Is it possible to allow installation of specific packages/profiles without admin credentials by modifying authorization rights?.I was able to allow installation for all by modifying the installation right in authorizationdb.Is it possible to receive any information about package requesting for installation inside auth plugin so that i would be able to evaluate and allow.
2
-
I will assume you don’t mean using admin credentials to delegate admin to a non admin account using something like sudoers file. Please clarify what you seek if my answer is not on the mark. Basically, it looks like you’re defining malware installer that doesn’t rely on tricking an admin to authorize the install.– bmike ♦Commented Jun 19, 2020 at 11:10
-
what i meant was to create a authorization plugin that would allow installation of certain whitelisted apps(which might be identified by publisher) without prompting for admin password.– theappledevCommented Jun 19, 2020 at 11:28
Add a comment
|
2 Answers
Missing Intent
Unfortunately, the information needed to evaluate if an installer package is whitelisted is not available during requests to obtain an system.install.* right.
Calls to macOS's Authorization Services do not include details about what the authorization will be used for.
Even if you implement a custom Authorization Plug-in, the authorization request will not mention what package is being installed.
Use plug-ins to extend macOS authorization services to perform authorizations in a new way or to implement a new policy that is too complex to be implemented entirely with the authorization policy database.
What Next?
Here are some options:
- File a bug report directly with Apple;
- Write a
SMJobBlesshelper to grant administrator rights on-demand; see UpdateCore for an example administrator privileged helper tool that installs software; - Consider third party software that can provide a "self serve" service for your users.
answered Jun 19, 2020 at 12:06
-
i have implemented a custom authorization plugin.Is there a way to identify which application is being installed?I tried to access context and hint values but was unable to get details about the application being installed Commented Jun 19, 2020 at 12:08
-
No, that information is not available in the request. I suspect Apple's engineers would consider the information a possible security leak. A possible solution from Apple would check for a
system.install.pkg.<bundle of pkg>before a more generic right check. Commented Jun 19, 2020 at 12:13 -
I have extended the answer to mention a
SMJobBlessapproach and linked to a sample project. Commented Jun 19, 2020 at 12:16 -
is it possible to use helper to identify which app being installed currently and grant right?in my case standard users should be able to install any whitelisted 3rd party app without admin credentials Commented Jun 19, 2020 at 12:26
-
Yes, you could wrap up UpdateKit to handle installation for non-administrators of acceptable packages. The wrapped UpdateKit would need to be installed by an administrator to grant the initial rights. Commented Jun 19, 2020 at 14:39
What you ask is possible in several ways. We use management frameworks like JAMF Pro or Munki to script and manage arbitrary changes and installations so that no user needs to download / package / install or prompt. These are powerful distributed automation options, but they cost time and salary and experience and licensing.
You can roll your own more minimal installer, Most require a bit of skill if you can’t change your installer to just run as non-admin, but they are lighter cost and weight than an MDM suite solution. See homebrew for a great example of an installer that needs admin only at setup and not when installing new code. If you need admin installer and can’t use brew cask to package your apps, a dependable way is to write a daemon that runs as admin. Microsoft Office, Adobe and many other software does this, the installer system runs at launch or as a daemon and gets admin privileges and then uses the OS to run periodically.
This avoids the design intent for the installer to ask for admin at the last moment when installations trigger. Following the design intent is generally more secure and far less work for you and your customers.
-
in my case i am supposed to allow installation of any third party application(including the one which require admin cred) by standard users which are whitelisted by admin Commented Jun 19, 2020 at 11:53
-
We use JAMF framework for this. Munki is another framework that does this if you like open source solutions. @theappledev– bmike ♦Commented Jun 19, 2020 at 12:31