[updater] macOS: updated .app installed with 0700 permissions (tempfile TempDir mode), unlaunchable for other users

Open Beginner friendly
#3,506 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
74/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
rust
Domain
release

Research direction

Read plugins/updater/src/updater.rs, especially the macOS install_inner flow at the extraction and final-rename locations around lines 1228-1238 and 1302. Reproduce the update on macOS and inspect the installed bundle with stat; done means the .app root is traversable by other users and they can launch it from /Applications.

Written by the indexing model from the issue text.

Description

platform: macos plugin: updater type: bug
Describe the bug

On macOS, an app updated through tauri-plugin-updater ends up installed with 0700 permissions on the .app bundle root. On multi-user Macs, every user other than the one who ran the update gets "You do not have permission to open the application" when launching it from /Applications.

Mechanism

In plugins/updater/src/updater.rs, macOS install_inner:

  1. The update is extracted into a tempfile::TempDir (L1228-L1230). tempfile creates temp directories with mode 0700 by design.
  2. The archive entries are unpacked with the first path component stripped (L1238), so the TempDir itself becomes the new bundle root.
  3. That directory is renamed into place as the installed .app (L1302). rename preserves the mode, so the installed bundle root is drwx------.

The tar entries inside keep their archived modes; it's specifically the bundle root directory (former TempDir) that ends up 0700. Nothing chmods it afterwards.

Reproduction

On any Mac with two user accounts:

  1. As user A, install an app whose updates ship via this plugin (fresh install from DMG: bundle root is drwxr-xr-x).
  2. Let the app auto-update.
  3. stat -f '%Sp %Su' /Applications/MyApp.app → drwx------ userA.
  4. As user B, try to launch the app → permission error (user B can't even traverse into the bundle).
Suggested fix

After the final rename (or on the extract dir before the rename), set the bundle root to 0755:

std::fs::set_permissions(&self.extract_path, std::fs::Permissions::from_mode(0o755))?;

Alternatively, extract into a child directory of the TempDir so the archived .app directory (with its own archived mode) is what gets renamed into place, rather than the TempDir itself.

Happy to open a PR either way.

Platform and versions
  • plugin: tauri-plugin-updater 2.10.0 (code unchanged at current v2 HEAD)
  • macOS (any); analysis done on macOS 27.0, tauri 2.11.2
Dominant language
Rust
Stars
1.8k
Forks
603
Avg merge
4d 1h
Merged PRs (30d)
11

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from tauri-apps/plugins-workspace

All issues in tauri-apps/plugins-workspace

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.