Problems understanding authorization

Question

Hi everybody, I'm having problems in understanding how to authorize my program to perform privileged tasks.
I read the apple documentation and wrote this piece of code:
AuthorizationRef auth;
OSStatus os;
AuthorizationRights rights;
AuthorizationItem item;
AuthorizationFlags flags;
os = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &auth);
item.name = "com.Me.myApp.test";
item.valueLength = 0;
item.value = NULL;
item.flags = 0;
rights.count = 1;
rights.items = &item;
flags = kAuthorizationFlagDefaults |
kAuthorizationFlagInteractionAllowed |
kAuthorizationFlagExtendRights;
os = AuthorizationCopyRights (auth, &rights, kAuthorizationEmptyEnvironment, flags, NULL);
after calling AuthorizationCopyRights I should be able to perform privileged tasks, right? Is there still something I've got to do?

Answer 1

etresoft wrote:
No. I mean you should study that documentation and figure out exactly what you want to do and the best way to go about it. You don't want to mess around with root access unless you know precisely what you are doing. I have seen programs that abused that privilege and caused me to have to reinstall unrelated 3rd party software that was inadvertently altered by an installer.
I've read that documentation 6 or 7 times, but it does explain only the concepts behind authorization (the Security Server, authentication without rights, naming the rights, credential cache and so on) while it's not such clear talking about code. What I need now is understand how it works. I've downloaded all the related sample code but I've found it filled with glue code, so that I didn't managed to understand what it really does. I'd prefer a bare code that actually does nothing useful rather than complete programs that does many things but don't let me understand the essentials.
Besides, what I'm trying to do is exactly to figure out the best way to solve my problem, but how can I choose the best way if I do not get where this way leads me to? I thought it was clear that my intention was not to acquire root privileges or to use AuthorizationExecuteWithPrivileges just to print a couple of strings or to execute an helloworld. I think it's obvious that root privileges should be used only if there's no other way, but I just want to understand how it works. It think it's absurd that, in order to understand that, I have to open low numbered ports!
Documentation says +The Security Server creates the file, opens it for reading and writing, and connects it to the tool’s standard input and output+. All right then, let's try. I executed ls and, reading the file, I found the output. Wonderful! Let's try with a custom program. Blank. So there's something I do not get. What? Mystery. I ask and the answer is "study the documentation".
I have never used a communication pipe when using AuthorizationExecuteWithPrivileges. I have never even released a program using AuthorizationExecuteWithPrivileges.
So maybe it would be easier to say "I don't know".
The best solution is not to use that function. The 2nd best solution is not to try to communicate with the tool you are executing. The third best solution is to study the documentation and example programs in order to learn how to do it correctly.
Probably you're right, probably the best solution is not to use that function. Probably it worths the effort to understand why. Even if the only result is that I'll be able to say "hey, that guy on the forum was right, let's find another way".
Well, except this, I have to thank you, your help has been useful this far.