Home

Awesome

SwiftPrivilegedHelper

This is an example application to demonstrate how to use a privileged helper tool with authentication in Swift 4.2.

NOTE: Privilege escalation is not supported in sandboxed applications.

Please undestand the code and improve and customize it to suit your needs and your application.

Updated for Swift 4.2

I have rewritten the whole project for Swift 4.2 and improved the example in many places:

Index

Requirements

Dowload it here: SMJobBlessUtil.py

Use it like this: ./SMJobBlessUtil.py check /path/to/MyApplication.app

Setup

To test the project, you need to update it to use your own signing certificate.

Select signing team

  1. Select the project in the navigator.
  2. For both the application and helper targets:
  3. Change the signing Team to your Team.

Signing Troubleshooting

Use SMJobBlessUtil.py and correct all issues reported until it doesn't show any output.

Note: Changing BundleIdentifier

The project uses a bash script to automatically update the needed code signing requirements for your current certificate so that they will be correct both during normal builds and archiving.

This script has hardcoded bundle identifiers for the app and the helper, so if you change the bundle identifiers for any of these you have to update the script accordingly.

Application

The helper is installed by using SMJobBless.

When installed, you can enter a directory path in the text field at the top and select to run the /bin/ls command (with the entered path as argument) using the helper tool with or without requiring authorization.

The application caches the authorization reference which means that you only have to authorize that action once until you press the "Destroy Cached Authorization" or restart the application.

This behaviour can easily be changed to either require authrization every time, after x seconds or never.

Adding or removing code in the helper

If you modify or add/remove code that's used in the helper tool you MUST update the helper bundle version so when run the next time the application will recognize the helper has to be updated. Or else your new code will never be run.

References

Links to documentation on the authorization system on macOS.