Support Homebrew without sudo access by MikeMcQuaid · Pull Request #24062 · Homebrew/brew

MikeMcQuaid · 2026-09-21T20:42:22Z

Detect unavailable sudo conservatively and honour HOMEBREW_NO_SUDO.
Retry optional filesystem operations only when elevation is needed.
Reject casks requiring privileged installers before installation.
Use suitable group permissions for non-admin installation owners.
Let root switch console and package users when sudo is unavailable.
Document sudo-free operation and its limits.

Have you followed our Contributing guidelines?
Have you checked for other open Pull Requests for the same change?
Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
Have you explained why you'd like these changes included, not just what they do?
For bug fixes, have you given step-by-step brew commands to reproduce the bug?
Have you written new tests (excluding integration tests)? Here's an example.
Have you successfully run brew lgtm (style, typechecking and tests) locally?

I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Codex with GPT 6 Astra at Extra High effort, with local review and testing.

Copilot

Copilot review overview

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Reject all privileged install artifacts before installation · New

What changed in this PR

This PR adds support for managing Homebrew installations without sudo, including conservative sudo detection, optional filesystem elevation, dedicated-user dispatch, ownership handling and documentation updates.

Changes:

Adds HOMEBREW_NO_SUDO detection and optional elevation.
Adds brew as-brew-user and improves console-user dispatch.
Updates cask/package ownership, privileged-artifact handling, tests, docs and completions.

File	Description
package/scripts/postinstall	Updated as part of this pull request.
manpages/brew.1	Updated as part of this pull request.
Library/Homebrew/utils/as_user.sh	Updated as part of this pull request.
Library/Homebrew/test/test_bot/test_cleanup_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/system_command_sudo_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/startup/sudo_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/pkg_postinstall_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/install_steps_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/cmd/as-console-user_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/cmd/as-brew-user_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/cask/quarantine_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/cask/installer_no_sudo_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/cask/dsl/shared_examples/staged.rb	Updated as part of this pull request.
Library/Homebrew/test/cask/dsl/preflight_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/cask/caskroom_spec.rb	Updated as part of this pull request.
Library/Homebrew/test/cask/artifact/app_spec.rb	Updated as part of this pull request.
Library/Homebrew/test_bot/test_cleanup.rb	Updated as part of this pull request.
Library/Homebrew/system_command.rb	Updated as part of this pull request.
Library/Homebrew/sorbet/rbi/dsl/homebrew/env_config.rbi	Updated as part of this pull request.
Library/Homebrew/sorbet/rbi/dsl/homebrew/cmd/as_brew_user.rbi	Updated as part of this pull request.
Library/Homebrew/install_steps.rb	Updated as part of this pull request.
Library/Homebrew/extend/os/mac/cask/quarantine.rb	Updated as part of this pull request.
Library/Homebrew/extend/os/mac/cask/artifact/symlinked.rb	Updated as part of this pull request.
Library/Homebrew/env_config.rb	Updated as part of this pull request.
Library/Homebrew/dev-cmd/vendor-gems.rb	Updated as part of this pull request.
Library/Homebrew/dev-cmd/bottle.rb	Updated as part of this pull request.
Library/Homebrew/cmd/as-console-user.sh	Updated as part of this pull request.
Library/Homebrew/cmd/as-console-user.rb	Updated as part of this pull request.
Library/Homebrew/cmd/as-brew-user.sh	Updated as part of this pull request.
Library/Homebrew/cmd/as-brew-user.rb	Updated as part of this pull request.
Library/Homebrew/cask/utils.rb	Updated as part of this pull request.
Library/Homebrew/cask/staged.rb	Updated as part of this pull request.
Library/Homebrew/cask/quarantine.rb	Updated as part of this pull request.
Library/Homebrew/cask/installer.rb	Updated as part of this pull request.
Library/Homebrew/cask/caskroom.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/symlinked.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/relocated.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/pkg.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/moved.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/installer.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/binary.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/appimage.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/app.rb	Updated as part of this pull request.
Library/Homebrew/cask/artifact/abstract_artifact.rb	Updated as part of this pull request.
Library/Homebrew/brew.sh	Updated as part of this pull request.
docs/Support-Tiers.md	Updated as part of this pull request.
docs/Manpage.md	Updated as part of this pull request.
docs/Installation.md	Updated as part of this pull request.
docs/Homebrew-Security-and-Supply-Chain.md	Updated as part of this pull request.
docs/Homebrew-on-Linux.md	Updated as part of this pull request.
docs/FAQ.md	Updated as part of this pull request.
completions/zsh/_brew	Updated as part of this pull request.
completions/internal_commands_list.txt	Updated as part of this pull request.
completions/fish/brew.fish	Updated as part of this pull request.
completions/bash/brew	Updated as part of this pull request.

