Repository navigation
Conversation
miharp
force-pushed
the
docs/macos-full-disk-access
branch
2 times, most recently
from
September 27, 2026 17:07
0e00a8c to
5de74f6
Compare
miharp
marked this pull request as ready for review
September 28, 2026 10:21
miharp
force-pushed
the
docs/macos-full-disk-access
branch
4 times, most recently
from
October 8, 2026 15:49
4daf2fe to
a7597e4
Compare
macOS blocks some changes the agent makes, such as deleting users and editing crontabs, unless the process has Full Disk Access. Add a step and a section to the macOS install pages that recommend granting it, show the failure, and explain how to grant access to the bundled Ruby interpreter, which is the process macOS checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Michael Harp <mike@mikeharp.com>
miharp
force-pushed
the
docs/macos-full-disk-access
branch
from
October 12, 2026 12:53
a7597e4 to
efea0e7
Compare
jay7x
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #492
Adds an Allow Full Disk Access section to the macOS install page for 8.x and 9.x, and a step in "After installation" that recommends it for every Mac.
The section covers:
eDSPermissionErrorfailure users will see/opt/puppetlabs/puppet/bin/ruby, rather than thepuppetwrapper, and what that grant coversThe content comes from the lab tests posted on #492:
The Full Disk Access grant carries over agent upgrades. In the VM, Ruby was granted on 8.28.1, then the agent was upgraded to 8.29.0 and then to 9.0.0-rc1. Each upgrade installed a new
rubybinary, and a launchd job could still delete a user after each one, with no new prompt. The bundled Ruby is signed with Overlook InfraTech's Developer ID (team7952TDBYDV), and macOS ties the grant to that signature rather than to the exact file.Out of scope
Granting access through a PPPC profile from MDM. The page points fleet admins to it, but the profile contents depend on each MDM product and are left to the admin.
Assisted by Claude.