Fix mac_brew_pkg.homebrew_prefix triggering su on every invocation (#69027)#69674
Merged
Conversation
homebrew_prefix() passes runas=<brew binary owner> unconditionally to cmdmod.run. On macOS, cmdmod.run wraps the command in `su -l <user> -c ...` whenever runas is truthy, even when <user> is the current process user. On a non-root TTY invocation this prompts for a password; on a non-TTY invocation it prints `su: Sorry` and a `Command 'brew' failed with return code: 1` line on every salt-ssh startup. Only forward runas when the brew binary is owned by a different user than the current process. When the owner matches the current user, short-circuit to runas=None so the su wrap is skipped. Defensively tolerate getpass.getuser() raising in exotic environments (empty passwd db, some container images) by falling back to the pre-fix behavior. Fixes saltstack#69027
twangboy
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Fixes
mac_brew_pkg.homebrew_prefix()triggering asupassword prompt(or
su: Sorryerror on non-tty invocations) on every salt-ssh startup asa non-root user whose Homebrew is owned by themselves. The probe now only
forwards
runas=tocmdmod.runwhen the brew binary owner differs fromthe current process user.
What issues does this PR fix or reference?
Fixes #69027
Previous Behavior
Every invocation of salt-ssh (or any Salt process that loads
mac_brew_pkg) on macOS as a non-root user prints:On a TTY, the user is prompted for their password before the wrapped
command fails. Root cause:
homebrew_prefix()passesrunas=<brew binary owner>tosalt.modules.cmdmod.rununconditionally.On Darwin,
cmdmod.runwraps the command insu -l <user> -c ...whenever
runasis truthy, even when<user>is the current processuser — and non-root invocations of
surequire a password regardless ofwhether the source and target identities match.
New Behavior
homebrew_prefix()callsgetpass.getuser()and short-circuitsrunasto
Nonewhen the brew binary owner is the current user. Thesu -lwrap is skipped in the common single-user macOS setup; behavior when the
brew binary is owned by a different user (shared multi-user installs)
is unchanged.
getpass.getuser()failures are tolerated defensively sowe never make things worse than the previous unconditional behavior.
Two regression tests were added to
tests/pytests/unit/modules/test_mac_brew_pkg.py:test_homebrew_prefix_no_su_when_brew_owner_is_current_usertest_homebrew_prefix_still_uses_runas_when_brew_owned_by_other_userMerge requirements satisfied?
changelog/69027.fixed.md)Commits signed with GPG?
Yes