macOS: skip chflags on fresh installs where /Users/<boinc_user> does not exist

CreateUserAndGroup() unconditionally runs chflags on /Users/<name>,
but on fresh installs the home directory is /var/empty. chflags fails,
CreateBOINCUsersAndGroups returns 256, all retries fail, and the
permission-setting functions never execute.

Fix: check with access() before calling chflags. Also rebuild buf2
to the filesystem path since it was overwritten to the DSCL path.

Additionally fix the PostInstall retry loop: REPORT_ERROR(i >= RETRY_LIMIT)
is never true inside a i < RETRY_LIMIT loop (off-by-one), and return
non-zero when security setup fails so the installer reports failure.

Fixes #6963

Author: RedesignedRobot

clientgui/mac/SetupSecurity.cpp

@@ -986,25 +986,30 @@ static OSStatus CreateUserAndGroup(char * user_name, char * group_name) {
 
     // Hide the home directory and share point https://support.apple.com/en-mn/102099
     // Something like "sudo chflags hidden /Users/boinc_master"
-    args[0] = "/usr/bin/sudo";
-    args[1] = "chflags";
-    args[2] = "hidden";
-    args[3] = buf2;
-    args[4] = NULL;
-    err = posix_spawnp(&thePid, "/usr/bin/sudo", NULL, NULL, args, environ);
-    waitpid(thePid, &status, WUNTRACED);
-    if (status != 0) {
-        err = status;
-    } else {
-        if (WIFEXITED(status)) {
-            err = WEXITSTATUS(status);
-            if (err == 1) {
-                err = errno;
-            }
-        }   // end if (WIFEXITED(status)) else
-    }       // end if waitpid returned 0 sstaus else
-if (err)
-    return err;
+    // buf2 was overwritten to DSCL path "/users/<name>" above; rebuild filesystem path.
+    // Skip if the directory doesn't exist (fresh installs set home to /var/empty).
+    sprintf(buf2, "/Users/%s", user_name);
+    if (access(buf2, F_OK) == 0) {
+        args[0] = "/usr/bin/sudo";
+        args[1] = "chflags";
+        args[2] = "hidden";
+        args[3] = buf2;
+        args[4] = NULL;
+        err = posix_spawnp(&thePid, "/usr/bin/sudo", NULL, NULL, args, environ);
+        waitpid(thePid, &status, WUNTRACED);
+        if (status != 0) {
+            err = status;
+        } else {
+            if (WIFEXITED(status)) {
+                err = WEXITSTATUS(status);
+                if (err == 1) {
+                    err = errno;
+                }
+            }   // end if (WIFEXITED(status)) else
+        }       // end if waitpid returned 0 sstaus else
+        if (err)
+            return err;
+    }
 
     err = ResynchDSSystem();
     if (err != noErr)

mac_installer/PostInstall.cpp

@@ -384,27 +384,27 @@ int main(int argc, char *argv[])
     for (i=0; i<RETRY_LIMIT; ++i) {
         err = CreateBOINCUsersAndGroups();
         if (err != noErr) {
-            printf("CreateBOINCUsersAndGroups returned %d (repetition=%d)", err, i);
+            printf("CreateBOINCUsersAndGroups returned %d (repetition=%d)\n", err, i);
             fflush(stdout);
-            REPORT_ERROR(i >= RETRY_LIMIT);
+            REPORT_ERROR(i >= RETRY_LIMIT - 1);
             continue;
         }
 
         // err = SetBOINCAppOwnersGroupsAndPermissions("/Applications/GridRepublic Desktop.app");
         err = SetBOINCAppOwnersGroupsAndPermissions(appPath[brandID]);
 
         if (err != noErr) {
-            printf("SetBOINCAppOwnersGroupsAndPermissions returned %d (repetition=%d)", err, i);
+            printf("SetBOINCAppOwnersGroupsAndPermissions returned %d (repetition=%d)\n", err, i);
             fflush(stdout);
-            REPORT_ERROR(i >= RETRY_LIMIT);
+            REPORT_ERROR(i >= RETRY_LIMIT - 1);
             continue;
         }
 
         err = SetBOINCDataOwnersGroupsAndPermissions();
         if (err != noErr) {
-            printf("SetBOINCDataOwnersGroupsAndPermissions returned %d (repetition=%d)", err, i);
+            printf("SetBOINCDataOwnersGroupsAndPermissions returned %d (repetition=%d)\n", err, i);
             fflush(stdout);
-            REPORT_ERROR(i >= RETRY_LIMIT);
+            REPORT_ERROR(i >= RETRY_LIMIT - 1);
             continue;
         }
 
@@ -414,14 +414,23 @@ int main(int argc, char *argv[])
             true, false, NULL, 0
         );
         if (err != noErr) {
-            printf("check_security returned %d (repetition=%d)", err, i);
+            printf("check_security returned %d (repetition=%d)\n", err, i);
             fflush(stdout);
-            REPORT_ERROR(i >= RETRY_LIMIT);
+            REPORT_ERROR(i >= RETRY_LIMIT - 1);
         } else {
             break;
         }
     }
 
+    // If security setup failed after all retries, report failure to the
+    // macOS Installer so it does not show "Installation Successful" when
+    // permissions were never set correctly.
+    if (err != noErr) {
+        printf("BOINC security setup failed after %d attempts (last error=%d)\n", RETRY_LIMIT, err);
+        fflush(stdout);
+        return err;
+    }
+
 #else   // ! defined(SANDBOX)
 
     Boolean                 Success = false;