Epic: `sudo` handling on macOS

This is an extended version of #1127:

We have 3 different levels of users:

1. Regular users without access to sudo (or don’t want to use it)
2. Users with sudo access requiring a password
3. Users with password-less sudo by default

sudo is required for the following operations:

• install vmnet related binaries into /opt/rancher-desktop
• create /etc/sudoers.d/rancher-desktop-lima
• start lima instance using a vmnet instance
• overwrite /var/run/docker.sock
• create symlinks in /usr/local/bin (see #1155)

Right now setting up and using vmnet is not optional, so it is impossible to run Rancher Desktop at all without sudo.

Tasks:

• #1700
• Run in reduced functionality mode when sudo is unavailable
  • #1226
  • #1937
  • #1841
    • #910
• #1225
• Replace use of sudo in code with a setuid helper process
  • This will reduce the frequency of prompts (to once per RD version)
  • For macOS, we may need to see if SMJobBless is a better fit.
  • Ship separate admin-installable package for setuid helper
    • This is to support scenarios where the admin can install things system-wide, but not modify the user configuration.
  • Figure out self-updating of setuid helper
    • Will probably require checking code signing; check if this works with out signing setup
    • Will need to do something for Linux (where there’s no standard code signing beyond the whole package).
• Verify that RD works when installed into $HOME/Applications
• #1128

---

Related issues:

• #1615
• #1968

[pboushy]

sudo is required for the following operations:

• install vmnet related binaries into /opt/rancher-desktop
• create /etc/sudoers.d/rancher-desktop-lima
• start lima instance using a vmnet instance
• overwrite /var/run/docker.sock
• create symlinks in /usr/local/bin

I’m the Mac enterprise administrator for my company, and looking at Rancher Desktop to replace Docker Desktop on a few hundred systems. Here’s my preferred mechanism for most of this:

It would be ideal for these items to be rolled up into a PKG, that either Rancher Desktop installs when it doesn’t detect them (if user is admin) OR that an admin can install as part of providing Rancher Desktop to non-admins.

As Mac Admins, we use tools like Jamf Pro, VMWare’s Workspace One, or Munki to provide software to our employees. Those tools have the ability to deploy Rancher Desktop, and immediately following install the “support utilities PKG” This would also allow mass deployment with minimal config required from developers.

[jandubois]

@pboushy offered on Slack:

I build alot of scripts and stuff to generate PKGs for custom packages we have. Let me know if there’s anything I can do to help y’all with that. I also have some experience with privileged helpers that would allow a normal user to run Rancher Desktop and Rancher Desktop create those items.

cc/ @mook-as