Hi, I'm in the process of creating an App + Helper Tool combo application, and depending on the necessity of root privileges, I'm setting up two paths in the app:
If root privileges are not necessary, I'm using SMJobSubmit rather directly:
var submissionError: Unmanaged<CFError>?
let submissionResult = SMJobSubmit(kSMDomainUserLaunchd, plist, nil, &submissionError)
where plist contains these items:
Label=com.***.redactedApp.redacted,
ProgramArguments=[path/to/helper-tool, commandName, commandArg1, commandArg2]
RunAtLoad=1,
KeepAlive=0
and it works as necessary, and performs the operations.
Now, in the case of privilege escalation being necessary, this call becomes a bit more complex:
let authorization = SFAuthorization()
var authRef: AuthorizationRef?
do {
try authorization?.obtain(withRight: kSMRightModifySystemDaemons,
flags: [.extendRights, .interactionAllowed])
authRef = authorization?.authorizationRef()
} catch let error {
// Logging error
}
var submissionError: Unmanaged<CFError>?
let submissionResult = SMJobSubmit(kSMDomainSystemLaunchd, plist, authRef, &submissionError)
while using the same plist, same executable at the same path, same Label.
However, when using the second path, suddenly SMJobSubmit fails:
Error Domain=CFErrorDomainLaunchd Code=2 "(null)"
Now, naturally I headed over to system logs in Console.app, and this is the weirdest - there is nothing suspicious near the log item I submit with the above error from the main application.
The tool is embedded in the Contents/MacOS folder. However, my problem is that anything that I can think of seems to lead to the same thought: it should be a problem in both cases, not just the privileged one.
Is there something extra that must be taken care of when using SMJobSubmit with privileged helper tools?
