Virtual-environments: Disable SIP in Mac OS Catalina

Created on 31 Mar 2020 · 13Comments · Source: actions/virtual-environments

We're planning on disabling SIP (System Integrity Protection) on Mac OS 10.15 images. The change is planned to take effect during the week of April 13th.

Please let us know of any concerns or questions you may have about this change.

Virtual environments affected

[x] macOS 10.15
[ ] Ubuntu 16.04 LTS
[ ] Ubuntu 18.04 LTS
[ ] Windows Server 2016 R2
[ ] Windows Server 2019

Apple

Source

alepauly

👍4

Most helpful comment

My use case is trying to launch TestCafe (browser automation) with Safari on OSX and it also fails as it requires automation and screen recording permissions.
Since the issue is closed are there any plans for addressing this at all in near future?

andrzej-kodify on 14 May 2020

👍5

All 13 comments

Why disable SIP?

It creates a bigger distance between running build scripting on an end user system compared to the Action/Pipeline VMs. In practice I have never had the need to disable SIP, sometimes some scripting needs to be changes. But still...

jeroenleenarts on 1 Apr 2020

👍2

thanks for the input @jeroenleenarts. At this point it's not set in stone that we'll disable it and we just wanted to get some feedback (rather quickly). The reason to disable it is because it allows for some workflows that don't with it enabled.

We agree that there's a risk with making the CI environment even more different from where the artifacts will eventually be run but want to get a sense of how users feel about it as well. Thanks again.

alepauly on 1 Apr 2020

👍1

@alepauly is this related to gaining programmatic access to microphone, location, camera?

Could this be an argument on a per-job basis e.g. disable_sip: true?

ydnar on 4 Apr 2020

@alepauly is this related to gaining programmatic access to microphone, location, camera?

Could this be an argument on a per-job basis e.g. disable_sip: true?

I think different customers need it for different reasons including building drivers, getting more access to certain OS components, and perhaps access devices.

Unfortunately a per-job variable is not possible at this time but it would definitely be ideal.

alepauly on 7 Apr 2020

At this time we're going to hold off on making this change based on feedback from customers in multiple channels. I'll reopen and pin this issue back up if we decide to go forward with it. Thanks all.

alepauly on 7 Apr 2020

😕2

I think different customers need it for different reasons including building drivers, getting more access to certain OS components, and perhaps access devices.

Unfortunately a per-job variable is not possible at this time but it would definitely be ideal.

Guessing this would be a wholly-separate macOS environment, e.g. macos-latest-sip-disabled?

Sorry to hear you’re abandoning this. It could be quite useful for testing iOS apps in a simulator.

ydnar on 7 Apr 2020

We would like to test https://github.com/eficode/robotframework-imagehorizonlibrary and it uses pyautogui for making actions which it does not work due to accessibility settings, I could change that with sqlite (https://apple.stackexchange.com/questions/178313/change-accessibility-setting-on-mac-using-terminal), but as it turns out there is SIP here which is preventing me to do just that.

matejc on 24 Apr 2020

👍4

I build kexts that I would like to kextload, and SIP disabled would certainly help, I would be able to avoid the whole codesign/certificate access in CI.

lundman on 12 May 2020

👍1

andrzej-kodify on 14 May 2020

👍5

Since the issue is closed are there any plans for addressing this at all in near future?

@andrzej-kodify, no plans right now but thanks for the input. We'll continue looking here and if we are able to figure out a way to offer it cost effectively, we will.

alepauly on 15 May 2020

@alepauly , a bunch of related customers requests that could be resolved by disabling SIP:

maxim-lobanov on 2 Jun 2020

👍3

ideally if we could have option to choose image with or without SIP we could test macOS apps in different environments. Another option could be if we can have a command to respond to macOS system prompts, such as allow/deny firewall prompts. Other macOS prompts for user consent could be enable/disable accessibility and other settings you can see in System Preferences -> Security & Privacy -> Privacy. Our automated UI tests are getting stuck at the moment when those prompts popup. Thank you for your support!