Home/ Questions/Q 283483
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T05:22:38+00:00

I have an application which needs to be able to write to Any User/Current

  • 0

I have an application which needs to be able to write to Any User/Current host preference files (which requires admin privileges per Preferences Utilities Reference) and also to enable/disable a launchd agent via its plist (writable only by root).

I’m using SFAuthorizationView to require users to authenticate as an admin before altering these values.

I’m trying to decide on the best way to do the actual altering of these values.

The cheap hackish option seems to be to use AuthorizationExecuteWithPrivileges() and mv or defaults, either via BLAuthentication or creating something similar myself. The downside to this is not getting the return value of whatever command line app I’m executing, plus some odd esoteric bugs I’ve encountered (such as getting a -60008 error in certain situations). This is strongly recommended against by Apple, obviously, but people do seem to do it and have some success with it.

The second most hackish option would seem to be the whole create a helper app with the suid bit set and the --self-repair option as discussed in various places. This seems possible, but like it’s probably not much less trouble than the third option.

The third option is to create a fully fledged launchd daemon which will run as root and communicate with my application via a socket. This seems like a bit of overkill to read and write some plist files, but it’s also possible I may find other uses for it down the road, and it wont be the only daemon for my application, so it doesn’t seem unreasonable to just add another.

I’m thinking about modifying this sample code for my purposes.

My two questions are:

  1. Does the launchd daemon option seem like the best route to go for this, or is there a much easier route I’m missing?

  2. Has anybody else successfully used that code as a basis for something similar, and does anybody see any glaring issues with it I’m missing? I’ve used it successfully in a test app, but I’d be curious to hear you guys’ opinion on it.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    1. launchd is definitely the best and safest way to go: you’ll need an installer package to get your helper into place. Do be sure that your helper does and can do absolutely nothing except edit the files you wish to target.

    2. No experience w/the code, but it’s based off of BetterAuthorizationSample, so that’s a nice start.

    • 0