Hello, in Linux homebrew allows installing it without root privilege. Recently I have switched to Mac but now here I'm seeing that homebrew doesn't provide the option to install without root. So I was curious to know if it's safe to proceed with root privilege?
MacBook Pro 14″, macOS 12.4
I use homebrew on Intel and a couple of Apple Silicon Macs. I never used root, or sudo to install homebrew, or any packages. In fact, since the packages are written and installed in the /usr/local (Intel) or /opt/homebrew (Apple Silicon) directory trees that should be owned by you, with group admin, no dialog has ever appeared requesting my admin password for any purpose. Only Layer Four Traceroute (lft), recommends sudo usage when run, and explains why.
Yes, there is an element of implicit trust involved, but there would be with any third-party package management solution, whether that was conda, npm, Perl module, Python module, Ruby GEM, etc. Apple is well on its way to eliminating the latter three. Homebrew installs its own portable Ruby in order to effect the package maintenance process.
I use homebrew on Intel and a couple of Apple Silicon Macs. I never used root, or sudo to install homebrew, or any packages. In fact, since the packages are written and installed in the /usr/local (Intel) or /opt/homebrew (Apple Silicon) directory trees that should be owned by you, with group admin, no dialog has ever appeared requesting my admin password for any purpose. Only Layer Four Traceroute (lft), recommends sudo usage when run, and explains why.
Yes, there is an element of implicit trust involved, but there would be with any third-party package management solution, whether that was conda, npm, Perl module, Python module, Ruby GEM, etc. Apple is well on its way to eliminating the latter three. Homebrew installs its own portable Ruby in order to effect the package maintenance process.
Homebrew can’t ruin macOS itself (due to system integrity protection; write-locked storage for macOS itself, etc), but it can (potentially) snarl the users’ storage areas, and it absolutely can alter user details such as PATH.
That some kegs might have security issues or might introduce exploits is certainly possible.
Nothing out of the range of backups, though.
Again, what is safe? You could conceivably choose to review all the code involved, for instance.
1) The ruin it can do is based more on your own abilities, or lack thereof. Sometimes people use such tools because they don't want to bother doing it themselves and sometimes they do it because they don't have the ability to do it themselves. The latter is risky. I've seen many people who used homebrew, created a mess, and then couldn't correct it.
2) Third party software always introduces a greater risk of vulnerabilities. Do you know who developed all of the software on your computer. Do you know where they got their dependencies from? Are they companies trying to make a profit, one way or another, or individuals with some other goal in mind? Now take that one step more removed and think about fourth party software like homebrew. If anything, it is remarkable how few vulnerabilities have been introduced this way.
Actually I was just lazy to read the installation script of homebrew and wanted to know if it uses root privilege to do something more than just creating /opt/homebrew and modifying it's ownership and permissions.
Regarding the tools I'll be using later on, I have good knowledge about them and in fact some development knowledge so the post-installation phase is not my concern. I was only concerned about what the installation script do because I feel that they could have provided and option for installing without root.
apple-user-10 wrote:
I was only concerned about what the installation script do because I feel that they could have provided and option for installing without root.
That kind of speculation is a slippery slope to all kinds of good software development and distribution practices. Don’t go there.
Safe? What is “safe”? Homebrew isn’t malware, if that’s what you mean. It can scramble your environment.
No I didn't mean that it's malware of course 😅. What I suspected is that if in case of any in the end of homebrew, can it ruin my system or create some vulnerability?
You mean like Log4J?
Is it safe to provide root privilege while installing homebrew?
