Skip to content

[Bug]: netdata-updater.sh runs install-required-packages.sh as root on macOS — same bug as #15027, but in the updater, not kickstart.sh #23467

Open
Bug
Open
[Bug]: netdata-updater.sh runs install-required-packages.sh as root on macOS — same bug as #15027, but in the updater, not kickstart.sh#23467
Bug
Assignees
Ferroin
Labels
bugneeds triageIssues which need to be manually labelled

Description

@Pablo1
Pablo1
opened on Aug 14, 2026

Bug description

netdata-updater.sh requires being run as root on macOS — it checks the invoking UID against the UID that performed the original install (INSTALL_UID in .environment, which is 0 for a from-source kickstart-build) and fatally refuses otherwise:

if echo "$INSTALL_TYPE" | grep -qv ^binpkg && [ "${INSTALL_UID}" != "$(id -u)" ]; then
  fatal "You are running this script as user with uid $(id -u). We recommend to run this script as root (user with uid 0)" U0011
fi

So in practice every macOS update on a from-source install is a sudo netdata-updater.sh invocation. It then downloads and runs install-required-packages.sh fresh from master on every update, with no privilege-dropping:

if ! "${bash}" "./install-required-packages.sh" ${opts} netdata >&3 2>&3; then
  error "Installing build dependencies failed. The update should still work, but you might be missing some features."
fi

install-required-packages.sh unconditionally refuses to run as root on macOS:

if [ ${EUID} -eq 0 ]; then
  echo >&2 "This script does not support running as EUID 0 on macOS. Please run it as a regular user."
  exit 1
fi

This is the identical bug reported and fixed in #15027 / PR #16675 — but that fix only patched kickstart.sh's install_local_build_dependencies() (adding a Darwin-specific branch to call it as the regular user instead of root). netdata-updater.sh has its own, independent call site for the same script that was never given the same treatment, so the bug still fires on every macOS update that requires sudo (i.e. any from-source kickstart-build install), deterministically. Confirmed this is still the case on current master, not just the v2.11.0 release.

Expected behavior

netdata-updater.sh should call install-required-packages.sh as the regular user on macOS, the same way kickstart.sh now does (per PR #16675), instead of inheriting root.

Steps to reproduce

  1. On an existing from-source macOS install, run sudo /usr/local/netdata/usr/libexec/netdata/netdata-updater.sh
  2. Observe: "This script does not support running as EUID 0 on macOS. Please run it as a regular user." followed by "Installing build dependencies failed. The update should still work, but you might be missing some features."

Installation method

kickstart.sh

System info

Darwin <hostname> 25.6.0 Darwin Kernel Version 25.6.0: Sat Jul 11 15:26:21 PDT 2026; root:xnu-12377.161.13~4/RELEASE_ARM64_T6000 arm64
ProductName:		macOS
ProductVersion:		26.6.1
BuildVersion:		25G76

