Mac OS X High Sierra Permissions

Mike_Hathaway · January 26, 2018, 5:17pm

I am one of the many thrown out by CrashPlan. Currently I backup up to a freenas system using sftp. All clients systems are OS X 10.12 / 10.13 Most machines with multiple users and get read errors.
Looking at the options of loading duplicati on startup with a plist, but really want to get backup working properly first. The machines are logged and running duplicati as the initial administrator account.

And duplicati-monitoring.com… very cool.

----------error-------

Error reported while accessing file: /Users/mikehathaway/Pictures
System.UnauthorizedAccessException: Access to the path '/Users/mikehathaway/Pictures' is denied.
  at System.IO.__Error.WinIOError (System.Int32 errorCode, System.String maybeFullPath) [0x00129] in <6e9b92f0d119424382ef180639777acb>:0 
  at System.IO.FileSystemEnumerableIterator`1[TSource].HandleError (System.Int32 hr, System.String path) [0x00006] in <6e9b92f0d119424382ef180639777acb>:0 
  at System.IO.FileSystemEnumerableIterator`1[TSource].CommonInit () [0x00054] in <6e9b92f0d119424382ef180639777acb>:0 
  at System.IO.FileSystemEnumerableIterator`1[TSource]..ctor (System.String path, System.String originalUserPath, System.String searchPattern, System.IO.SearchOption searchOption, System.IO.SearchResultHandler`1[TSource] resultHandler, System.Boolean checkHost) [0x000d6] in <6e9b92f0d119424382ef180639777acb>:0 
  at System.IO.FileSystemEnumerableFactory.CreateFileNameIterator (System.String path, System.String originalUserPath, System.String searchPattern, System.Boolean includeFiles, System.Boolean includeDirs, System.IO.SearchOption searchOption, System.Boolean checkHost) [0x00009] in <6e9b92f0d119424382ef180639777acb>:0 
  at System.IO.Directory.InternalGetFileDirectoryNames (System.String path, System.String userPathOriginal, System.String searchPattern, System.Boolean includeFiles, System.Boolean includeDirs, System.IO.SearchOption searchOption, System.Boolean checkHost) [0x00000] in <6e9b92f0d119424382ef180639777acb>:0 
  at System.IO.Directory.InternalGetFiles (System.String path, System.String searchPattern, System.IO.SearchOption searchOption) [0x00000] in <6e9b92f0d119424382ef180639777acb>:0 
  at System.IO.Directory.GetFiles (System.String path) [0x0000e] in <6e9b92f0d119424382ef180639777acb>:0 
  at Duplicati.Library.Snapshots.NoSnapshot.ListFiles (System.String folder) [0x00000] in <77daa5b4404f4a3f88c47ead1428ebeb>:0 
  at Duplicati.Library.Utility.Utility+<EnumerateFileSystemEntries>d__22.MoveNext () [0x00244] in <1cb5198b00f34ae59d97ee7fe7a3a16c>:0

JonMikelV · January 28, 2018, 12:10am

Hi @Mike_Hathaway, welcome to the forum!

Due to how Duplicati stores configuring and database files I think you’ll find it easier to get the plist based service / daemon working first. Shifting from tray-icon to daemon often involves extras steps that can be avoided by starting as daemon.

If you still want to wait on that shift, I suspect you need to be running Duplicati as root rather than administrator.

Mike_Hathaway · January 28, 2018, 6:08am

I have 3 machines, I am working on one of them I am switching to the plist service daemon. Just not quite working yet.

Mike_Hathaway · January 30, 2018, 6:03am

I have duplicati working as a service and no more permissions errors. I installed the server.plist into the /Library/LaunchDaemons and the client .plist into /Library/LaunchAgents Works like a charm on 10.13 and 10.12

These are the plists

gist.github.com

https://gist.github.com/mohakshah/6ec2351bcf8e6898b4a3f79bfc2f12cf#file-net-duplicati-server-plist

net.duplicati.server.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>net.duplicati.server</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/Duplicati.app/Contents/MacOS/duplicati-server</string>
        <string>--webservice-port=8200</string>

This file has been truncated. show original

net.duplicati.tray-icon.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>net.duplicati.tray-icon</string>
    <key>ProgramArguments</key>
    <array>
        <string>open</string>
        <string>/Applications/Duplicati.app/</string>

This file has been truncated. show original

JonMikelV · January 31, 2018, 3:46am

Great! Does that mean we can flag your post as the solution or is there something else that needs to be address?

(By the way, I edited your initial post by adding “~~~” before and after the er message to make it more readable.)

Mike_Hathaway · January 31, 2018, 7:02pm

Yes this is a solution that could be flagged. Running on 3 systems. One completely remote from the sftp server.

jbmfc · November 8, 2018, 12:16am

Running perfectly for me on 10.14.1, thank you!

JonMikelV · November 8, 2018, 4:53am

Welcome to the forum, @jbmfc - and thanks for letting us know this worked for you!

kenkendk · November 8, 2018, 7:36am

I see it works for you, but my understanding is that this is part of security/privacy measures in MacOS Mojave.

At some point I will modify the build script to notarize the MacOS builds so they get this access. But until then you can use the workaround you found, or you can go to system settings -> security & privacy -> anonymity -> full disk access, and add Duplicati.app there.

doemaas · December 9, 2018, 11:01am

Actually looking for a nice way to cleanly start/stop/restart Duplicati on macOS Mojave, command line or otherwise, and was again set to the tray-icon path for that.

Followed all the right steps (I think), backups running nicely, but never got the tray-icon to work.

Forcing reloading and executing the tray-icon plist as follows:

sudo launchctl unload -w /Library/LaunchAgents/net.duplicati.tray-icon.plist 
sudo launchctl load -w /Library/LaunchAgents/net.duplicati.tray-icon.plist

I got the following from tail -f /var/log/system.log:

Dec  9 11:41:03 Transmogrifier com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system): Could not import service from caller: caller = open.3877, service = com.duplicati.app.17984, error = 134: Service cannot load in requested session
Dec  9 11:41:03 Transmogrifier com.apple.xpc.launchd[1] (net.duplicati.tray-icon[3877]): Service exited with abnormal code: 1

Any ideas to get this resolved?
Or have another possibility for clean start/stop/restart?

JonMikelV · December 12, 2018, 1:33pm

I’m not a Mac expert but could this be caused by the MacOS permission changes @kenkendk mentioned in the previous post?

doemaas · December 12, 2018, 7:37pm

initially don’t think so. The duplicati and duplicati-server scripts are both in the Duplicati.app packet, and this app has the right privacy settings. But I will dig deeper.

Furthermore, what is the best way of stopping, starting and restarting the Duplicati components?

JonMikelV · December 19, 2018, 7:31pm

On Windows I use Task Manager, Services, or sc command line.
On Linux I use systemd’s systemctl command.
On MacOS, um, I restart the machine.

I’m guessing @Pectojin might have a suggestion on what would be better for controlling the Duplicati service on MacOS.

Pectojin · December 19, 2018, 8:22pm

I gotta be honest. I’m hopelessly stuck in denial about the high sierra permissions. I’m not affected so I just use the default configured by the .pkg installer.

It’ll start by itself on boot, if I need to restart it I’ll exit from the tray icon and then start it through spotlight