exec failed during post-install step

[ethanuppal]

Output of brew config

HOMEBREW_VERSION: 5.0.16-138-g3440c54
ORIGIN: https://github.com/Homebrew/brew
HEAD: 3440c54da55ba76331d3a047e0bda5883132d69f
Last commit: 2 hours ago
Branch: main
Core tap JSON: 11 Mar 10:52 UTC
Core cask tap JSON: 11 Mar 10:52 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 32
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 16
Homebrew Ruby: 4.0.1 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.1/bin/ruby
CPU: 16-core 64-bit arm_brava
Clang: 17.0.0 build 1700
Git: 2.39.5 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.7.2-arm64
CLT: 26.3
Xcode: 26.3
Metal Toolchain: N/A
Rosetta 2: false

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: A newer Command Line Tools release is available.
Update them from Software Update in System Settings.

If that doesn't show you any updates, run:
  sudo rm -rf /Library/Developer/CommandLineTools
  sudo xcode-select --install

Alternatively, manually download them from:
  https://developer.apple.com/download/all/.
You should download the Command Line Tools for Xcode 26.3.



This is a Tier 2 configuration:
  https://docs.brew.sh/Support-Tiers#tier-2
You can report issues with Tier 2 configurations to Homebrew/* repositories!
Read the above document before opening any issues or PRs.


Warning: The directory Xcode is reportedly installed to doesn't exist:
  /Applications/Xcode.app/Contents/Developer
You may need to `xcode-select` the proper path if you have moved Xcode.

Description of issue

Formula postinstalls do not complete successfully:

==> Postinstalling fish
brew: exec failed: /usr/sbin/sysctl
brew: exec failed: getconf
brew: exec failed: /usr/bin/xcode-select
brew: exec failed: /usr/bin/mdfind
brew: exec failed: /usr/sbin/pkgutil
brew: exec failed: /Library/Developer/CommandLineTools/usr/bin/clang
Warning: The post-install step did not complete successfully

(All of these tools successfully execute when run in /bin/bash.)

1. Build a native macOS container with https://github.com/darwin-containers/homebrew-formula
2. Get the latest supported command line tools and unpack their /Library to the root of the container
3. xcode-select -r
4. mount -t devfs devfs /dev
5. Install Homebrew
6. Install a formula, e.g., brew install fish

[SMillerDev]

Get the latest supported command line tools and unpack their /Library to the root of the container

Clearly this step didn't work because doctor is complaining about it:

Warning: A newer Command Line Tools release is available.
Update them from Software Update in System Settings.

If that doesn't show you any updates, run:
  sudo rm -rf /Library/Developer/CommandLineTools
  sudo xcode-select --install

Warning: The directory Xcode is reportedly installed to doesn't exist:
  /Applications/Xcode.app/Contents/Developer
You may need to `xcode-select` the proper path if you have moved Xcode.

[ethanuppal]

Also, the Popen in the ruby code fails on commands like getconf that don't seem to involve writing to /dev/null?

We redirect stderr to /dev/null. You can test running postinstall with HOMEBREW_STDERR=1 as a workaround and seeing if that makes things work.

Well, no exec failed at least...

# HOMEBREW_STDERR=1 brew postinstall fish
==> Postinstalling fish
NOTE:  Most system logs have moved to a new logging system.  See log(1) for more information.
Warning: The post-install step did not complete successfully
You can try again using:
  brew postinstall fish

[ethanuppal]

log stream --style compact --predicate 'sender=="Sandbox"'

I started log stream --style compact --predicate 'sender=="Sandbox"' > log.txt, then ran HOMEBREW_STDERR=1 brew postinstall fish, and cancelled the logging when done. It seems like a lot of things are being denied, but I'm not sure if they count as errors:

2026-03-18 00:54:21.765 Df kernel[0:383e6] (Sandbox) Sandbox: ContextStoreAgent(696) allow file-read-xattr /Applications/kitty.app/Contents/MacOS/kitty
2026-03-18 00:54:21.775 Df kernel[0:383e6] (Sandbox) Sandbox: ContextStoreAgent(696) allow file-read-data /Applications/kitty.app/Contents/Info.plist
2026-03-18 00:54:22.895 E  kernel[0:38667] (Sandbox) Sandbox: nice(16641) deny(1) file-write-data /private/d/vfs/.../dev/dtracehelper
2026-03-18 00:54:22.897 E  kernel[0:38668] (Sandbox) Sandbox: ruby(16641) deny(1) file-write-data /private/d/vfs/.../dev/dtracehelper
2026-03-18 00:54:23.133 E  kernel[0:3866e] (Sandbox) Sandbox: sysctl(16642) deny(1) file-write-data /private/d/vfs/.../dev/dtracehelper
2026-03-18 00:54:23.137 E  kernel[0:38672] (Sandbox) Sandbox: getconf(16643) deny(1) file-write-data /private/d/vfs/.../dev/dtracehelper
2026-03-18 00:54:23.329 E  kernel[0:38676] (Sandbox) Sandbox: xcode-select(16644) deny(1) file-write-data /private/d/vfs/.../dev/dtracehelper
2026-03-18 00:54:23.331 E  kernel[0:38668] (Sandbox) Sandbox: ruby(16641) deny(1) file-write-create /private/d/vfs/.../opt/homebrew/Cellar/fish/4.5.0/share/fish/vendor_functions.d

[Bo98]

Looks like that /private/d/vfs/... is breaking the sandbox. That last line in particular is likely why the post install is failing.

Check without HOMEBREW_STDERR too. We explicitly allow /dev/null (https://github.com/Homebrew/brew/blob/603412ff82ca6677dd8e477bdc23e2a8225c21ce/Library/Homebrew/sandbox.rb#L320) but I suspect it is seeing it as /private/d/vfs/.../dev/null and blocking it.

[Bo98]

With your Python test script (or even just directly in shell), try set up a similar rule where it blocks file-write* except for some /dev paths.

[ethanuppal]

With your Python test script (or even just directly in shell), try set up a similar rule where it blocks file-write* except for some /dev paths.

Looks like it is the case!

bash-3.2# cat sandbox.txt
(version 1)
(allow file-write*
        (literal "/dev/ptmx")
        (literal "/dev/dtracehelper")
        (literal "/dev/null")
        (literal "/dev/random")
        (literal "/dev/zero")
        (regex #"^/dev/fd/[0-9]+$")
        (regex #"^/dev/tty[a-z0-9]*$")
)
(deny file-write*)
(deny file-write-setugid)
(deny file-write-mode)
(allow default)

bash-3.2# sandbox-exec -f sandbox.txt "/bin/bash" "-c" "echo hi"
hi
bash-3.2# sandbox-exec -f sandbox.txt "/bin/bash" "-c" "echo hi > /dev/null"
/bin/bash: /dev/null: Operation not permitted

bash-3.2# cat log.txt | grep null
2026-03-19 01:11:07.330 E  kernel[0:4661d1] (Sandbox) Sandbox: bash(93992) deny(1) file-write-data /private/d/vfs/.../dev/null

Allowing a write to /private/d/vfs/.../dev/null made the issue go away. I guess /dev/null is not properly linked to /private/d/vfs/.../dev/null in the container?