CPAN on El Capitan

[rhumbliner]

Apple's newest release of OS X, El Capitan, includes a security feature that hobbles some of the capabilities of root: SIP. This includes preventing root from changing /usr/bin. This also prevents cpan from installing a new version of CPAN as seen here:

{s10:~} whoami
root
{s10:~} cpan CPAN
CPAN: Storable loaded ok (v2.41)
Reading '/var/root/.cpan/Metadata'
  Database was generated on Thu, 08 Oct 2015 10:41:02 GMT
Running install for module 'CPAN'
Running make for A/AN/ANDK/CPAN-2.10.tar.gz
CPAN: Digest::SHA loaded ok (v5.84_01)
CPAN: Compress::Zlib loaded ok (v2.069)
Checksum for /var/root/.cpan/sources/authors/id/A/AN/ANDK/CPAN-2.10.ta
+r.gz ok
CPAN: File::Temp loaded ok (v0.23)
CPAN: Parse::CPAN::Meta loaded ok (v1.4417)
CPAN: CPAN::Meta loaded ok (v2.150005)
CPAN: Module::CoreList loaded ok (v3.03)

  CPAN.pm: Building A/AN/ANDK/CPAN-2.10.tar.gz


Checking if your kit is complete...
Looks good
Generating a Unix-style Makefile
Writing Makefile for CPAN
Writing MYMETA.yml and MYMETA.json

<snip>

All tests successful.
Files=30, Tests=701, 28 wallclock secs ( 0.39 usr  0.06 sys + 18.83 cu
+sr  3.16 csys = 22.44 CPU)
Result: PASS
  ANDK/CPAN-2.10.tar.gz
  /usr/bin/make test -- OK
Running make install
Manifying 2 pod documents
Manifying 16 pod documents
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!
ERROR: Can't create '/usr/bin'
Do not have write permissions on '/usr/bin'
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+!!
 at -e line 1.
make: *** [pure_perl_install] Error 1
  ANDK/CPAN-2.10.tar.gz
  /usr/bin/make install  -- NOT OK
{s10:~}

I'm looking for suggestions on how to best work around this. It is possible to disable SIP but I'd prefer not to.

TIA

[MidLifeXis]

Is this perhaps something that should fall under the "Don't mess with the system's Perl" discussion? (SuperSearch Preload)

[stevieb]

Your answer is probably a more sane one than mine. Just recently I've started using Perlbrew, so I'm not quite completely out of the mindset that the system Perl installation should be left alone.

[adefaria]

I would think that if the system cpan (i.e. /usr/bin/cpan) complains "Hey I'm not up to date! Please update me":

.............
  New CPAN.pm version (v2.10) available.
  [Currently running version is v2.00]
  You might want to try
    install CPAN
    reload cpan
  to both upgrade CPAN.pm and run the new version without leaving
  the current session.

then if you follow its instructions it should work, no?

[MidLifeXis]

Just because the cpan script knows it is out of date does not ensure that the operating system (which is what the system perl is there to support) is able to make use of changed APIs of modules, deprecated features, updated output formats, other functionality, etc.

If I am walking on stilts, and suddenly the rubber foot is replaced with a wheel, something is going to fall down.

[stevieb]

After glancing over the SIP link, it appears as though you are permitted to write to /usr/local, but not anything else in /usr. Perhaps try changing your binary install path to /usr/local/bin?

cpan> o conf makepl_arg "INSTALLBIN=/usr/local/bin INSTALLSCRIPT=/usr/
+local/bin"

cpan> o conf commit

Then run your install again.

[bitingduck]

That's rather frustrating. I don't mess with files in the protected areas often, but I have occasionally had need to. As far as language installs (not just Perl), I've started using the various tools (perlbrew, rvm) that install multiple versions into /usr/local.

You can always install VMWare and develop on a linux install... I've been leaning that way lately anyway, and when I finally have to upgrade to El Cap (I have Yosemite at work and Mavericks at home) I'll probably move even more in that direction.

[Your Mother]

OS X is a touchy system in this regard (not the only one). I changed my system Perl once on my Mac and it took me a week of screwing around to undo the damage… I might have just given up and reinstalled the system, I can’t even remember.

[Anonymous Monk]

El Capitan took a lot of cues from "selinux" and other "hardened" OSes. Root is not all-powerful, nor is it readily accessible, there either. I never cared for an all-powerful root user anyway.

[Laurent_R]

Yeah, sure, I am not using the root user often, but I don't want my OS designers to decide everything for me if it is MY system. I am really pis*sed off with operating systems that try to decide everything for me.

I hate Windows for that, but I can still live with it, because it is not completely blocked, but it seems that OS X is just worse on that account. That's just reminds me how I regretted having once bought an i-phone. Sorry, but never that prison again (not to speak about the probable programmed obsolescence design that killed by iphone-2 just four months after the end of the warranty period, but that's another question).

[karlgoethebier]

"...suggestions on how to best work around this..."

Install perlbrew. I prefer to keep my versions of Perl in $HOME:

karls-mac-mini:~ karl$ perlbrew list
  5.14.2threads
  perl-5.16.2
  perl-5.16.3
  perl-5.17.7
  perl-5.18.0
  perl-5.18.1
  perl-5.18.2
  perl-5.18.2threads
  perl-5.20.0
* perl-5.20.0threads

See also Re: Perl version, Re: Simultaneously reading from a file and serving data and Re: When to bundle Perl with your app?.

Regards, Karl

[gatomon]

Lots of comments, but few solutions. How about this:

After: "Do not have write permissions on '/usr/bin'"

Find the build directory in root's home. It will something like this directory:

/var/root/.cpan/build/CPAN-2.14-XXXXXX

Become root:

sudo -i

and go to the directory:

cd /var/root/.cpan/build/CPAN-2.14-XXXXXX

Edit the Makefile 2 places:

INSTALLBIN = /usr/bin
--->>>
INSTALLBIN = /usr/local/bin
 And:
INSTALLSCRIPT = /usr/bin
--->>>
INSTALLSCRIPT = /usr/local/bin

Then run make:

make install

This will install cpan (and cpan-mirrors) in /usr/local/bin