Re: Running process as root from Cocoa

FROM : Mitchell Hashimoto
DATE : Tue Jan 29 06:07:18 2008

I am looking for the most correct solution, not necessarilly the
simplest. I've been reading about the authorization services and I've
come up with a solution which works but I'm curious about a few
things. The code I have is listed below. It "works" but is it
"correct" ?

Thank you everyone! This is a great help.

   NSString *fullPath = @"/Applications/Program.app/Contents/MacOS/Program";
   AuthorizationItem myItems[1];

   myItems[0].name = kAuthorizationRightExecute;
   myItems[0].valueLength = [fullPath length];
   myItems[0].value = [fullPath cStringUsingEncoding:NSASCIIStringEncoding];
   myItems[0].flags = 0;
   
   AuthorizationRights myRights;
   myRights.count = 1;
   myRights.items = myItems;
   
   AuthorizationFlags myFlags;
   myFlags = kAuthorizationFlagDefaults |
   kAuthorizationFlagInteractionAllowed |
   kAuthorizationFlagExtendRights;
   
   AuthorizationRef authorizationRef;
   OSStatus myStatus;
   
   myStatus = AuthorizationCreate (&myRights,
kAuthorizationEmptyEnvironment, myFlags, &authorizationRef);
   if (myStatus != errAuthorizationSuccess) {
       // oh no. Show dialog.
   }
   
   AuthorizationExecuteWithPrivileges(authorizationRef,
myItems[0].value, kAuthorizationFlagDefaults, nil, nil);


On Jan 28, 2008 2:01 PM, Bill Bumgarner <<email_removed>> wrote:
> On Jan 28, 2008, at 1:48 PM, Nir Soffer wrote:
> > The simplest solution is:
> >
> >      NSAppleScript *script = [[NSAppleScript alloc] initWithSource:
> >              @"do shell script 'path/to/exeutable' with administrator
> > privileges"];
> >
> >      NSDictionary *errorInfo;
> >      [script executeAndReturnError:&errorInfo];
>
> Easily trojaned unless you code sign...
>
> Just bring up your executable's binary in emacs and edit the path/to/
> executable to point to your favorite nefarious shell script.
>
> b.bum
>
> _______________________________________________
>
> Cocoa-dev mailing list (<email_removed>)
>
> Please do not post admin requests or moderator comments to the list.
> Contact the moderators at cocoa-dev-admins(at)lists.apple.com
>
> Help/Unsubscribe/Update your Subscription:
> http://lists.apple.com/mailman/options/cocoa-dev/<email_removed>
>
> This email sent to <email_removed>
>