restic and backrest path change with every upgrade and need for permissions change

[amarendra]

I just started it using 2-3 days ago so still getting the hang of it but so far liking it. It's simple and it just works without getting in the way or how restic is configured.

However I noticed this when I upgraded from 1.5.0 to 1.5.1 that I had to give fresh permission to Photos/etc access, Full Disk Access, and also approval for objective-see/LuLu as well. Because apparently every version is referenced from its path which contains the version number in it.

Can it be avoided? Or is there already a way that can avoid it (maybe I am not aware of that)?

[garethgeorge]

Hey— thanks for filing this, hadn’t been aware macOS users were running into this.

I think it could make sense for backrest to try to keep the path static and instead use the restic executable itself to check the version (via version command).

Will macOS retain the full disk access permissions even if the binary checksum changes? Is the path the only thing that matters?

[amarendra]

I am granting it to backrest which is what the prompt was for. (I get promot for restic only when LuLu intercepts n/w calls, that is because that's the process making those n/w calls I guess).

file access

(As of now backrest+restic is able to access all the files in my include list except ~/Library/Messages/chat.db. Don't know what special permission is needed for this.

Unfortunately apple has no official docs on how the feature behaves

Yeah, that's classic Apple.

When I go and see in Privacy & Security there are two section related to this:

Files and Folders which has 2 instances of backrest. Looks like the one greyed out is the one which was 1.5.0 and is orphaned there for some reason. So yeah keeping the path of binary static might help. It used to work for restic cli. I never had to redo the permissions either for Mac's privacy restrictions or for LuLu.

Let me remove the both backrest and then give fresh full disk access permission to the 1.5.1 backrest binary I will share here what happens. → This worked. backrest was able to access even ~/Library/Messages. I verified it with snapshot browser (which is a neat killer feature by the way; thank you!).

(I do see backrest in /opt/homebrew which points to the latest backrest version - can that not made to work? Not sure how other apps from homebrew work, or how restic cli works)

[garethgeorge]

Hmm, I wonder if this is fundamentally a homebrew issue with the paths changing? That's annoying if the case -- using the included install script will keep the path static -- but isn't great because you miss out on automatic updates.

[amarendra]

/opt/homebrew

Can you not have the service point to this path's binary? It anyway always points to the latest version, right? (But then I don't know how Mac treats permissions and symlinks).

I guess might need to see how restic handles it. Because I needed to provide permissions only once across upgrades (iirc).

But Mac GUI apps anyway just move the latest .app file (actually folder) to /Applications/ and get done with it.

[garethgeorge]

Iiuc homebrew is creating a symlink? I think what I'm wondering is if the problem is that macOS is checking the actual location that the symlink resolves to, and that location might be changing after each upgrade?

[amarendra]

Iiuc homebrew is creating a symlink?

I would certainly think so.

I do see a conversation about it in restic issues from 2018 here - restic/restic#2051 (comment). There might be more.