STPrivilegedTask ask for password for each task - macos

Question

I would like to start a lot of NSTasks that require root privilege, I found that I should use Apple's Authorization Kit and I found STPrivilegedTask, which is designed for that.
The thing is, when I start a STPrivilegedTask, it will ask me for the root password each time. Is there a way to enter the root password for the first privileged task, and then for the other tasks, the application will remember the root password, so the user won't have to enter the password again and again and again?

Answer 1

Depending on your use case, you might be happy just replacing the initialization of authorizationRef in STPrivilegedTask -launch with something like...
// create authorization reference
static AuthorizationRef authorizationRef = NULL;
#synchronized(self) {
if (!authorizationRef) {
err = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &authorizationRef);
if (err != errAuthorizationSuccess) { return err; }
}
}
... and then removing the AuthorizationFree:
// free the auth ref
AuthorizationFree(authorizationRef, kAuthorizationFlagDefaults);
That will allow you to launch tasks without the password prompt for five minutes.
If you need more control, create a Command Line Tool in Xcode that executes the desired commands using normal NSTask calls.
When you launch the tool using STPrivilegedTask or AuthorizationExecuteWithPrivileges, the NSTask commands will run with administrator privileges (euid = 0).
SMJobBless is the way to launch a tool going forward — especially if you need to perform privileged operations on a regular basis, without prompting for a password.
It's much harder to do that correctly using AuthorizationExecuteWithPrivileges.
Notes on SMJobBless
SMJobBless prompts for a password & installs the helper.
When you talk to the helper, there will be no password prompt.
Apple's own example on this is fairly convoluted, but there are other examples out there.
Some pages suggest that only your application is allowed to talk to your helper. Apple doesn't say that anywhere. After the helper is installed, I'm pretty sure anyone can talk to it.
You could probably enforce the code signing requirements (PROPERTY LISTS section of this document) yourself, but I couldn't find any examples that do that.
I used AuthorizationExecuteWithPrivileges a couple years ago to install a launchd daemon, but I have yet to tangle with SMJobBless myself.

Answer 2

Hi I found some work around for this issue. Here I am listing all steps, hope help someone facing same issue:
First step on application launch to check if our application has administration privileges.
// run a terminal command for admin privileges available or not
NSString* csPluginDirectoryPath = [NSString stringWithFormat:#"%#/supportFiles",[CommonMethods getResourceFolderPath]];
NSString* tapPathCommand = [NSString stringWithFormat:#"chown root %#/tap.kext", csPluginDirectoryPath];
//if app has not admin privileges then it return error text
// if application has admin privileges it will return empty message
NSString* csErrorMessage = [self ExecuteSudoTerminalCommand:tapPathCommand];
if(csErrorMessage && [csErrorMessage length] > 2)
{
// go for admin privileges
[self launchHelperTool];
}
-(NSString*) ExecuteSudoTerminalCommand:(NSString*) terminalCommands
{
NSString* resultOfScript = #"";
NSString* csScript = [NSString stringWithFormat:#"do shell script \"%#\"",terminalCommands];
NSDictionary* errors = [NSDictionary dictionary];
NSAppleScript* appleScript = [[NSAppleScript alloc] initWithSource:csScript];
NSAppleEventDescriptor* descriptor = [appleScript executeAndReturnError:&errors];
if(descriptor == nil)
{
resultOfScript = [errors objectForKey:#"NSAppleScriptErrorMessage"];
}
else
resultOfScript = [descriptor stringValue];
return resultOfScript;
}
-(void) launchHelperTool
{
helperToolPath = [[[NSBundle mainBundle] resourcePath] stringByAppendingString:#"/Chameleon VPN"];
NSBundle *thisBundle = [NSBundle mainBundle];
NSString* commonDictionaryPath = [[thisBundle bundleURL] absoluteString];
commonDictionaryPath = [commonDictionaryPath substringToIndex:commonDictionaryPath.length - 1];
commonDictionaryPath = [commonDictionaryPath stringByReplacingOccurrencesOfString:#"file:/" withString:#""];
NSArray *args = [NSArray arrayWithObjects:helperToolPath, commonDictionaryPath, nil];
NSTask *task = [NSTask launchedTaskWithLaunchPath:helperToolPath arguments:args];
[task waitUntilExit];
int status = [task terminationStatus];
if (status == 0)
{
NSLog(#"Task succeeded.");
}
else
{
NSLog(#"Task failed.");
exit(0);
}
}