Wireshark doesn't create group on install

[dershow]

I tried to upgrade wireshark2, and I also tried to install wireshark3. Each of them installs wireshark-chmodbpf which has notes that instruct the user to run:

sudo dseditgroup -q -o edit -a [USER] -t user access_bpf

However, when I try that, with my user name, I get:

Group not found.

The port should create this group. If that is not possible, the notes should indicate how a user can do that with any necessary information for the group to function correctly for wireshark. Without that, I can't run wireshark.

[mf2k (Frank Schima)]

I see the same issue.

[ghosthound]

I did not see this problem, pretty sure that wireshark-chmodbpf created the access_bpf group. I'm on 10.14.5, what macOS rev are you on?

[dershow]

I am on 10.14.5 as well. Perhaps you already had the group created from a prior version or some other testing or install that you did? I see this:

$ sudo find -x / -group access_bpf -ls
find: -group: access_bpf: no such group

[ghosthound]

I can think of a few workarounds:

You should be able to:

sudo port install wireshark3 -chmodbpf

and it should install without depending on wireshark-chmodbpf.

You can disable the wireshark-chmodbpf startup item and sudo chgrp wheel /dev/bpf* which should put the /dev/bpf entries back to "default". Presuming your user is a member of group wheel wireshark should then work. In fact, this chmod should work even if you do not disable the wireshark-chmodbpf startup item, you'll just have to do it after every reboot.

[ghosthound]

Replying to dershow:

I am on 10.14.5 as well. Perhaps you already had the group created from a prior version or some other testing or install that you did? I see this:

$ sudo find -x / -group access_bpf -ls
find: -group: access_bpf: no such group

Could be, the timestamp on the group file is from yesterday (which is not definitive proof it was created then). I'll try another system shortly and see what I get.

[dershow]

I would think that another work around is to just create the group by hand. I know that it can be done, but I am not sure what parameters and details are needed for access_bpf to function correctly and safely? Does it need a specific gid for example?

[jmroot (Joshua Root)]

The problem is that wireshark-chmodbpf only runs addgroup in pre-destroot. If you get a binary archive, that code never gets run on your machine.

[ra1nb0w]

I followed other ports. Have you some suggestions on how to place it to avoid the problem? thanks

[mf2k (Frank Schima)]

As long as it does not hurt to run it multiple times, you can use pre-activate.

[jmroot (Joshua Root)]

Well the other ports are broken too if they're only doing it at destroot time. Please file tickets against them. :)

Since it only need to be done once per machine, doing it in post-install is also OK (in addition to pre-destroot). Doing it at activation time also works but that potentially means the code runs more often than it needs to.

[ra1nb0w]

Ok. I create a PR that duplicate the addgroup to port-install. thank you!

[ra1nb0w]

see ​https://github.com/macports/macports-ports/pull/4509

[ra1nb0w]

In 4e4ff37b8b13d8e1f7aad59855e4a6761e3300d3/macports-ports (master):

wireshark-chmodbpf: fix group creation if installed from binary

fix group creation if installed from the binary package

Closes: #58537