Please fix your postinstall script

donmontalvo · 04-17-2024, 06:59 PM

The last few lines in your `postinstall` script in your flat/signed PKG is incorrect.

The intent is to open the app as the current user, whereas most enterprise users are not administrators.

This is bad:

open -a "/Applications/DisplayLink Manager.app"

This is good:

currentUser=$(/usr/bin/stat -f %Su /dev/console);
/bin/launchctl asuser $(/usr/bin/id -u "$currentUser") /usr/bin/open "/Applications/DisplayLink Manager.app"

In enterprise environments that use Jamf Pro to manage their fleet of macOS computers, all policies run as root.

Not even root can open an app in the user space (as the current user), so policies fail with error. The above provides the fix.

Hope to see 1.10.2 with the fix soon.

donmontalvo · 04-22-2024, 08:43 PM

Hoping someone is monitoring this thread.

Until this is fixed, hopefully in 1.10.2, we are forced to expand the flat/signed PKG, comment out the last few lines in the postinstall script, flatten and resign. Then we deploy the PKG in a policy using the above commands to open as the current user.

Never a good idea to reverse engineer a vendor's PKG, so hoping 1.10.2 is released with the fix so we don't have to.

04-17-2024, 06:59 PM	#1
donmontalvo Junior Member Join Date: Jan 2017 Posts: 24	Please fix your postinstall script The last few lines in your `postinstall` script in your flat/signed PKG is incorrect. The intent is to open the app as the current user, whereas most enterprise users are not administrators. This is bad: open -a "/Applications/DisplayLink Manager.app" This is good: currentUser=$(/usr/bin/stat -f %Su /dev/console); /bin/launchctl asuser $(/usr/bin/id -u "$currentUser") /usr/bin/open "/Applications/DisplayLink Manager.app" In enterprise environments that use Jamf Pro to manage their fleet of macOS computers, all policies run as root. Not even root can open an app in the user space (as the current user), so policies fail with error. The above provides the fix. Hope to see 1.10.2 with the fix soon. Last edited by donmontalvo; 04-17-2024 at 07:11 PM.

04-22-2024, 08:43 PM	#2
donmontalvo Junior Member Join Date: Jan 2017 Posts: 24	Hoping someone is monitoring this thread. Until this is fixed, hopefully in 1.10.2, we are forced to expand the flat/signed PKG, comment out the last few lines in the postinstall script, flatten and resign. Then we deploy the PKG in a policy using the above commands to open as the current user. Never a good idea to reverse engineer a vendor's PKG, so hoping 1.10.2 is released with the fix so we don't have to.