Netdata build info

time=2026-08-13T21:13:28.915-07:00 comm=netdata source=daemon level=notice errno="2, No such file or directory" tid=1476998  msg="CONFIG: cannot load user config '/usr/local/netdata/etc/netdata/stream.conf'. Will try stock config."
Packaging:
    Netdata Version ____________________________________________ : v2.11.0
    Installation Type __________________________________________ : kickstart-build
    Package Architecture _______________________________________ : unknown
    Package Distro _____________________________________________ : unknown
    Configure Options __________________________________________ : cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_C_STANDARD=11 -DCMAKE_CXX_STANDARD=17 -DBUILD_SHARED_LIBS=OFF -DCMAKE_C_FLAGS=' -fexceptions -fno-omit-frame-pointer -funwind-tables -fasynchronous-unwind-tables' -DCMAKE_CXX_FLAGS='  -fexceptions -fno-omit-frame-pointer -funwind-tables -fasynchronous-unwind-tables' -DCMAKE_COMPILE_DEFINITIONS='HAVE_OSLOG' -DCMAKE_EXE_LINKER_FLAGS=' -fexceptions -rdynamic' -DCMAKE_SHARED_LINKER_FLAGS=''
Default Directories:
    User Configurations ________________________________________ : /usr/local/netdata/etc/netdata
    Stock Configurations _______________________________________ : /usr/local/netdata/usr/lib/netdata/conf.d
    Stock Data Files ___________________________________________ : /usr/local/netdata/usr/share/netdata
    Ephemeral Databases (metrics data, metadata) _______________ : /usr/local/netdata/var/cache/netdata
    Permanent Databases ________________________________________ : /usr/local/netdata/var/lib/netdata
    Plugins ____________________________________________________ : /usr/local/netdata/usr/libexec/netdata/plugins.d
    Static Web Files ___________________________________________ : /usr/local/netdata/usr/share/netdata/web
    Log Files __________________________________________________ : /usr/local/netdata/var/log/netdata
    Lock Files _________________________________________________ : /usr/local/netdata/var/lib/netdata/lock
    Home _______________________________________________________ : /usr/local/netdata/var/lib/netdata
Operating System:
    Kernel _____________________________________________________ : Darwin
    Kernel Version _____________________________________________ : 25.6.0
    Operating System ___________________________________________ : macOS
    Operating System ID ________________________________________ : macOS
    Operating System ID Like ___________________________________ : macOS
    Operating System Version ___________________________________ : 26.6.1
    Operating System Version ID ________________________________ : unknown
    Detection __________________________________________________ : sw_vers
Hardware:
    CPU Cores __________________________________________________ : 10
    CPU Frequency ______________________________________________ : unknown
    RAM Bytes __________________________________________________ : 34359738368
    Disk Capacity ______________________________________________ : 494384795648
    CPU Architecture ___________________________________________ : arm64
    Virtualization Technology __________________________________ : unknown
    Virtualization Detection ___________________________________ : none
Container:
    Container __________________________________________________ : unknown
    Container Detection ________________________________________ : none
    Container Orchestrator _____________________________________ : none
    Container Operating System _________________________________ : none
    Container Operating System ID ______________________________ : none
    Container Operating System ID Like _________________________ : none
    Container Operating System Version _________________________ : none
    Container Operating System Version ID ______________________ : none
    Container Operating System Detection _______________________ : none
Features:
    Built For __________________________________________________ : MacOS
    Netdata Cloud ______________________________________________ : YES
    Health (trigger alerts and send notifications) _____________ : YES
    Streaming (stream metrics to parent Netdata servers) _______ : YES
    Back-filling (of higher database tiers) ____________________ : YES
    Replication (fill the gaps of parent Netdata servers) ______ : YES
    Streaming and Replication Compression ______________________ : YES (zstd lz4 gzip brotli)
    Contexts (index all active and archived metrics) ___________ : YES
    Tiering (multiple dbs with different metrics resolution) ___ : YES (5)
    Machine Learning ___________________________________________ : YES
    Memory Allocator ___________________________________________ : system
Database Engines:
    sqlite _____________________________________________________ : 3.53.3
    dbengine (compression) _____________________________________ : YES (zstd lz4)
    alloc ______________________________________________________ : YES
    ram ________________________________________________________ : YES
    none _______________________________________________________ : YES
Connectivity Capabilities:
    ACLK (Agent-Cloud Link: MQTT over WebSockets over TLS) _____ : YES
    static (Netdata internal web server) _______________________ : YES
    WebRTC (experimental) ______________________________________ : NO
    Native HTTPS (TLS Support) _________________________________ : YES
