How to use FileManager with admin permissions programmatically

Hello,


I have a max os application that is supposed to copy files into /Library/Application Support folder.

I found a piece of code that performs the authorization with authentication and even creates the rights successfully.

Right after I try to perform a priviledged operation like creating a directory in /Library/Application Support folder.

I get a no permission error 513. How do I use the authorization I created. Seems like my case suits self-restricted application authorization. But I'm missing something there. Will appreciate your help. Here is the code I use to gainAccess:

Thanks in advance

privatefunc gainPermissions() {
        var authorizationRef: AuthorizationRef? = nil
        var authItem = AuthorizationItem(name: "xmpie.com.XMPieInstaller.filesRight", valueLength: 0, value: nil, flags: 0)
        var authRights = AuthorizationRights(count: 1, items: &authItem)
        let flags: AuthorizationFlags = [.interactionAllowed, .preAuthorize, .extendRights]
        var authStatus = AuthorizationCreate(&authRights, nil, flags, &authorizationRef)
        guard let authRef = authorizationRef else {
            NSLog("Failed to get authorization! \(authStatus) - \(String(authStatus: authStatus))")
            return
        }
        authStatus = AuthorizationCopyRights(authRef, &authRights, nil, flags, nil)
        NSLog("Auth status #\(authStatus) - \(String(authStatus: authStatus))")

        let paths = NSSearchPathForDirectoriesInDomains(.applicationSupportDirectory, .localDomainMask, true)
        if paths.count != 0 {
            let resolvedPath = paths[0] as NSString
            let resolvedPath1 = resolvedPath.appendingPathComponent("XMPieTest")
            do {
                try FileManager.default.createDirectory(atPath: resolvedPath1, withIntermediateDirectories: true, attributes: nil)
            } catch let error as NSError {
               print(error.localizedDescription);
            }
      

Replies

I’ve no idea what that code is trying to do, but it’s way off in the weeds. There’s no connection between the

AuthorizationRef
it creates in the first part and the
FileManager
call it makes in the second.

Installing components system wide is a challenge. There are four basic strategies you can use:

  • Create an installer package for the Apple installer (A)

  • Create your own installer (B)

  • NSWorkspaceAuthorization
    (C)
  • AuthorizationExecuteWithPrivileges
    (D)

You should immediately rule out option D. That API was deprecated many years ago, and for good reasons: It’s deeply insecure.

Option C is great, but rather limited. I don’t think it’ll do what you need.

Option B is a lot of work. A good place to start is the EvenBetterAuthorizationSample sample code. This shows how to bootstrap your escalated privileges, and from there you can write the code to install and remove components.

Option A is the one I typically recommend. It’s secure and relatively easy to do.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.

Thank you for clarifying the options. All I'm trying to achieve is to copy files to /Library/Application Support and other areas that require admin privileges. Is there no way to grant admin privileges in order to use FileManager APIs for this purpose?

Is there no way to grant admin privileges in order to use

FileManager
APIs for this purpose?

No.

FileManager
does its work inside your process and thus the only way to grant privileges to
FileManager
is to run the entire process with privileges.

All I'm trying to achieve is to copy files to

/Library/Application Support

What are these files?

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

ps DTS is closed 21 Dec through 1 Jan.