I have a application inside which i have kept other applications.I want to launch other application in root privilege through main application.As we know AuthorizationExecuteWithPrivileges() has been deprecated, so that i have created a privileged helper tool. I am using Main application to install this helper tool through SMJobBless() function , and communicate through XPC mechanism. Every thing is working fine, Main application sending message(Path of application to be launch) to helper tool that is already running in root mode. The helper tool is able to launch that application provided in path, but the problem is, launched application doesn't have root privilege. Can anyone tell me how i can use this helper tool to launch another application in root privilege.Or is there any other mechanism to achieve it, i will ever thankful for this.
Related
I am creating a plug-in in Objective-C to a third-party macOS app. I want to register and handle url scheme (like myscheme://somedatahere) and file types - for example, when a user double click on a file our plug-in should be notified.
As my product is just a plug-in to a third-party app, the code has no access to the app's NSApplication instance nor to its events. As such, I need to create a helper app and bundle it inside the plug-in bundle/package to register and handle that. Please let me know if these presumptions are incorrect.
The plug-in bundle is being installed inside the Library/Application Support (the user typically downloads the plug-in into the Downloads folder, double click it and then the host app's handler copies the plug-in into the Application Support folder). The app handling urls and file types will be placed inside the plug-in bundle. The location was chosen by the host app.
I have several uncertainties I failed to find answers for:
How does the macOS finds apps capable of handling a particular url scheme and file types?
Does macOS finds it somewhat automatically or should I call something?
If it is found automatically, will it work even if the app is located inside a plug-in package outside of the Applications directory?
You can find the answers you are looking for the in the Launch Services documentation.
If you check the section "Application Registration", you will see that:
A built-in background tool, run whenever the system is booted or a new user logs in, automatically searches the Applications folders in the system, network, local, and user domains and registers any new applications it finds there.
The Finder automatically registers all applications as it becomes aware of them, such as when they are dragged onto the user’s disk or when the user navigates to a folder containing them.
So, if your helper app is installed into /Library/Application Support by the user manually dragging-and-dropping, it looks like Launch Services will see it and register the URL scheme.
Otherwise, the documentation continues to cover the manual case:
In spite of these automatic registration utilities, it may sometimes be necessary to register an application explicitly with Launch Services. For example, although developers are encouraged to package their applications so that they can be installed by simply dragging them onto the user’s disk, some applications may require more elaborate custom installer software. In such cases, the installer should call one of the Launch Services registration functions LSRegisterFSRef or LSRegisterURL to register the application explicitly.
I am trying to install a privileged helper tool to perform some elevated work. I am using SMJobBless for the same.
I am able to install the tool fine and also able to communicate with it. I am using Mac OS X 10.8.4 and using NSXPCConnection for the same.
I have added .mach service in the plist which will be installed in /Library/LaunchDaemons. I am using [initWithMachServiceName:options:] in the app as the helper is privileged tool and [– initWithMachServiceName:] in the helper to listen. The communication is working fine.
But the problem is I tried the same communication with another application I created which did not have any codesign at all (the helper tool installer earlier was codesigned). I tried to connect to the mach service of the helper tool and was able to connect easily. This is a problem because anybody can communicate with it then and make it do anything.
I wanted some way to securely communicate between my application and the helper tool.
Thanks a lot.
As you've said that you're not signing the second app, I believe that that is the problem that is allowing a 2nd app from calling the helper application. From the Apple docs and specifically the ReadMe file in SMJobBless, it states: -
The Service Management framework uses code signatures to ensure that the helper tool is the one expected to be run by the main application
This document should be able to assist you in getting the helper app correctly associated with its owner.
Note that it references a python script, which is provided here.
Answering my own question: I had logged a radar bug for the same and Apple said that the behavior was intended:
"It is up to the privileged helper to not expose insecure operations"
I'm working on a OS X desktop application. I want to bundle a helper tool with it. I was thinking of using SMJobSubmit to start a helper program with elevated privileges. (The tool basically does a sudo call.)
How could I send the console output from the tool back to my main application?
I know with NSTask I could use NSPipe to redirect console output. But, since I don't think I can use NSTask with elevated privileges, I'm using SMJobSubmit instead.
(Yes, I've taken care of the authorization part.)
I think, as far as I know, you should use XPC connection to communicate with your helper program. Instead of using SMJobSubmit(Since it is deprecated anyway) use SMJobBless to install your helper tool as a LaunchD job which runs in elevated privileges. Use XPC connection from your Mac OS X app to communicate with it to invoke the function call that executes your logic, capture the output and reply back to the main app. If you are willing to go ahead with this idea, the below sample code from Apple will guide you through.
https://developer.apple.com/library/mac/samplecode/EvenBetterAuthorizationSample/Listings/Read_Me_About_EvenBetterAuthorizationSample_txt.html
I have a dynamic library, I intent to inject in running application & newly launched applications.
I can inject it in running applications with the help of a process running with root user permissions.
Now I am trying that library should get loaded as soon as application is launched. I know one such library capable of doing this called, application enhancer. I am looking for similar behavior.
Does anyone has an Idea how can this be achieved?
Look at SIMBL agent code. It adds a observer to application launch notification and then injects. You can follow the same approach.
Hy,
I've create a setup for my vb application with visual studio.
At the end of the install I want to launch the application so i've add a custom action and used the chell to launch it. It's work but... the application is launch as SYSTEM user...
is there a way to launch it in normal user (on win7 as administrator)?
Thanks for your help
If you are installing the application as an Administrator and launching the application, then it will start under that identity.
Try installing the application as a non Admin user and see under what identity the application launches.
If it still requires Admin access, then look at the privileges requested in your config file.