Why are symbolic followed when installating a .pkg payload?

Question

Created 1w

Replies 3

Boosts 0

Participants 2

In macOS Tahoe 26.7 or Sequoia 15.7.5 (and probably other prior versions), when you install a .pkg, symlinks are followed:

i.e. if your payload install a file to /Users/Shared/my-folder and, on the target volume, the /Users/Shared/my-folder item is a symbolic link to /Users/Shared/actual-folder, the file will be installed inside /Users/Shared/actual-folder.

It used to be possible to tell the installation framework/mechanism not to follow symbolic links by using the followSymLinks attribute in the raw package PackageInfo file. And in this case, the symbolic link would be replaced by a real directory and the file would be installed where it was supposed to be installed.

This attribute is apparently not taken into account anymore by the framework/mechanism.

[Q] Is this on purpose or is it a bug (in shove for instance)? If it is on purpose, why was it considered a good idea to always follow symbolic links considering the security issues this can create?

Answered by DTS Engineer in 906012022

Remember that the goal of DevForums is to help developers build products for Apple platforms. Given that, I can answer the implicit question here, namely, “Should I ship an installer package that relies on the the Apple installer following symlinks?” And the answer to that is, as I’m sure you’re aware, “No.”

If that’s not the question you want answered, feel free to reply back here with more details, but please keep in mind tip 3 of Quinn’s Top Ten DevForums Tips.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 1

DTS Engineer OP

Apple

6d

Recommended

Remember that the goal of DevForums is to help developers build products for Apple platforms. Given that, I can answer the implicit question here, namely, “Should I ship an installer package that relies on the the Apple installer following symlinks?” And the answer to that is, as I’m sure you’re aware, “No.”

If that’s not the question you want answered, feel free to reply back here with more details, but please keep in mind tip 3 of Quinn’s Top Ten DevForums Tips.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Answer 2

IHadToChooseAUserNameAndIdidntWantTo OP

6d

It's not really my question.

In the past, following or not following symbolic links could be controlled by the developer building the package (by using the modern version of the IFPkgFlagFollowLinks flag). Now, it looks like that the options that the developer set is not taken anymore into account by the installation mechanism of recent macOS versions.

This looks like both a regression bug and a security issue.

But at the same time since the package format has never been officially documented (contrary to the distribution XML file or Installer JS (with its own bugs: e.g. FB20448952)), it's difficult to file a bug report that states that an undocumented option that has been working for many years is not working anymore and is a regression.

But the behavior of always following symbolic links could be a security issue depending on where the items of the payload are to be installed.

Answer 3

DTS Engineer OP

Apple

5d

It's not really my question.

OK. But the rest of your reply doesn’t contain a question either [1].

Sorry to be so strict, but you have to remember that my mandate here is to help developers create products that use Apple’s APIs and tools, so I kinda need to know what developer-facing issue you’re trying to solve.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] At least not by the standard DTS metric of Are there any question marks? (-: