0

I have a command line tool written in C++ with the Xcode that should detect if it's running as root (which is needed to communicate with my launch daemon):

if(geteuid() != 0)
{
    //Not root

}

And if not, show the prompt to elevate itself (in a new process) to root:

enter image description here

To begin that I call AuthorizationCreate as such:

//Get path to this process
pid_t pid = getpid();
char buffPath[PROC_PIDPATHINFO_MAXSIZE] = {};
int nln = proc_pidpath(pid, buffPath, PROC_PIDPATHINFO_MAXSIZE);
if(nln > 0 &&
   nln < PROC_PIDPATHINFO_MAXSIZE)
{
    AuthorizationRef authorizationRef;
    AuthorizationItem myItems = { kAuthorizationRightExecute, strlen(buffPath), &buffPath, 0 };
    AuthorizationRights myRights = { 1, &myItems };
    AuthorizationFlags flags = kAuthorizationFlagDefaults | kAuthorizationFlagInteractionAllowed | kAuthorizationFlagPreAuthorize | kAuthorizationFlagExtendRights;

    OSStatus status;
    status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment,
                                 kAuthorizationFlagDefaults, &authorizationRef);
    
    if(status == errAuthorizationSuccess)
    {
        //...
    }
}

But when I'm testing it on one macOS, and run my app by double-clicking it in Finder, the Finder tries to open it through Terminal, which results in AuthorizationCreate returning errAuthorizationInternal (or -60008):

Unable to obtain authorization for this operation.

What am I doing wrong with that AuthorizationCreate?

c00000fd
  • 20,994
  • 29
  • 177
  • 400
  • I recommend streaming the system log while attempting this, perhaps with --info, then checking for any messages that might give you some extra context. (`log stream --info`) Also make sure you have your code signing in order. Generally though, I expect this API to be intended for *apps* rather than command line tools. – pmdj Apr 08 '23 at 09:24

0 Answers0