June 2008 - Darwin-dev - lists.apple.com

Re: What's the official way to detect a user has administration privileges?
by Finlay Dobbie 26 Jun '08

26 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:reply-to :to:subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=kmXKHdhtEM6MypZbKOxZaZEAwURaO0HDJhse8vkiqQ8=; b=VIWA9CROCA5sZv0FCav2UHBTVMnKP2viMIZ3pwn139g8WOVufDYTXi8jnFKzYNAYdx Ev4NJjHk0Dvg86y3k9hvn1d0oNAxf60JLIA5iiXy/Nu2DDI5wRN/oyYNxQAFGDdpbnEw zFLEuVmNKbuYxOOzWfTd/nKvURvZmuM2PEBuE= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:reply-to:to:subject:cc:in-reply-to :mime-version:content-type:content-transfer-encoding :content-disposition:references; b=oBS4M2ItfcnSwZASg+odk73CnPFUKSCFygJaD+PCjdcjO9rZ2VLLHs/2qxDj6etpud 2qi7HbxESKbtwHXTSZup4CR7ukKb7sHnXNrxNwbj0izXR2D6jMJd1Tf78JRj4Wy2+qFW wEXRjfOij8OexZUQ8iAaCmupW8/H9b5rPFXuY= On Wed, Jun 25, 2008 at 9:41 PM, Stephen J. Butler <stephen.butler(a)gmail.com> wrote: > On Wed, Jun 25, 2008 at 10:31 AM, Stephane Sudre <ssudre(a)intego.com> wrote: >> Trying to get Extended Rights for "system.privilege.admin" fails for users >> with "Allow user to administer this computer" turned on. The error states >> that it fails because it requires interaction. This is probably to request >> the user to enter his admin password. >> >> So unfortunately, this does not look like to be a solution. > > Hmm... I could have sworn there was a way to do this, but now I can't > find a way. Sorry to send you down the wrong path. Probably the closest you can do is define your own right and apply only the kAuthorizationRuleIsAdmin rule. Then you can attempt to gain the right, which will determine if the user complies with the is-admin rule as defined in /etc/authorization. This is probably closest that you'll get to the concept of an "admin user" within Authentication Services, but of course that won't work if, for example, you're trying to determine whether someone will be able to perform the authenticate-admin rule if they authenticated as themselves in advance of asking them to do so, AND the local /etc/authorization policy file has been modified in a weird and nonstandard way. Of course, this may be an irrelevant degenerate case. However, the wider point which you seem to have encountered is that Authentication Services provides far more granularity than just "is admin" or "is not admin", so it kind of depends what you're trying to do overall. If you have further questions about the intricacies of Security on Mac OS X, you might find them better directed at the apple-cdsa list. -- Finlay _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: USB Mass Storage: command size limits
by Chas Williams (CONTRACTOR) 26 Jun '08

26 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com In message <BB29C48515F7A84FA1892C01BA31392702B78FFE(a)muttley.corp.oxsemi.com>," Andy Green" writes: >I was wondering if I could tweak this for our USB device, which can >support bigger commands. However it looks like the traffic is limited by >IOBlockStorageDriver. i think you need to look at setting kIOMaximumSegmentCountReadKey, kIOMaximumSegmentCountWriteKey, kIOMaximumByteCountReadKey and kIOMaximumByteCountWriteKey in your driver that gets IOBlockStorageDriver objects attached. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

USB Mass Storage: command size limits
by Andy Green 26 Jun '08

26 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Thread-index: AcjW9kdSt7KiVYmfSCuKf5SpsbDhFQAeeOeA Thread-topic: USB Mass Storage: command size limits Why does the mac never send commands larger than 128kB to a USB mass storage device? I was wondering if I could tweak this for our USB device, which can support bigger commands. However it looks like the traffic is limited by IOBlockStorageDriver. How could I change the behaviour of IOBlockStorageDriver? I can subclass and instantiate IOBlockStorageServices from a custom LUN driver, but how could I cause a subclass of IOBlockStorageDriver to be loaded for my device? Is that even the right way to do it? I did have a play with a subclass of IOPeripheralDeviceType00, overriding ReportMaxBlocksReadTransfer(), but that didn't seem to let me INCREASE the command size, only decrease it. Cheers, Andy _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: which set of C++ headers?
by Alexander Agranovsky 26 Jun '08

