Hi, I'm in the process of creating an App + Helper Tool combo application, and depending on the necessity of root privileges, I'm setting up two paths in the app:
-
If root privileges are not necessary, I'm using
SMJobSubmitrather directly:var submissionError: Unmanaged<CFError>? let submissionResult = SMJobSubmit(kSMDomainUserLaunchd, plist, nil, &submissionError)where
plistcontains these items:Label=com.***.redactedApp.redacted,ProgramArguments=[path/to/helper-tool, commandName, commandArg1, commandArg2]RunAtLoad=1,KeepAlive=0
and it works as necessary, and performs the operations.
-
Now, in the case of privilege escalation being necessary, this call becomes a bit more complex:
let authorization = SFAuthorization() var authRef: AuthorizationRef? do { try authorization?.obtain(withRight: kSMRightModifySystemDaemons, flags: [.extendRights, .interactionAllowed]) authRef = authorization?.authorizationRef() } catch let error { // Logging error } var submissionError: Unmanaged<CFError>? let submissionResult = SMJobSubmit(kSMDomainSystemLaunchd, plist, authRef, &submissionError)while using the same
plist, same executable at the same path, same Label.
However, when using the second path, suddenly SMJobSubmit fails:
Error Domain=CFErrorDomainLaunchd Code=2 "(null)"
Now, naturally I headed over to system logs in Console.app, and this is the weirdest - there is nothing suspicious near the log item I submit with the above error from the main application.
The tool is embedded in the Contents/MacOS folder. However, my problem is that anything that I can think of seems to lead to the same thought: it should be a problem in both cases, not just the privileged one.
Is there something extra that must be taken care of when using SMJobSubmit with privileged helper tools?
