Comments on: sudo NSTasks with Mac OS X’s Security framework

By: bdunagan

bdunagan — Sat, 31 Jul 2010 05:19:41 +0000

@Gus Not sure about your specific issue, but I know this process works with ‘/bin/launchctl’. Sorry I can’t help more.

By: Gus

Gus — Fri, 30 Jul 2010 23:29:25 +0000

I am having a lot of trouble to execute: sudo launchctl load using this solution.
After I call AuthorizationExecuteWithPrivileges I receive “errAuthorizationSuccess”
But on console I get this:

“sudo: no tty present and no askpass program specified”

If I manually run it on a Terminal and run the program again everything works.

By: bdunagan

bdunagan — Tue, 27 Jul 2010 04:44:46 +0000

@serge I simply used logging to debug any issues that arose, but StackOverflow says gdb from Terminal can do it: http://stackoverflow.com/questions/1384284/how-does-one-automatically-attach-a-debugger-to-a-process-at-process-start-on-os.

By: serge

serge — Thu, 22 Jul 2010 20:46:23 +0000

I got your project from svn, it is very helpful. however i have a question, how do you debug AuthHelperTool it is a separate target in the project. Im having a hard time debugging it.

By: bdunagan

bdunagan — Fri, 21 May 2010 04:50:18 +0000

@Sharath: My understanding is that you can’t simply cache the authorization between launches. The user will need to authorize any root-level tool at least every launch. Let me know if I’m mistaken. For more info, I would check out Apple’s Authorization Services Programming Guide.

By: bdunagan

bdunagan — Fri, 21 May 2010 04:43:44 +0000

@Chris: I know this reply is incredibly late, but I only recently figured out how to do what you ask. I wrote up a blog post about communicating with a privileged tool: http://www.bdunagan.com/2010/04/18/communicating-with-a-privileged-tool/.

By: Sharath

Sharath — Thu, 20 May 2010 08:59:09 +0000

Hi,
Your article was very useful and the example is excellent as well. Going forward with that, I would like to implement credentials caching either at install time or first run so that I don’t see the authorization dialog again .. Could you give me pointers on where to look for information on that?

Thanks..

By: Chris

Chris — Sun, 07 Mar 2010 05:18:38 +0000

Brian,

Thanks, this was very helpful!

I’m trying to expand on this to run tcpdump, but am running into the issue of how to stop tcpdump once it’s running. If I understand correctly, the AuthHelperTool would run tcpdump via an NSTask when called with an argument “start” for example. A separate process of the AuthHelperTool would then use the terminate method of NSTask to stop the task, but since it’s a separate process, it has no knowledge of the original object, so how would you do this?

By: fill the void – System Preferences Pane Lock

fill the void – System Preferences Pane Lock — Mon, 14 Dec 2009 01:32:44 +0000

[...] creates a simple prefpane with a button and the lock UI, building on two earlier posts about root-level operations and debugging prefpanes. Clicking the button creates an empty file at /var/log/test.txt, an action [...]

By: Chris

Chris — Tue, 19 May 2009 19:45:26 +0000

Brian, thank you so much for this write up – it has been incredibly helpful.

If anyone is following the above in XCode 3 I had a problem when applying and compiling the code and I hope this helps: – when you add the security framework to your app via right clicking on frameworks > Add existing frameworks > ….

Make sure you add the framework after you’ve created the new shell tool app as described above and that you select the new app as a target, otherwise, when you compile, the security framework will only be available to your main app rather than the bundled AuthHelpTool and on compile you’ll get symbol(s) not found errors.

Thanks again Brian… from a (now) happy beginner in Cocoa