Etcher can't elevate privileges from non-admin user on OS X Catalina

balenaEtcher
#1

I use a “standard” (non-admin) user on my OS X Catalina system. Most functions that require administrative privileges prompt me for both a username and a password. Etcher only prompts me for my password, which isn’t enough for it to elevate its privileges.

OS X version is 10.15.6, Etcher version is 1.5.109.

#7

Hey there,

Do you see any error messages?

Perhaps you can try running etcher directly from a terminal with sudo /Applications/balenaEtcher.app/Contents/MacOS/balenaEtcher

Hope this helps

#9

Your mail system is only allowing me to send you one attached/embedded image at a time so I’m going to split my reply across three emails.

(part 1/3)

Thanks for getting back to me.

sudo from the command line won’t work for me, because I’m running as the non-admin user “rick”:

lcmphkiengeangfm.png

rick@MacBook-Pro-723 ~ % sudo /Applications/balenaEtcher.app/Contents/MacOS/balenaEtcher
Password:
rick is not in the sudoers file. This incident will be reported.

This behavior isn’t new with Catalina; the “rick” user has never been able to sudo to root directly.

#10

(part 2/3)

In any case, Etcher launched from the desktop used to work without a problem because the authentication dialog would allow me to enter both the “admin” username and its password.

obmmlmamndifdogk.png

#11

(part 3/3)

The current version does work as expected on an older version of OS X. I
tried v1.5.109 on an El Capitan system (yes, that’s pretty old but
Etcher worked the same all the way through Mojave):

Other privileged functions on Catalina prompt me for the username and
password as expected; Etcher is the only program I have that’s
experiencing this problem.

Thanks,
Rick

ajnlogaieohckdpf.png

#37

Hello,
The elevation system used on versions < Catalina does not allow direct access to disks starting from Catalina.
This is why we use sudo ---askpass in that case. There is no way to specify a user with that method.
There is no better way to handle this for now.
There might be a way to avoid this: https://www.tweaking4all.com/hardware/raspberry-pi/applepi-baker-v2/#WritingtoaDiskSudoAccessvsHelperTool but I’m not sure this can work with an electron app. I’ll have a look if I find some time.

#39

Wouldn’t Etcher be allowed to do direct disk access if enabled in the Settings->Security&Privacy->Full Disk Access panel? If so, then granting that access might allow Etcher to be modified to go back to the previous behavior where the dialog included a place to enter the username.

If this can’t be worked around, then Etcher needs to inform the user that it needs to be run from an administrator account. Its current behavior - accepting a password and immediately returning back to the main screen without reporting an error - leads to confusion.

#42

At the moment this can’t be worked around so you’ll need an admin account. We’ll add a line in the docs to specify this.
We need to look into it but have a pretty busy queue, so if anyone feels like doing some tests and a PR with a different solution that works pre- and post-Catalina, they’re more than welcome

#44

Thanks for looking into it. I believe Catalina hasn’t completely broken the ability for non-admin users to write disk images to SD cards, as I’m able to do this with another program (Raspberry Pi Imager). It prompts me for an administrative user’s username and password, even when running from my non-admin account.

I like Etcher better, so I hope there’s a way of making it work. Thanks for looking into it!