macos - 将授权服务与 NSTask 结合使用

Question

好的，我正在使用 NSTask 来运行需要以管理员权限运行的 shell 脚本。我正在使用这个问题的一些代码:NSTask and AuthorizationCreate 。这是我目前拥有的:

//Authorization Create
AuthorizationRef myAuthorizationRef;
OSStatus myStatus;
myStatus = AuthorizationCreate (NULL, kAuthorizationEmptyEnvironment,
                                kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed , &myAuthorizationRef);
AuthorizationItem myItems[1];

myItems[0].name = "com.myOrganization.myProduct.myRight1";
myItems[0].valueLength = 0;
myItems[0].value = NULL;
myItems[0].flags = 0;

AuthorizationRights myRights;
myRights.count = sizeof (myItems) / sizeof (myItems[0]);
myRights.items = myItems;

AuthorizationFlags myFlags;
myFlags = kAuthorizationFlagDefaults |
kAuthorizationFlagInteractionAllowed |
kAuthorizationFlagExtendRights;

myStatus = AuthorizationCopyRights (myAuthorizationRef, &myRights,
                                    kAuthorizationEmptyEnvironment, myFlags, NULL);

if (myStatus==errAuthorizationSuccess)
{
    NSString *path = [[NSBundle mainBundle] pathForResource:@"kandorBackup" ofType:@"sh"];

    NSPipe *outputPipe = [NSPipe pipe];
    readHandle = [outputPipe fileHandleForReading];
    inData = nil;
    returnValue = nil;

    NSTask *task = [[NSTask alloc] init];
    [task setLaunchPath:path];
    [task setArguments:[NSArray arrayWithObjects:login, selectedDrive, rsyncFinalFlags, nil]];
    [task setStandardOutput:outputPipe];
    [readHandle waitForDataInBackgroundAndNotify];
    [[NSNotificationCenter defaultCenter] addObserver:self
                                             selector:@selector(recievedData:)
                                                 name:NSFileHandleDataAvailableNotification

                                               object:nil];
    [task launch];
}
myStatus = AuthorizationFree (myAuthorizationRef,
                              kAuthorizationFlagDestroyRights);

执行此操作时，系统会提示我输入管理员用户名和密码，但随后任务会像平常一样运行，而无需提升权限。为了让 NSTask 真正使用授权，我缺少什么？

Answer 1

在这里，您只是获得了一个 AuthorizationRef 并没有对其进行任何操作，仅获得授权并不会使您的可执行文件获得特权运行。您可以使用 ref 来启动使用 SMJobSubmit 嵌入到应用程序中的可执行文件，并且在该可执行文件中，您可以使用具有提升权限的 NSTask。以下是一些示例代码，解释了其工作原理:http://www.stairways.com/blog/2012-08-06-smjobsubmit