Files not reviewed (2)

Library/Homebrew/sorbet/rbi/dsl/homebrew/cmd/as_brew_user.rbi: File type not supported
Library/Homebrew/sorbet/rbi/dsl/homebrew/env_config.rbi: File type not supported

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

- Detect unavailable sudo conservatively and honour `HOMEBREW_NO_SUDO`. - Retry optional filesystem operations only when elevation is needed. - Reject casks requiring privileged installers before installation. - Protect non-admin `staff` installations from other users' writes. - Preserve stricter umasks in Homebrew and installer subprocesses. - Let root switch users without sudo and preserve command failures. - Skip optional system service probes when sudo is disabled. - Document sudo-free operation and its limits.

Copilot AI lite review requested due to automatic review settings September 21, 2026 20:42

MikeMcQuaid requested a review from a team as a code owner September 21, 2026 20:42

Copilot started reviewing on behalf of MikeMcQuaid September 21, 2026 20:42

View session

MikeMcQuaid force-pushed the homebrew-user-access branch from 141cbc1 to 1312ada Compare September 21, 2026 20:52

Copilot AI reviewed Sep 21, 2026

View reviewed changes

Comment thread Library/Homebrew/cask/installer.rb Resolved

MikeMcQuaid force-pushed the homebrew-user-access branch 5 times, most recently from 5b3d7a5 to a5f4778 Compare September 22, 2026 13:44

MikeMcQuaid added this pull request to stack #24072 September 22, 2026 13:44

MikeMcQuaid force-pushed the homebrew-user-access branch from a5f4778 to 3dece9e Compare September 22, 2026 13:53

p-linnane approved these changes Sep 22, 2026

View reviewed changes

Comment thread Library/Homebrew/cmd/as-console-user.sh Resolved

Comment thread Library/Homebrew/system_command.rb Resolved

MikeMcQuaid force-pushed the homebrew-user-access branch from 3dece9e to 1e7795f Compare September 23, 2026 03:38

MikeMcQuaid force-pushed the homebrew-user-access branch from 1e7795f to bbfa5f8 Compare September 23, 2026 14:45

MikeMcQuaid added this pull request to the merge queue Sep 23, 2026

Merged via the queue into main with commit d91b9d6 Sep 23, 2026
58 checks passed

MikeMcQuaid deleted the homebrew-user-access branch September 23, 2026 17:23

timkgh mentioned this pull request Sep 30, 2026

Linux homebrew: log spammed by sudo with a password is required ; TTY=pts/0 ; PWD=/home/user ; USER=root ; COMMAND=list #24137

Closed

4 tasks done

vboerchers mentioned this pull request Sep 30, 2026

Cask operations fail with can't find group for <gid> for AD/mobile accounts #24140

Closed

4 tasks done

bvolpato mentioned this pull request Nov 3, 2026

Skip id forks for read-only brew commands #24455

Merged

5 of 8 tasks

Navigation Menu

Repository navigation

Support Homebrew without sudo access - #24062

Support Homebrew without sudo access#24062
MikeMcQuaid merged 1 commit into
mainfrom
homebrew-user-access

MikeMcQuaid commented Sep 21, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

MikeMcQuaid commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MikeMcQuaid commented Sep 21, 2026 •

edited

Loading