26 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com - Alex On Jun 25, 2008, at 8:56 PM, Clark Cox wrote: Hi all, They seem to be vastly different. So my questions are: - which one is supposed to be used? You use whichever corresponds to the compiler that you're using The compiler chooses (i.e. you shouldn't have to worry about it) -- Clark S. Cox III clarkcox3(a)gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… Thanks! I figured that could be the case, but couldn't find any trace of presence of gcc/g++ 3.3 on the system. BTW, any idea why they're not installed as part of the toolkit, while the headers are? On Wed, Jun 25, 2008 at 3:17 PM, Alexander Agranovsky <alex(a)voxeo.com> wrote: OSX 10.5 SDK seems to include two STL implementations -- one in /Developer/SDKs/MacOSX10.5.sdk/usr/include/gcc/darwin/3.3/c++/, another one in /Developer/SDKs/MacOSX10.5.sdk/usr/include/c++/4.0.0/. - what controls which one is picked? This email sent to site_archiver(a)lists.apple.com

1 0

Re: which set of C++ headers?
by Clark Cox 26 Jun '08

26 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=ox+bQH/DZuIuooUTcLNBe3w6FkkC4XCsBzDTGJ55sXM=; b=xaX/mO2s/RUciMLKD+Hhc/J+4NRL4XX4R1QSR43sm6rzS+jGfzN7C8p4sKpKkc57th cM+vxmAzKWZp7g1Q8mu76xMK9/qvlHmHzmycfGMr01kKWITYmwCtsmtG6zqfMHtlsoFE csdcdxjqWnAUEVgN86f0h7eBqweF44UBg5RZ4= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=YnUMIv7FmUMCxpRcvRXqART3J60Tyxcf3c8mm7/RIh6XM1nqEr17xGfr6ZxXAQE4Kv LVPlbWjIjDTDGEzXmCuXAXl2b5FnT91+wTJfXQqIbGRODzWeLJt5Y7gQeGdF0q84mQtF sgL7mozFH02Vnr8QVAEWDUcRW9tKP65HMoX64= On Wed, Jun 25, 2008 at 3:17 PM, Alexander Agranovsky <alex(a)voxeo.com> wrote: > Hi all, > > OSX 10.5 SDK seems to include two STL implementations -- one in > /Developer/SDKs/MacOSX10.5.sdk/usr/include/gcc/darwin/3.3/c++/, another one > in /Developer/SDKs/MacOSX10.5.sdk/usr/include/c++/4.0.0/. > > They seem to be vastly different. So my questions are: > - which one is supposed to be used? You use whichever corresponds to the compiler that you're using > - what controls which one is picked? The compiler chooses (i.e. you shouldn't have to worry about it) -- Clark S. Cox III clarkcox3(a)gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: which set of C++ headers?
by Andrew Myrick 25 Jun '08

25 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Looks like they are for the two different versions of gcc. -Andrew On Jun 25, 2008, at 3:17 PM, Alexander Agranovsky wrote: Hi all, They seem to be vastly different. So my questions are: - which one is supposed to be used? - what controls which one is picked? - Alex _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/amyrick%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… OSX 10.5 SDK seems to include two STL implementations -- one in / Developer/SDKs/MacOSX10.5.sdk/usr/include/gcc/darwin/3.3/c++/, another one in /Developer/SDKs/MacOSX10.5.sdk/usr/include/c++/4.0.0/. This email sent to amyrick(a)apple.com This email sent to site_archiver(a)lists.apple.com

