Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Try looking at Greg Guerin's <a href="http://www.amug.org/~glguerin/sw/#authkit" rel="noreferrer">AuthKit</a> library. It is a Mac-specific library that wraps <a href="http://developer.apple.com/library/mac/#documentation/Security/Reference/authorization_ref/Reference/reference.html" rel="noreferrer">Mac OS X Authorization Services</a>.</p> <p>Here is an example:</p> <pre><code>import glguerin.authkit.*; Privilege priv = new Privilege("system.privilege.admin"); Authorization auth = new MacOSXAuthorization(); try { // This will cause an authentication prompt to be // shown to the user, requesting the "system.privilege.admin" // privilege. auth.authorize(priv, true); // If we reach this point, we can execute privileged programs. // Load the secured file. Process proc = auth.execPrivileged(new String[] { "/bin/cat", "/root/securefile" }); InputStream inputStream = proc.getInputStream(); // Use standard I/O mechanisms to read the input. } catch (UnauthorizedCancellation e) { // User chose not to authorize the application. // Handle appropriately. } </code></pre> <p>The <code>auth.authorize()</code> call will cause the standard "Please enter your password to allow program X to make changes" dialog. The user can cancel if desired, causing <code>glguerin.authkit.UnauthorizedCancellation</code> to be thrown.</p> <p><img src="https://i.stack.imgur.com/RKwj3.png" alt="screen shot of Mac OS X authorization prompt"></p> <p><strong>This solution has a huge advantage over using <code>sudo</code> or <code>setuid</code>: it only runs the <em>necessary</em> tasks as root.</strong></p> <p>One last gotcha: the default JNI loader for AuthKit uses the Cocoa/Java bridge, which was removed from Mac OS X as of Snow Leopard. So on recent versions of Mac OS X, the code above will fail with <code>UnsatisfiedLinkError</code>. To work around this, use the following:</p> <pre><code>// Put this class somewhere: public class AuthKitLibLoader extends LibLoader { @Override protected File makeFallbackDir() { return new File("."); } } // Then, before calling AuthKit (using the above example), do this: // Hook in our "Snow Leopard-safe" extension to AuthKit (see below). System.setProperty("glguerin.util.LibLoader.imp", AuthKitLibLoader.class.getName()); </code></pre> <p>Finally, be sure to read the <a href="http://www.amug.org/~glguerin/sw/authkit/index.html" rel="noreferrer">AuthKit documentation</a> for more detail.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload