C++ Show OSX Permission Dialog

Question

I am writing an application on OSX by using Qt C++ that needs root privilege. I believe I can get these needed privilege by displaying a dialog box prompting user name and password, something like this in XAMPP:

How this can be done? Am I have to build the form manually then use setuid , or is there already built in function on the SDK?

Answer 1

Originally, Apple provided a function ' AuthorizationExecuteWithPrivileges ' that allowed an application to launch another with root privileges. This has since been deprecated for security reasons.

The dialog here is a bit misleading. Apple provides authorization services that launches the dialog under various different situations, but usually from an application having called the function AuthorizationCopyRights, after having setup rules in an authorization database (the file at /etc/authorization) and having created the Authorization reference with AuthorizationCreate.

Security on OSX is split between a security daemon, a security agent and applications. An application can restrict features using this system, or request authorisation for the user to enter credentials so it can launch a privileged application, which is what you need to do.

It's important to note that the dialog has not been presented by the application, but by the Security Agent, which is solely responsible for the security GUI. The daemon actually processes the authorization.

Apple's method for elevation is to have all applications run with Standard User rights and should a privileged task be required, then this must be factored out into a separate application which is registered to run with launchd and given the elevated privileges. The example Apple provides is SMJobBless .

While the calling code of the example is written in Objective-C, the important functions are just C functions in the SMJobBlessAppController.m file, most notably AuthorizationCreate to create an authorisation reference and the code in the Objective-C function blessHelperWithLabel:error: at the bottom of the file.

Begin with this help document on SMJobBless, which details the process.

Finally, if you're using Qt, you'll need to include Apple's Security framework for the required function calls. To do that, just add the following to your .pro file: -

QMAKE_LFLAGS += -F /System/Library/Frameworks/Security.framework/
LIBS += -framework Security