Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
 
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Add to authorization policy database error


On Dec 7, 2004, at 1:51 PM, Steven Palm wrote: 
 Shouldn't this work?  (using hardcoded values for easier reading here)

NSArray *keys = [NSArray arrayWithObjects:@"rule", @"comment", nil];
NSArray *rules = [NSArray arrayWithObjects:@"authenticate-session-owner-or-admin", nil];
NSArray *vals = [NSArray arrayWithObjects:rules, @"load/unload tun/tap kexts", nil];
NSDictionary *dict = [NSDictionary dictionaryWithObjects:vals forKeys:keys];
err = AuthorizationRightSet(authRef, "my.right.name", dict, @"description", [NSBundle mainBundle], NULL);

Although I do see entries in the database that have an array of values, apparently you can't add them this way? I removed that construct and they add fine if I specify the rule as a CFStringRef/NSString entity.

So this right would timeout after five minutes, and either require that they have the first right when they try to get this one or would have to authenticate. Now that I think of it, I'm not sure this would do quite what I want.... I'd really like to grant this upon program launch when they must authenticate for the first right, but timeout in five minutes and then require re-authentication from that point on... I'll have to rethink that I guess.

I think the best approach would be to allow root to acquire the right automatically, and have the helper tool launch on startup and grab the right for me. That way the user will have it when the program starts with a five minute timeout, after which time they would have to re-authenticate. I haven't tested that, but I think it will work.

Steve


_______________________________________________
Do not post admin requests to the list. They will be ignored.
Apple-cdsa mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/apple-cdsa/email@hidden

This email sent to email@hidden
References: 
 >Add to authorization policy database error (From: Steven Palm <email@hidden>)
 >Re: Add to authorization policy database error (From: Conrad Sauerwald <email@hidden>)
 >Re: Add to authorization policy database error (From: Steven Palm <email@hidden>)



Visit the Apple Store online or at retail locations.
1-800-MY-APPLE

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2007 Apple Inc. All rights reserved.