1 0

which set of C++ headers?
by Alexander Agranovsky 25 Jun '08

25 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hi all, They seem to be vastly different. So my questions are: - which one is supposed to be used? - what controls which one is picked? - Alex _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… OSX 10.5 SDK seems to include two STL implementations -- one in / Developer/SDKs/MacOSX10.5.sdk/usr/include/gcc/darwin/3.3/c++/, another one in /Developer/SDKs/MacOSX10.5.sdk/usr/include/c++/4.0.0/. This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Stephen J. Butler 25 Jun '08

25 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=v81MeN0VMgHmGMZSqNrnu7CgAtIprsCHjT/5FnwAXdk=; b=oSB0BIqZo/HdwrEes2S5sNyKEqwTLrGst1daH4o5BUPNmcWcVnX+xMTFYtbVRqaJgs 1bZlLvesCYThSIvLpBHBpN0jo5eDf55WEWwpKmOC8gQVXbps6ZoHMTMNNFtiq+YFlInO cxCq6aVJL4fiqijflIqnL+SzAcPctnebp/sgw= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=X5Pa9ARRTiqH8wTiQB3PYeM9Zd1CfSrGnRWZAotvS41otDrEcBn/gvp2HMikeozy5O 9RqhufY4xthHJsIkIdipZGnzmnF9OIcwsjlkWidmNKiZYoKNKFI1xnk2VVkM+JnTGday ZUlAh/epwuEy0sw4fVIoXUf0JUQC0HD+tkrEA= On Wed, Jun 25, 2008 at 10:31 AM, Stephane Sudre <ssudre(a)intego.com> wrote: > Trying to get Extended Rights for "system.privilege.admin" fails for users > with "Allow user to administer this computer" turned on. The error states > that it fails because it requires interaction. This is probably to request > the user to enter his admin password. > > So unfortunately, this does not look like to be a solution. Hmm... I could have sworn there was a way to do this, but now I can't find a way. Sorry to send you down the wrong path. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Stephane Sudre 25 Jun '08

25 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Jun 24, 2008, at 21:49, Stephen J. Butler wrote: The best way to do what you want is to use the Authorization Services AuthorizationCopyRights: So unfortunately, this does not look like to be a solution. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Tue, Jun 24, 2008 at 5:32 AM, Stéphane <ssudre(a)intego.com> wrote: What's the official way to detect a user has administration privileges (from a Mac OS X point of view)? OpenDirectory (how?) or does the fact that the user belongs to group admin is enough (with the exception of root)? <http://developer.apple.com/documentation/Security/Reference/ authorization_ref/Reference/reference.html#//apple_ref/doc/uid/ TP30000826-CH1g-F17549> Check for the "system.privilege.admin" right. Trying to get Extended Rights for "system.privilege.admin" fails for users with "Allow user to administer this computer" turned on. The error states that it fails because it requires interaction. This is probably to request the user to enter his admin password. This email sent to site_archiver(a)lists.apple.com

1 0

Re: What's the official way to detect a user has administration privileges?
by Stephane Sudre 24 Jun '08

24 Jun '08

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On mardi, juin 24, 2008, at 07:44 PM, Alexander von Below wrote: Am 24.06.2008 um 19:39 schrieb Stephane Sudre: I will try the "system.privilege.admin" key suggested. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… How do you check if "Allow user to administer this computer" is turned on for a specific user account? It feels like you're trying to second-guess the OS here - would it be better to simply attempt whatever it is you want to do, and if that fails due to lack of privileges (assuming you can detect that) retry with more privileges? Not in this case. But really, you should say what you are trying to accomplish. You can check if the user is in the admin group, that _should_ be consistent with the "Allow user to administrate" setting This is what I'm trying to ascertain. But apparently this option can be turned on and the user can be not a member of the 'admin' group at the same time. This email sent to site_archiver(a)lists.apple.com

1 0