Question

I’m trying to run a process with elevated privileges – specifically OpenVPN, which requires root privileges to add routes to the system.

Looking around for existing examples around leads me to AuthorizationExecuteWithPrivileges, which seems to be now deprecated.

I tried the new SMJobBless method but I have a few questions regarding its viability for this purpose. As I understand it, I can create a separate privileged tool and communicate with it via sockets to ask the tool to perform privileged commands. However, I can’t seem to figure out how I can start the OpenVPN process and capture its standard output in real time doing it this way as the main application would not be starting the process itself.

Another option is to use setuid on the OpenVPN executable. Could I possibly use the helper installed by SMJobBless to set the file permissions and setuid on the executable, then run it normally via NSTask?

Edit:

Lastly is there some way to just run one single command with privileges without having to install anything permanently? Although this new method is more secure, it seems very heavy handed.

Answer 1

I managed to go the SMJobBless method by using a helper and communicating it with XPC (the method shown on Nathan de Vries’s Blog). Using this helper I set the permissions on the external process to 04555 (setuid, rx). Then the SMJob is removed as it is no longer required. Essentially emulating an “one-off” privileged job.

Following that I was able to use NSTask to start the process and capture its output in my main application.

Additionally I have a check at the start to see if the permissions are set right on the executable, if not the SMJob helper is re-blessed and permissions set.

If anyone has a cleaner solution, feel free to share. Thanks!