Self Service App Permission

[jrauch]

I cannot for the life of me figure this out. I've got an Application I put out on Self Service that won't allow students to open it. I used Composer to create a PKG (and a DMG) attached it to the policy. It installs no problem, Applications is whitelisted and other Apps work. When they try to open it, it says they don't have permissions to open the application. I'm not sure what else to try here.

[mm2270]

Did you make any adjustments to the permissions on the app itself while in Composer? Generally speaking, it's a good practice to examine the permissions on the app inside Composer and make any adjustments to make sure it's not set in a way that only one user has access to open it.

Another thought - how did you build the package? Was it a snapshot? If so, some apps don't play well when captured this way and deployed. The "permissions" error could simply be the OSes way of saying it's not able to run the app because it wasn't installed correctly. I'm not sure what application this is, so I'm just speculating on that. It might help if you mention the app name. Some of us here might have experience with it.

[jrauch]

The app is Drosophila Genetics Lab 3.301, it's specific to a teacher/class. They've got two installs, a zipped file with the Application only, no packaging or anything. You simply unzip it and move the the whole folder into the Applications. Then run the App from there. A second is a PKG file which goes through and install of the Application.

What I've done: Moved the Application to Composer after it's been installed.
Moved the package to Composer and converted it to a source.

I've attached two screenshots of the current permission settings.

[mm2270]

So first, why convert the package to a source in Composer? Jamf Pro can take native package installs as is and deploy them. Unless you tested the package installer from the vendor and it wasn't working? Otherwise there should be no need to pull them into Composer for conversion. The only reason I've needed to do that is to more closely examine the contents of the package, like any possible scripts in it.

Anyway, if you haven't done so already, just try using the installer package as it comes from the software developer to see if that works.

Lastly, just looking at that very old looking folder icon makes me think perhaps this is an old app that hasn't been updated in a while. I didn't ask it before, but I was wondering if this was a case of an old app that is trying to run on a modern OS version. Could that be it?

[jrauch]

The package works until I put it into Casper Admin. I tried installing it via USB on mine and a student test machine and it works. So there's some disconnect when sending out through Casper. I just tried again with the PKG file and now it's giving me a App is corrupt or damaged message. Me creating different DMG/PKG files in Composer was just troubleshooting.

[mm2270 · Accepted solution]

Ok, I didn't look close enough before, but in your first screenshot of the permissions on the app itself, it looks like only "administrator" can open it. There need to be checks for the staff group at least for Read and Execute (R + X) If not, only the account "administrator" can execute the app bundle. You should probably also set Everyone to the same permissions as staff.

[jrauch]

That was it, darn permissions. To be completely honest I didn't know you could edit the permissions in Composer. So that's why I'm probably having so much trouble with some Apps.

[mm2270]

Well, I'm glad that got it sorted for you, and it wasn't something strange like how the app installs itself. Sometimes the errors we see actually mean what they say! This was one of those cases :)

So you know also for the future, if you look in Composer, that little gear icon to the bottom right of the permissions setting is something you'll want to look at as well. Another way to fix this would have been to click on the enclosing "Drosophila Genetics Labs 3.301" folder and then click that gear icon and choose the menu item called "Apply Permissions to <folder name> and All Enclosed Items" This does a recursive permissions adjustment, making sure every item under that directory have the same as the directory itself. I say that because in your 2nd screenshot, it looks like that enclosing directory had the correct permissions.

There are several other options under that menu that can help as well.