I kindly ask for a review of my approach before I proceed with MRs.
Using a dedicated group doesn’t work, as described here, regardless if it is a dedicated linuxbrew group, or an existing one like wheel.
I think I solved the issue by making three changes in different places of the system.
Change 1, install Homebrew as a dedicated user
In /usr/share/ublue-os/just/05-brew.just (source) create a new user account and run Homebrew installer as the new user:
(...)
if [ "$ACCEPT" == "YES I UNDERSTAND" ]; then
# Homebrew installed as a separate user
# enables easy sudo alias on multi-account systems
sudo useradd linuxbrew
sudo chmod go+rx /home/linuxbrew # gives access to completion scripts
sudo -Hu linuxbrew /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
else
(...)
Change 2, alias “brew” to run as linuxbrew user
In file /etc/profile.d/brew.sh add the alias:
#!/usr/bin/env bash
alias brew='sudo -Hu linuxbrew /home/linuxbrew/.linuxbrew/Homebrew/bin/brew'
[[ -d /home/linuxbrew/.linuxbrew && $- == i ]] && eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
Change 3, passwordless sudo for admins to run brew as linuxbrew
Create a file /etc/sudoers.d/brew-for-all with the following sudo rule:
# This drop-in enables all administrators to use Homebrew as linuxbrew user without password
%wheel ALL=(linuxbrew) CWD=/tmp NOPASSWD: /home/linuxbrew/.linuxbrew/Homebrew/bin/brew
Homebrew needs a writable current working directory, and fortunately sudo has a CWD option for that.
A missing piece: migration of existing brew installations
Migration should be possible by retroactively creating a user with a home directory in /home/linuxbrew, and setting proper ownerships and permissions on the home directory recursively.
A question: what is this brew installation script for?
I wonder if this script also needs changes, any help appreciated:
ublue-os/bluefin/blob/main/build_files/brew.sh