Re: Critical infrastructure update failing in TLU alone

> On 18 Aug 2026, at 17:52, Karl Berry <[email protected]> wrote:
> 
>            macOS 27.0 Beta 6
> 
> Maybe the new mac beta is refusing to execute any program it does not like?
> Did you install previous updates on this same OS version?
> 
> Or maybe there is some kind of new problem Apple is inflicting on what
> the shell script is doing.

Hi Karl,

Thanks for listening.

Infrastructure updates in TLU still worked on macOS 27 Beta 3 (July 6). They no longer work on Beta 5 (August 10) and 6 (August 17). So if the problem comes from macOS, it's caused by one of the following updates

	macOS 27 Beta 3 v2 (July 14)
	macOS 27 Beta 4 (July 20)  
	macOS 27 Beta 5 (August 10)

Unfortunately the release notes at <https://developer.apple.com/documentation/macos-release-notes/macos-27-release-notes> are cumulative, they don't list things separately for each beta version.

At present I only have access to macOS 27 Beta 5 and 6. On Friday I'll get access to macOS 11 Big Sur from 2020, but I have no Mac with any of the macOS versions in between. 

> I (or rather the scripts) prepared this update in the same way as all
> previous ones, and the actual update was tiny (a few lines in TLPDB.pm).
> Nothing substantive changed on the TL side, afaik.
> 
> There are various things you can do to take the update more step by step.
> Run it with --help.  In particular, you might try running it with 
> --target foodir --noexec and then you should have the contents of the
> archive without the script being run. Then you should have the script in
> foodir/runme.sh and can run with sh -vx or otherwise debug. I think.
> I haven't done this in a while.

update-tlmgr-latest.sh runs perfectly fine in Terminal. It's only when it's run by TLU that things get awry.

As far as I could reconstruct:

- TLU sets the path with

	TLMEnvironment updatePathEnvironment

from <https://github.com/amaxwell/tlutility/blob/master/TLMEnvironment.m>, which calls setenv.

- Then it downloads update-tlmgr-latest.sh and runs it indirectly, through

	TLMAuthorizedOperation main
	TLMAuthorizedOperation setWrapperPID
	TLMAuthorizedOperation setUnderlyingPID

from <https://github.com/amaxwell/tlutility/blob/master/TLMAuthorizedOperation.m>, which call

	tlu_ipctask

from <https://github.com/amaxwell/tlutility/blob/master/tlu_ipctask.m>.

That's as far as I can go. Figuring out what's happening there is beyond me. I don't even know C, I can try to guess a few things but that's all.

One thing I can tell is that TLU uses the deprecated but still functional AuthorizationExecuteWithPrivileges() (AEWP) to run processes as root. Adam writes in TLMAuthorizedOperation.m (lines 479--490)

         /*
         Apple's current documentation [1] says to use launchd to run processes as root and they provide a sample [2] to do
         this.  However, using AEWP is still suggested as viable for an "installer" process, and I'm interpreting that loosely.
         Wedging IPC into the launchd process would be non-trivial, unless Apple improves the performance of asl_search to
         become usable; my tests showed that it took ~10 seconds per query, so it's worthless for progress updates to a tableview.
         In any case, I suspect that tlmgr itself is a more significant security hole, just because of the complexity of its
         job and the multiple subprocesses involved; the actual act of running it with root privileges is trivial by comparison.
         
         [1] http://developer.apple.com/documentation/Security/Conceptual/authorization_concepts/01introduction/chapter_1_section_1.html
         [2] http://developer.apple.com/samplecode/BetterAuthorizationSample/listing4.html
         
         */

AEWP is changing in macOS 27. On the plus side, since the first beta, it allows authentication via TouchID (ie with fingerprint) as an alternative to typing the password. Before macOS 27, it didn't.

But maybe on the minus side, since the latest betas, it no longer provides what TLU expects of it.

Wait: if I interpret <https://github.com/Lyutoon/macOS_DSH_LPE> correctly, a vulnerability using AuthorizationExecuteWithPrivileges has been disclosed very recently (2026-07-18), and "Apple confirmed the underlying bug had already been fixed in a macOS 26.6 beta from mid-June 2026". So maybe the latest betas of macOS 27 include the same security fix, and that's what's disrupting TLU.

Bruno