Switching homebrew to work without sudo

[EricFriedlander]

Hello!

My school (where I'm employed) got randsom-wared last last year. As a result, they now have installed "admin-by-request" on all school owned computers and I no longer have sudo access. As I understand it (and I apologize if this is wrong) homebrew can work when you don't have sudo access. However, when I originally installed homebrew, I had sudo access so now when I try to install things I get " is not in the sudoers file. This incident will be reported.". Is there a way to switch homebrew so that it no longer requires sudo access without breaking anything? I can potentially get sudo access temporarily to make the changes if necessary.

Thanks!

[SMillerDev]

A new homebrew install only requires sudo when installing homebrew itself. What are you running that gives this error?

[EricFriedlander]

Hmmm. That makes sense. The question I have is that my school uses "admin by request". When I request administrative privileges, I have no problem with the Edge installer. However, the homebrew installation still fails with the same message. Any idea why that could be?

[gromgit]

Apologies, was posting before ☕. Installing casks does invoke sudo, as your error message actually indicated, and my own test confirms:

$ brew install --debug --verbose --cask microsoft-edge
[...]
==> Installing artifact of class Cask::Artifact::Pkg
==> Running installer for microsoft-edge; your password may be necessary.
Package installers may write to any location; options such as `--appdir` are ignored.
/usr/bin/sudo -E -- /usr/bin/env LOGNAME=aho USER=aho USERNAME=aho /usr/sbin/installer -pkg /opt/homebrew/Caskroom/microsoft-edge/101.0.1210.39/MicrosoftEdge-101.0.1210.39.pkg -target / -verboseR -applyChoiceChangesXML /opt/homebrew/tmp/choices20220512-58408-9ndoa1.xml
Password:

and I see from https://www.adminbyrequest.com/Mac that:

For security reasons, sudo access is disabled during administrator sessions by default. This can be enabled in the settings or a policy file (see Mac policies). We do not recommend enabling sudo access unless absolutely necessary. Admin By Requests has checks in place to prevent system tampering using sudo, but due to the root-level access, it is impossible to fully protect against tampering using sudo. Consider using the build-in /etc/sudoers file, if only certain commands needs to be run with sudo. The Admin By Request sudo settings will not override normal /etc/sudoers settings.

Since sudo is used to invoke the macOS system install tool, and given your environment runs Admin By Request because malware got installed, I doubt your admins would be happy to add that command to /etc/sudoers. I'm afraid enabling the required access is something you'll have to discuss with them.

[EricFriedlander]

Am I right in understanding that it is possible to set-up homebrew to not use sudo? And if so, how can I switch it without messing things up. Assume that I can get temporary sudo access to make the change...

[SMillerDev]

If you only use formula you will not need sudo. But that is not a common usecase for homebrew

[Kentzo]

Note that it's a flaw in the current implementation of Homebrew to unconditionally require sudo for installer packages (files with the pkg extension like in your case).

I'm trying to address this via Homebrew/brew#14593