Assistance in using privileges of authorization or execution with privileges

Question

Hello, good people SO,

I am writing a shell script that will change some system settings, such as HostName (scutil --set HostName), which require permission processing. The script will be run inside the application generated by Platypus .

As soon as my script calls scutil (for example), I, of course, force the security server to request authentication from me.

Looking at the security man page, I am interested in two flags:

security authorize security execute-with-privileges 

Also from the man page I will give an example:

 security -q authorize -uew my-right | security -q authorize -i my-right 

"Allow the right and transfer it to another team as a way to add authorization to shell scripts."

Be that as it may, I am not getting what I want from this, and I suppose I just don’t understand how to use it correctly. Does anyone have more info? What I find in the search does not make me wiser. I would appreciate help in:

• Getting a credential request script once to run the entire script elevated.
• Request credentials once so that they can be sent to individual commands within the script that need a boost.

Running a script with the Platypus flag Running as an administrator still ends with running a script with $ EUID not 0 (zero).

I suppose means that the script is somehow elevated, but does not work as root. This height, if it works, seems insufficient to call scutil --set HostName x , because this command is still requesting credentials.

If you need further clarification, just pat!

Thanks in advance.

Regards, Ted

Answer 1

I am not familiar with using the security command-line tool or Platypus, but looking at the pages of the security manual, it seems to be consistent with the Core Foundation Apple programming interface, so I can explain a little from where the view is, assuming the command line command will probably use the same core Foundation Foundation structure.

The executeWithPrivileges function is now deprecated, and in order for the program to perform functions that require promotion, the program must take into account the enhanced actions in another helper program that is registered in launchd. startd is responsible for handling the actual execution and boosting the helper application.

Your main application is also signed with a supporting application, so only he can request the launch of an assistant application.

You can read more about this in the documentation for the SMJobBless application here .

Although SMJobBless is written in Objective-C and the C helper, you can use Platypus instead of scripts, but that’s not what I tried myself, so you have to experiment.

As you can see from the documentation, the call to the helper application is performed using a URI (for example, com.apple.calculator) to identify the helper program, so it must be in the application bundle.

Hope this helps.