mac上的应用提权

标签：

一个mac上的app需要在/Applications/My.app/Contents/MacOS路径下创建一个配置文件，在开启root权限的账户下运行时ok，但是在没有开启root权限的账户下运行时，创建文件会失败，报"Permission Denied"

花时间了解了一下mac上的应用提权，由于安全的原因，提权方式一直在调整，目前苹果推荐的方式是使用Security Manager，并提供了一个例子:SMJobBless

以下引用自stackoverflow http://stackoverflow.com/questions/18404884/c-show-osx-permission-dialog

"

Originally, Apple provided a function ‘AuthorizationExecuteWithPrivileges‘ that allowed an application to launch another with root privileges. This has since been deprecated for security reasons.

The dialog here is a bit misleading. Apple provides authorization services that launches the dialog under various different situations, but usually from an application having called the function AuthorizationCopyRights, after having setup rules in an authorization database (the file at /etc/authorization) and having created the Authorization reference with AuthorizationCreate.

Security on OSX is split between a security daemon, a security agent and applications. An application can restrict features using this system, or request authorisation for the user to enter credentials so it can launch a privileged application, which is what you need to do.

It‘s important to note that the dialog has not been presented by the application, but by the Security Agent, which is solely responsible for the security GUI. The daemon actually processes the authorization.

Apple‘s method for elevation is to have all applications run with Standard User rights and should a privileged task be required, then this must be factored out into a separate application which is registered to run with launchd and given the elevated privileges. The example Apple provides isSMJobBless.

While the calling code of the example is written in Objective-C, the important functions are just C functions in the SMJobBlessAppController.m file, most notably AuthorizationCreate to create an authorisation reference and the code in the Objective-C function blessHelperWithLabel:error: at the bottom of the file.

Begin with this help document on SMJobBless, which details the process.

Finally, if you‘re using Qt, you‘ll need to include Apple‘s Security framework for the required function calls. To do that, just add the following to your .pro file: -

QMAKE_LFLAGS += -F /System/Library/Frameworks/Security.framework/
LIBS += -framework Security

"

附：

1.Enable and using the "root" user in mac os x

https://support.apple.com/en-us/HT204012

mac上的应用提权

标签：

原文地址：http://www.cnblogs.com/bugchecker/p/get_root_privilege_for_app_on_mac.html