every 2 seconds or so.

[Sunyang730]

Having the same issue. Would love to participate in fixing it but I have no idea how to compile and test this code base. Anyone can help me get started?

[fancyydk]

Thanks for all the work on Squirrel. I, too, am running into this issue and was wondering if there's a solution or workaround.

BTW, what @hhff is seeing after changing the owner of My App.app is being tracked here #151