Re: Making folders and files as non-admin user [WAS: Re: Privileged shutdown]
Re: Making folders and files as non-admin user [WAS: Re: Privileged shutdown]
- Subject: Re: Making folders and files as non-admin user [WAS: Re: Privileged shutdown]
- From: Paul Berkowitz <email@hidden>
- Date: Sun, 25 Jul 2004 09:28:11 -0700
-------------continued (part 2) -------------------
On 7/25/04 3:03 AM, "Axel Luttgens" <email@hidden> wrote:
>
>
Now, let's have a look at the Mac OS layer.
>
>
As far as file system operations are concerned, and because it relies on
>
the BSD layer, it can't contradict the latter.
>
And certainly not be more permissive.
>
In fact, it often tends to be more stringent than BSD; just enable the
>
root user and log in as that user: you will become very frustrated...
I'm actually very impressed with how strong and secure the permissions thing
is. Remember how you could subvert "Multiple Users" so-called protection on
OS 9 by simply booting from a CD or a different partition on the computer?
Nothing like that here.
>
>
So, let's log in as our regular user 'test', create a folder named
>
'testfolder' on the desktop, open the window of '/Library/Application
>
Support' and drag 'testfolder' to that window.
>
A dialog box immediately appears, telling us that we just aren't allowed
>
to do this (how could we dare?!?).
>
But there's an 'Authenticate' button. [3]
>
Which allows you to enter an... administrator name/password.
Well, 'with administrator privileges' form AppleScript seemed to bring up a
similar dialog (actually not the same - it asked only for an admin password,
not an admin username as well!), but that didn't help.
>
>
In fact, the Mac OS layer adds its own authorization policy over the BSD
>
layer's one.
>
>
To get an quick idea about it, just look at the contents of:
>
/etc/authorization
>
It appears that the group 'admin' receives a special treatment too (the
>
same way members of that group receive lots of privileges through sudo
>
at the BSD level).
>
>
All those matters are developed in:
>
>
<http://developer.apple.com/documentation/Security/Conceptual/authorization_co
>
ncepts/index.html>
>
As you are considering an AS-S application [4], and should you really
>
need to install things into system locations, it should be possible to
>
implement something similar to what is described in the section "Calling
>
a Privileged Installer"
I'll look into that. Fortunately, I found a clever way to do this with
~/Library, at least it seems to be working well. But I'm sure I'll need this
another time.
>
>
>
Sorry for the length,
Thank you for the length. ;-)
>
And hoping to be of some help,
Indeed you were.
>
>
>
>
[1] Incidentally, I always feel unconfortable with the choices behind
>
the OS installer: the user who installs the OS also becomes an
>
administrator, with nothing in the procedure leading to the creation of
>
a regular user's account.
>
As a result, every Mac OS computer in the world is very likely to be run
>
in an unsecure way.
? If they made the single user of most Macs into a regular user instead of
an admin, requiring special logging in as admin to do admin-type things,
their tech support would be tied up with confused and irate customers all
day long and ordinary users would end up switching to Windows, I'm afraid.
>
[2] But what's the magic about 'sudo'?
>
In fact, it is an executable owned by root, with it set uid bit set, and
>
executable by everyone.
>
So, somebody running 'sudo <some command>' launches sudo as root, so
>
that sudo then has the ability to transfer its privileges to other
>
processes.
>
This of course supposes that sudo is bug-free...
>
But this also is possible because somebody having root privileges must
>
have created/installed sudo. Kind of chicken-egg, isn't it?
As I said, it didn't actually get around the permissions issues when I tried
it.
>
[3] It's only rather recently that such authentication buttons are
>
systematically provided in the various parts of the Finder's interface.
Right. I just noticed one yesterday.
>
[4] Tell me, why did you put an hypen? ;-)
Apparently, if I don't, my message could get blocked by over-zealous
anti-porn ISP filters in the American netherworld. ;-)
--
Paul Berkowitz
_______________________________________________
applescript-users mailing list | email@hidden
Help/Unsubscribe/Archives:
http://www.lists.apple.com/mailman/listinfo/applescript-users
Do not post admin requests to the list. They will be ignored.