Re: Security framework question
Re: Security framework question
- Subject: Re: Security framework question
- From: Eric Peyton <email@hidden>
- Date: Wed, 11 Jul 2001 09:45:31 -0500
On Tuesday, July 10, 2001, at 06:23 PM, Ed Silva wrote:
Well, after some digging I found that keeping a tool in the App
bundle isn'
t the only way to do it.
It turns out that if you make the application binary (ie:
MyApp.app/Contents/MacOS/MyApp) sutuid root it works just fine.
The way I figured this out was by looking at NetInfo Manager.app:
-rwsrwxr-x 1 root admin 175944 Jun 21 14:45 NetInfo Manager*
This seems much more reasonable to me than creating a separate
tool to do the job, but I wonder if there are security
consequences.
Any thoughts (good or bad) on a setuid root app binary?
NO NO NO NO NO
1) they can only! be installed with the Apple installer by
default. I seriously doubt you will be able to coherently explain
to end user how to install an app and make it setuid without
enabling and using root.
2) Setuid applications (especially Cocoa ones) are prone to easy
security holes.
3) Unless you know what you are doing, and how you are doing it at
a very low leve, please please please stay away from setuid
binaries.
You will notice that there are fewer and fewer all the time on
Apple shipped versions of OS X. This trend will continue. Certain
apps need it for very special reasons (admin authentication is the
ONLY reason that NetInfo Manager.app is setuid).
Eric
On Monday, July 9, 2001, at 07:28 PM, Brian Hill wrote:
On Monday, July 9, 2001, at 08:03 PM, Ed Silva wrote:
I have been thinking that I could make a tool to do the real work
(creating the dir, writing files, etc) and use the security
framework to call that, but that seems like such a hack that I
really want to find a better way to do this.
Any ideas? Am I missing something here?
Nope. That's what you have to do -- put it in a tool and use the
functions in the Security framework to run it.
Brian
email@hidden http://personalpages.tds.net/~brian_hill
"Why? I came into this game for adventure - go anywhere, travel
light, get in, get out, wherever there's trouble, a man alone.
Now they've got the whole country sectioned off and you can't
move without a form. I'm the last of a breed."
-- Archibald "Harry" Tuttle, Rogue HVAC Repairman
Cheers,
--Ed
_______________________________________________
cocoa-dev mailing list
email@hidden
http://www.lists.apple.com/mailman/listinfo/cocoa-dev