Managing the Authorization Database in OS X Mavericks

Question

Hi,
Since i updated to os 10.9, i had to change my script which helps me to create a powerusers group, which has more rights than a normal user. It was no problem to change in the most rules the group key from admin to powerusers. I did this with the help of the security authorizationdb and the plistbuddy command. What I do not understand is why i can't change anything in the authenticate-admin, the authenticate-admin-30 or the authenticate-session-owner-or-admin rule. Anyone has an idea? I used the following command:
security authorizationdb read authenticate-admin > /tmp/test.plist
/usr/libexec/PlistBuddy -c "Set :group powerusers" /tmp/test.plist
security authorizationdb write authenticate-admin < /tmp/test.plist
The first two lines work ok but it won't write it back into the auth DB. The same command even won't work if i leave away the second line and change nothing in the plist file. Does anyone has tips or ideas how to resolve this? or inputs why it doesn't work?

Answer 1

You can't change settings by modifying plist files. The plist files are just persistent representations of what is in memory. You have to change the database in memory and that means running the appropriate command-line utility. In this case, that is probably the dscl tool.