Cask macfuse - setting rights for libs is too open

[RutgerLubbers]

Output of brew config

HOMEBREW_VERSION: 4.3.19
ORIGIN: https://github.com/Homebrew/brew
HEAD: 1f9bd2de89883ec9a59db3eab0f5475bce06d5bc
Last commit: 3 days ago
Core tap JSON: 05 Sep 06:48 UTC
Core cask tap JSON: 05 Sep 06:48 UTC
HOMEBREW_PREFIX: /usr/local
HOMEBREW_BROWSER: open
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: nano
HOMEBREW_MAKE_JOBS: 16
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.3.4 => /usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/3.3.4_1/bin/ruby
CPU: 16-core 64-bit kabylake
Clang: 15.0.0 build 1500
Git: 2.46.0 => /usr/local/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 14.6.1-x86_64
CLT: 15.3.0.0.1.1708646388
Xcode: N/A

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  graphiql
  spectacle

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  openssl@1.1
  vagrant-completion
  youtube-dl

Description of issue

Installing macfuse fails with an error.
The output of brew install macfuse is:

==> Installing Cask macfuse
==> Running installer for macfuse with sudo; the password may be necessary.
Password:
installer: Package name is macFUSE
installer: Installing at base path /
installer: The install was successful.
==> Changing ownership of paths required by macfuse with sudo; the password may be necessary.
chown: /usr/local/lib/sentinel.dylib: Operation not permitted
==> Purging files for version 4.8.0 of Cask macfuse
Error: Failure while executing; `/usr/bin/sudo -E -- /usr/sbin/chown -R -- rutger:staff /usr/local/include /usr/local/lib` exited with 1. Here's the output:
chown: /usr/local/lib/sentinel.dylib: Operation not permitted

Our company requires us to use Sentinel One. Sentinel One prevents tampering with its files. One of these files is /usr/local/lib/sentinel.dylib.

The install script (don't know if this is the correct homebrew word) changes the file ownership of all files:

postflight do
    set_ownership ["/usr/local/include", "/usr/local/lib"]
  end

When I do a manual install of macfuse, the following files are added:

$ ls -als  /usr/local/lib | grep fuse
520 -rwxr-xr-x   1 root   wheel 531744 Jun 11 01:05 libfuse.2.dylib
  0 lrwxr-xr-x   1 root   wheel     15 Sep  5 09:06 libfuse.dylib -> libfuse.2.dylib
  4 -rwxr-xr-x   1 root   wheel    971 Jun 11 01:05 libfuse.la
  0 lrwxr-xr-x   1 root   wheel     15 Sep  5 09:06 libosxfuse.2.dylib -> libfuse.2.dylib
  0 lrwxr-xr-x   1 root   wheel     15 Sep  5 09:06 libosxfuse_i64.2.dylib -> libfuse.2.dylib

$ ls -l /usr/local/include | grep fuse
0 drwxr-xr-x   9 root   wheel  288 Jun 11 01:05 fuse
4 -rw-r--r--   1 root   wheel  246 Jun 11 01:05 fuse.h

Could the installer just update the ownership of just these files / directories?

I'm able to test updates / fixes.

Relevant casks

macfuse