使用SMJobBless时防止授权弹出窗口

Question

we are developing an application with a Helper Tool - which is installed into the system using SMJobBless. This works as expected; but there is a caveat.

We do frequent automatic deployments - sometimes more than one per week. Everytime the Helper Tool version changes, we re-register it - causing a password prompt. These 2 factors would quickly become irritating to our users.

Is there a way to have the password prompt appear only once, during the initial Helper Tool installation? Could subsequent updates happen without a prompt? Perhaps there is a way to leverage the existing Helper Tool to install a newer version of itself?

Answer 1

Short answer: No. SMJobBless() always prompts for admin credentials. There's no way to stop it from prompting. If you call this API, it'll prompt (or fail).

---

Longer answer on workarounds:

If your helper tool is running with admin/root privileges, it could theoretically replace itself with a new version. Think very carefully before doing this. Getting this right and maintaining security is very difficult , and the fact that even the major OSes have had vulnerabilities in installer functionality is a strong indicator that the risks of going this route may outweigh the benefits.

If you must proceed, read up on:

• Race Conditions, Secure File Operations, and Time of Check vs Time of Use

• Apple's Security APIs , particularly SecRequirementCreateWithString and SecCodeCheckValidity .

• macOS Code Signing In Depth and the Code Signing Requirement Language

You would have to ensure that your helper tool cannot be tricked into replacing itself with (or executing) malicious code, or you will have opened your software up to being a trivial root exploit vector.

Also note: Regardless of what Apple currently does to verify helper tools installed by SMJobBless , it is conceivable that they could tighten the requirements in the future and refuse to run helper tools that have been modified since they were installed via SMJobBless . The safest method (in multiple respects) is to just call SMJobBless whenever you need to install/update the helper.