mirror of
https://git.openafs.org/openafs.git
synced 2025-01-18 15:00:12 +00:00
120871f03f
The prefpane for macOS runs as the logged-in user, but needs root access for some operations: starting/stopping the client, editing various configuration files like CellServDB, etc. We currently use functions like AuthorizationExecuteWithPrivileges() to run commands with root privileges directly, but this approach no longer works as of macOS 10.8 (Mountain Lion); the relevant functions have been removed. Instead, a new approach exists as of macOS 10.6 (Snow Leopard). The prefpane application itself cannot gain root privileges, but we can provide another daemon process that runs as root, and the PrefPane sends requests to that process to perform the privileged operations we need. In this commit, create a separate helper program called PrivilegedHelper (privhelper for short) that serves this purpose. Define the executePrivTask() method in TaskUtil to handle communicating with privhelper over XPC. This commit does not define any of the tasks that privhelper will actually perform; this just implements privhelper itself. Later commits will add and use various privileged tasks in privhelper. In order for privhelper to be able to run as root, both privhelper and the prefpane itself must be code signed and the relevant apple team id must be specified in their Info.plist when they are built, as well as inside privhelper.c. Currently, we have no way of specifying code signatures info during the build, since all code signing is done when generating packages (via pkgbuild.sh) after binaries are built. For now, just put a commented-out section in src/platform/DARWIN/AFSPreference/Info.plist and src/platform/DARWIN/PrivilegedHelper/privhelper-info.plist and a placeholder in src/platform/DARWIN/PrivilegedHelper/privhelper.c to show how to add this information. The package builder must add their own team id to these before privhelper can work properly. The privhelper tool checks that the calling user has authorization to run commands as root (via AuthorizationCopyRights()), and that the calling process is either our AFSBackgrounder menu bar or the prefpane. We use xpc_connection_set_peer_code_signing_requirement() for this where available, but fallback to using SecCodeCheckValidity() with SecCodeCreateWithXPCMessage() or xpc_dictionary_get_audit_token()/SecCodeCopyGuestWithAttributes() if needed. Change-Id: I724b6d486ee5397c89c79e589ddcb2a5987a895b Reviewed-on: https://gerrit.openafs.org/15956 Tested-by: BuildBot <buildbot@rampaginggeek.com> Reviewed-by: Michael Meffie <mmeffie@sinenomine.net> Reviewed-by: Cheyenne Wills <cwills@sinenomine.net> Reviewed-by: Mark Vitale <mvitale@sinenomine.net> Reviewed-by: Andrew Deason <adeason@sinenomine.net>
179 lines
4.7 KiB
Plaintext
179 lines
4.7 KiB
Plaintext
AC_PREREQ([2.64])
|
|
AC_INIT([OpenAFS],[m4_esyscmd(build-tools/git-version .)],[openafs-bugs@openafs.org],[],[http://www.openafs.org/])
|
|
AC_CONFIG_AUX_DIR([build-tools])
|
|
AC_CONFIG_MACRO_DIR([src/cf])
|
|
AC_CONFIG_SRCDIR([src/config/stds.h])
|
|
|
|
AC_CONFIG_HEADERS([src/config/afsconfig.h])
|
|
MACOS_VERSION=1.9.2
|
|
|
|
AC_SUBST([MACOS_VERSION])
|
|
|
|
AC_PATH_PROGS([PATH_CPP], [cpp], [${CC-cc} -E], [$PATH:/lib:/usr/ccs/lib])
|
|
AC_SUBST([PATH_CPP])
|
|
|
|
OPENAFS_PATH_CC
|
|
OPENAFS_CONFIGURE_COMMON
|
|
OPENAFS_KRB5
|
|
OPENAFS_GSS
|
|
|
|
dnl Checks for summary
|
|
OPENAFS_SUMMARY_CHECK_NAMEI
|
|
|
|
AC_CONFIG_FILES([
|
|
Makefile
|
|
doc/man-pages/Makefile
|
|
doc/man-pages/install-man
|
|
doc/xml/AdminGuide/Makefile
|
|
doc/xml/QuickStartUnix/Makefile
|
|
doc/xml/UserGuide/Makefile
|
|
doc/xml/AdminRef/Makefile
|
|
doc/xml/mobi-fixup.xsl
|
|
doc/doxygen/Doxyfile
|
|
src/afs/Makefile
|
|
src/afsd/Makefile
|
|
src/afsmonitor/Makefile
|
|
src/aklog/Makefile
|
|
src/audit/Makefile
|
|
src/auth/Makefile
|
|
src/auth/test/Makefile
|
|
src/bozo/Makefile
|
|
src/bozo/test/Makefile
|
|
src/bu_utils/Makefile
|
|
src/bubasics/Makefile
|
|
src/bucoord/Makefile
|
|
src/budb/Makefile
|
|
src/tbudb/Makefile
|
|
src/butc/Makefile
|
|
src/butm/Makefile
|
|
src/cmd/Makefile
|
|
src/cmd/test/Makefile
|
|
src/comerr/Makefile
|
|
src/comerr/test/Makefile
|
|
src/config/Makefile
|
|
src/config/Makefile.config
|
|
src/config/Makefile.libtool
|
|
src/config/Makefile.lwp
|
|
src/config/Makefile.lwptool
|
|
src/config/Makefile.pthread
|
|
src/config/Makefile.version-CML
|
|
src/config/Makefile.version-NOCML
|
|
src/config/cc-wrapper
|
|
src/config/shlib-build
|
|
src/config/shlib-install
|
|
src/crypto/hcrypto/Makefile
|
|
src/crypto/rfc3961/Makefile
|
|
src/dir/Makefile
|
|
src/dir/test/Makefile
|
|
src/dviced/Makefile
|
|
src/dvolser/Makefile
|
|
src/export/Makefile
|
|
src/finale/Makefile
|
|
src/fsint/Makefile
|
|
src/fsprobe/Makefile
|
|
src/gtx/Makefile
|
|
src/kauth/Makefile
|
|
src/kauth/test/Makefile
|
|
src/kopenafs/Makefile
|
|
src/libacl/Makefile
|
|
src/libacl/test/Makefile
|
|
src/libadmin/Makefile
|
|
src/libadmin/adminutil/Makefile
|
|
src/libadmin/bos/Makefile
|
|
src/libadmin/cfg/Makefile
|
|
src/libadmin/cfg/test/Makefile
|
|
src/libadmin/client/Makefile
|
|
src/libadmin/kas/Makefile
|
|
src/libadmin/pts/Makefile
|
|
src/libadmin/samples/Makefile
|
|
src/libadmin/test/Makefile
|
|
src/libadmin/vos/Makefile
|
|
src/libafs/Makefile.common
|
|
src/libafs/MakefileProto.${MKAFS_OSTYPE}
|
|
${DARWIN_PLIST}
|
|
src/libafsauthent/Makefile
|
|
src/libafsrpc/Makefile
|
|
src/libuafs/Makefile.common
|
|
src/libuafs/MakefileProto.${MKAFS_OSTYPE}
|
|
src/log/Makefile
|
|
src/log/test/Makefile
|
|
src/lwp/Makefile
|
|
src/lwp/test/Makefile
|
|
src/opr/Makefile
|
|
src/packaging/MacOS/OpenAFS-debug.Description.plist
|
|
src/packaging/MacOS/OpenAFS-debug.Info.plist
|
|
src/packaging/MacOS/OpenAFS.Description.plist
|
|
src/packaging/MacOS/OpenAFS.Info.plist
|
|
src/packaging/MacOS/OpenAFS.info
|
|
src/packaging/MacOS/buildpkg.sh
|
|
src/packaging/MacOS/pkgbuild.sh
|
|
src/pam/Makefile
|
|
src/platform/Makefile
|
|
src/platform/${MKAFS_OSTYPE}/Makefile
|
|
src/platform/DARWIN/growlagent/Makefile
|
|
src/platform/DARWIN/PrivilegedHelper/Makefile
|
|
src/procmgmt/Makefile
|
|
src/procmgmt/test/Makefile
|
|
src/ptserver/Makefile
|
|
src/tptserver/Makefile
|
|
src/roken/Makefile
|
|
src/rx/Makefile
|
|
src/rx/bulk.example/Makefile
|
|
src/rx/bulktest/Makefile
|
|
src/rx/multi.example/Makefile
|
|
src/rx/simple.example/Makefile
|
|
src/rx/test/Makefile
|
|
src/rxdebug/Makefile
|
|
src/rxgen/Makefile
|
|
src/rxgk/Makefile
|
|
src/rxkad/Makefile
|
|
src/rxkad/test/Makefile
|
|
src/rxosd/Makefile
|
|
src/rxstat/Makefile
|
|
src/scout/Makefile
|
|
src/sys/Makefile
|
|
src/tbutc/Makefile
|
|
src/tests/Makefile
|
|
src/tests/run-tests
|
|
src/tools/Makefile
|
|
src/tools/dumpscan/Makefile
|
|
src/tools/rxperf/Makefile
|
|
src/tsalvaged/Makefile
|
|
src/tsm41/Makefile
|
|
src/tvolser/Makefile
|
|
src/ubik/Makefile
|
|
src/tubik/Makefile
|
|
src/update/Makefile
|
|
src/usd/Makefile
|
|
src/usd/test/Makefile
|
|
src/uss/Makefile
|
|
src/util/Makefile
|
|
src/util/test/Makefile
|
|
src/libafscp/Makefile
|
|
src/venus/Makefile
|
|
src/venus/test/Makefile
|
|
src/vfsck/Makefile
|
|
src/viced/Makefile
|
|
src/vlserver/Makefile
|
|
src/tvlserver/Makefile
|
|
src/vol/Makefile
|
|
src/volser/Makefile
|
|
src/xstat/Makefile
|
|
src/helper-splint.sh
|
|
tests/Makefile
|
|
tests/auth/Makefile
|
|
tests/cmd/Makefile
|
|
tests/common/Makefile
|
|
tests/opr/Makefile
|
|
tests/rx/Makefile
|
|
tests/tap/Makefile
|
|
tests/util/Makefile
|
|
tests/volser/Makefile])
|
|
AC_CONFIG_COMMANDS([default],[chmod a+x src/config/shlib-build
|
|
chmod a+x src/config/shlib-install
|
|
chmod a+x src/config/cc-wrapper],[])
|
|
AC_OUTPUT
|
|
|
|
# print a final summary
|
|
OPENAFS_SUMMARY
|