Re: Executing AppleScripts from an 'AXTrustedProcess'
Re: Executing AppleScripts from an 'AXTrustedProcess'
- Subject: Re: Executing AppleScripts from an 'AXTrustedProcess'
- From: Bill Cheeseman <email@hidden>
- Date: Mon, 02 Feb 2009 15:34:23 -0500
- Thread-topic: Executing AppleScripts from an 'AXTrustedProcess'
on 2009-02-02 3:16 PM, Rainer Brockerhoff at email@hidden wrote:
>> First, is this a bug, or a security feature that restricts trusted
>> processes from executing AppleScripts that call other applications'
>> scripting dictionaries?
>
> I seem to recall it's a recent security feature... setuid/setgid apps have
> such restrictions now. No doubt they'll have more in future releases.
I wonder whether this confuses root access (setuid/setgid) with entrustment.
I believe I recall correctly that the recent security change regarding
AppleScript relates (or was intended to relate) only to the issue of root
access. So if the OP limits root access to the helper app that runs
AXMakeProcessTrusted against his main application executable, the
limitations regarding root access shouldn't be an issue.
I don't offhand see any principled reason why security considerations would
lead Apple to prevent a trusted assistive application from running
AppleScript commands addressed to another application. If anything, a
trusted assistive application should be allowed to exercise increased power.
(I can imagine, however, that this might have been an unintended side effect
of implementing the root limitations.)
Until a knowledgeable Apple engineer weighs in to the contrary, I would be
inclined to suggest that the OP look for the cause of the problem somewhere
else. Unless, of course, he has confirmed that his application works as
intended if he does everything the same EXCEPT to run the
AXMakeProcessTrusted function -- in that case, we're all up a creek.
--
Bill Cheeseman - email@hidden
Quechee Software, Quechee, Vermont, USA
www.quecheesoftware.com
PreFab Software - www.prefabsoftware.com
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Accessibility-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden