A user in the admin group. The user who installs Mac OS X is automatically assigned to the admin group. An administrator has fewer privileges than root, but more privileges than a normal user. An administrator cannot create, delete, or move files in the system domain.
The act of verifying identity with something the user has, knows, or is. For example, a user knows information such as a name and password. The user may have something physical such as a smart card. The identity can be something the user is—a physical feature such as a fingerprint or retinal scan. Authentication may require two or more forms of identification.
The act of granting a right. For example, a user asks for the right to perform an operation. The Security Server grants authorization after the user fulfills the rules specified in the policy database—such as providing a credential or authenticating.
A parameter or field that instructs the Security Server how to proceed with a request. Options include requesting preauthorization, requesting partial authorization, appending rights, and interacting with the user.
The Security Server uses the authorization reference to access an authorization session associated with a process.
An API that facilitates fine-grain control of privileged operations, such as accessing restricted areas of the operating system and self-restricted parts of your Mac OS X application. The Security Server uses policy-based decisions to authorize rights for users.
A measurement of biological matter used for identification—for example, fingerprints, retinal scans, and face recognition.
Proof of user authentication. used by the Security Server. When the Security Server authenticates a user, it creates a credential as part of the authorization session.
An application that uses a helper tool to perform specific tasks. Interprocess communication mechanisms are used to communicate between processes. In a factored application that uses Authorization Services, factor the code that performs privileged operations is factored into a separate helper tool.
A tool that executes some of an application’s functions as a separate process. In the case of security, a helper tool performs privileged operations for the application. See also setuid tool.
The name of a rule. The Security Server uses a rule’s key to match a right with a rule.
In BSD, a set of attributes governing who can read, write, and execute resources in the file system. The output of the ls -l command represents permissions as a nine-position code segmented into three binary three-character subcodes; the first subcode gives the permissions for the owner of the file, the second for the group that the file belongs to, and the last for everyone else. For example, -rwsr-xr-- means that the owner of the file has read, write, execute permissions (rwx); the group has read and execute permissions (r-x); all others have only read permissions. (The left-most position is reserved for a special character that says if this is a regular file (-), a directory (d), a symbolic link (l), or a special pseudo file device.) The execute bit has a different semantic for directories, meaning they are searchable.
A system that requires authorization to perform a privileged operations.
A database containing the set of rules the Security Server uses to determine authorization.
A form of authorization used before performing the actual authorization. Preauthorization is used to determine if a user has the possibility of authorizing later.
An operation that requires special rights or permissions. For example, all operations a user performs as root are privileged.
A named privilege. The Security Server authorizes rights for a user to perform a privileged operation.
A set of attributes used to set security policies for applications and for the system. See also policy database.
(1) The user with unlimited system privileges. Also called the superuser. (2) The top directory in a BSD-style directory hierarchy. Written as a slash (/), it is the first element in every absolute pathname.
A Core Services application in Mac OS X that deals with authorization and authentication through interaction with the policy database and Pluggable Authentication Modules (PAM).
An application that restricts part of its features to specific users.
The fourth bit in a resource’s permissions code. When this bit is set to s, the system allows the process running it to masquerade as another user. For example, -r-sr-xr-x 1 root wheel traceroute allows the process running the traceroute utility to run as root.
A tool that has its setuid bit set.
An application that has a portion of its features restricted to specific users because of the BSD permissions system.
Last updated: 2009-01-06