    TLS Host Verification ______________________________________ : YES
Libraries:
    LZ4 (extremely fast lossless compression algorithm) ________ : YES
    ZSTD (fast, lossless compression algorithm) ________________ : YES
    zlib (lossless data-compression library) ___________________ : YES
    Brotli (generic-purpose lossless compression algorithm) ____ : YES
    protobuf (platform-neutral data serialization protocol) ____ : YES (system)
    OpenSSL (cryptography) _____________________________________ : YES
    libdatachannel (stand-alone WebRTC data channels) __________ : NO
    JSON-C (lightweight JSON manipulation) _____________________ : YES
    libcap (Linux capabilities system operations) ______________ : NO
    libcrypto (cryptographic functions) ________________________ : YES
    libyaml (library for parsing and emitting YAML) ____________ : YES
    libmnl (library for working with netfilter) ________________ : NO
    stacktraces (library for getting stack traces) _____________ : unknown
Plugins:
    apps (monitor processes) ___________________________________ : YES
    cgroups (monitor containers and VMs) _______________________ : NO
    cgroup-network (associate interfaces to CGROUPS) ___________ : NO
    proc (monitor Linux systems) _______________________________ : NO
    tc (monitor Linux network QoS) _____________________________ : NO
    diskspace (monitor Linux mount points) _____________________ : NO
    freebsd (monitor FreeBSD systems) __________________________ : NO
    macos (monitor MacOS systems) ______________________________ : YES
    macos-logs (monitor macOS unified logs) ____________________ : YES
    windows (monitor Windows systems) __________________________ : NO
    statsd (collect custom application metrics) ________________ : YES
    timex (check system clock synchronization) _________________ : YES
    idlejitter (check system latency and jitter) _______________ : YES
    bash (support shell data collection jobs - charts.d) _______ : YES
    debugfs (kernel debugging metrics) _________________________ : NO
    cups (monitor printers and print jobs) _____________________ : YES
    ebpf (monitor system calls) ________________________________ : NO
    freeipmi (monitor enterprise server H/W) ___________________ : NO
    network-viewer (monitor TCP/UDP IPv4/6 sockets) ____________ : YES
    systemd-journal (monitor journal logs) _____________________ : NO
    windows-events (monitor Windows events) ____________________ : NO
    nfacct (gather netfilter accounting) _______________________ : NO
    perf (collect kernel performance events) ___________________ : NO
    slabinfo (monitor kernel object caching) ___________________ : NO
    Xen ________________________________________________________ : NO
    Xen VBD Error Tracking _____________________________________ : NO
Exporters:
    AWS Kinesis ________________________________________________ : NO
    GCP PubSub _________________________________________________ : NO
    MongoDB ____________________________________________________ : NO
    Prometheus (OpenMetrics) Exporter __________________________ : YES
    Prometheus Remote Write ____________________________________ : NO
    Graphite ___________________________________________________ : YES
    Graphite HTTP / HTTPS ______________________________________ : YES
    JSON _______________________________________________________ : YES
    JSON HTTP / HTTPS __________________________________________ : YES
    OpenTSDB ___________________________________________________ : YES
    OpenTSDB HTTP / HTTPS ______________________________________ : YES
    All Metrics API ____________________________________________ : YES
    Shell (use metrics in shell scripts) _______________________ : YES
Debug/Developer Features:
    Trace All Netdata Allocations (with charts) ________________ : NO
    Developer Mode (more runtime checks, slower) _______________ : NO
Runtime Information:
    Profile ____________________________________________________ : standalone
    Stream Parent (accept data from Children) __________________ : NO
    Stream Child (send data to a Parent) _______________________ : NO
    Total System Memory ________________________________________ : 34359738368
    Available System Memory ____________________________________ : 13120618496

Additional info

For reference, the exact fix that landed for the kickstart.sh case (PR #16675) was a Darwin-specific branch in install_local_build_dependencies():```diff- if ! run_as_root "${bash}" "${tmpdir}/install-required-packages.sh" ${opts} netdata; then

  • warning "Failed to install all required packages, but installation might still be possible."
    • if [ "$(uname -s)" = "Darwin" ]; then
    • if ! run "${bash}" "${tmpdir}/install-required-packages.sh" ${opts} netdata; then
    •  warning "Failed to install all required packages, but installation might still be possible."
    • fi
    • else
    • if ! run_as_root "${bash}" "${tmpdir}/install-required-packages.sh" ${opts} netdata; then
    •  warning "Failed to install all required packages, but installation might still be possible."
    • fi
  • fi

The equivalent branch in netdata-updater.sh's own dependency-install block (currently unconditional, no uname check) would presumably fix this the same way.

Metadata

Metadata

Assignees

Labels

bugneeds triageIssues which need to be manually labelled

Type

Bug

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions