SecurityTool/authz.c

   1 /*
   2  * Copyright (c) 2003-2004,2006-2007,2009-2010,2012-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  *
  23  *  authz.c
  24  */
  25
  26 #include <getopt.h>
  27 #include <stdio.h>
  28 #include <Security/AuthorizationPriv.h>
  29 #include <utilities/SecCFRelease.h>
  30
  31 #include "authz.h"
  32 #include "security_tool.h"
  33
  34 // AEWP?
  35
  36 static AuthorizationRef
  37 read_auth_ref_from_stdin()
  38 {
  39         AuthorizationRef auth_ref = NULL;
  40         AuthorizationExternalForm extform;
  41         ssize_t bytes_read;
  42
  43         while (kAuthorizationExternalFormLength != (bytes_read = read(STDIN_FILENO, &extform, kAuthorizationExternalFormLength)))
  44         {
  45                 if ((bytes_read == -1) && ((errno != EAGAIN) || (errno != EINTR)))
  46                         break;
  47         }
  48         if (bytes_read != kAuthorizationExternalFormLength)
  49                 fprintf(stderr, "ERR: Failed to read authref\n");
  50         else
  51                 if (AuthorizationCreateFromExternalForm(&extform, &auth_ref))
  52                         fprintf(stderr, "ERR: Failed to internalize authref\n");
  53
  54         close(0);
  55
  56         return auth_ref;
  57 }
  58
  59 static int
  60 write_auth_ref_to_stdout(AuthorizationRef auth_ref)
  61 {
  62         AuthorizationExternalForm extform;
  63         ssize_t bytes_written;
  64
  65         if (AuthorizationMakeExternalForm(auth_ref, &extform))
  66                 return -1;
  67
  68         while (kAuthorizationExternalFormLength != (bytes_written = write(STDOUT_FILENO, &extform, kAuthorizationExternalFormLength)))
  69         {
  70                 if ((bytes_written == -1) && ((errno != EAGAIN) || (errno != EINTR)))
  71                         break;
  72         }
  73
  74         if (bytes_written == kAuthorizationExternalFormLength)
  75                 return 0;
  76
  77         return -1;
  78 }
  79
  80 static void
  81 write_dict_to_stdout(CFDictionaryRef dict)
  82 {
  83         if (!dict)
  84                 return;
  85
  86         CFDataRef right_definition_xml = CFPropertyListCreateXMLData(NULL, dict);
  87
  88         if (!right_definition_xml)
  89                 return;
  90
  91         write(STDOUT_FILENO, CFDataGetBytePtr(right_definition_xml), CFDataGetLength(right_definition_xml));
  92         CFRelease(right_definition_xml);
  93 }
  94
  95 static CFDictionaryRef CF_RETURNS_RETAINED
  96 read_dict_from_stdin()
  97 {
  98         ssize_t bytes_read = 0;
  99         uint8_t buffer[4096];
 100         CFMutableDataRef data = CFDataCreateMutable(kCFAllocatorDefault, 0);
 101         CFErrorRef err = NULL;
 102
 103         if (!data)
 104                 return NULL;
 105
 106         while ((bytes_read = read(STDIN_FILENO, (void *)buffer, sizeof(buffer))))
 107         {
 108                 if (bytes_read == -1)
 109                         break;
 110                 else
 111                         CFDataAppendBytes(data, buffer, bytes_read);
 112         }
 113
 114         CFDictionaryRef right_dict = (CFDictionaryRef)CFPropertyListCreateWithData(kCFAllocatorDefault, data, kCFPropertyListImmutable, NULL, &err);
 115         CFRelease(data);
 116
 117         if (NULL == right_dict) {
 118                 CFShow(err);
 119                 return NULL;
 120         }
 121
 122         if (CFGetTypeID(right_dict) != CFDictionaryGetTypeID())
 123         {
 124                 fprintf(stderr, "This is not a dictionary.\n");
 125                 CFRelease(right_dict);
 126                 return NULL;
 127         }
 128         return right_dict;
 129 }
 130
 131 static CFPropertyListRef CF_RETURNS_RETAINED
 132 read_plist_from_file(CFStringRef filePath)
 133 {
 134         CFTypeRef         property = NULL;
 135         CFPropertyListRef propertyList = NULL;
 136         CFURLRef          fileURL = NULL;
 137         CFErrorRef       errorString = NULL;
 138         CFDataRef         resourceData = NULL;
 139         Boolean           status = FALSE;
 140         SInt32            errorCode = -1;
 141
 142         // Convert the path to a URL.
 143         fileURL = CFURLCreateWithFileSystemPath(kCFAllocatorDefault, filePath, kCFURLPOSIXPathStyle, false);
 144         if (NULL == fileURL) {
 145                 goto bail;
 146         }
 147         property = CFURLCreatePropertyFromResource(kCFAllocatorDefault, fileURL, kCFURLFileExists, NULL);
 148         if (NULL == property) {
 149                 goto bail;
 150         }
 151         status = CFBooleanGetValue(property);
 152         if (!status) {
 153                 fprintf(stderr, "The file does not exist.\n");
 154                 goto bail;
 155         }
 156
 157         // Read the XML file.
 158         status = CFURLCreateDataAndPropertiesFromResource(kCFAllocatorDefault, fileURL, &resourceData, NULL, NULL, &errorCode);
 159         if (!status) {
 160                 fprintf(stderr, "Error (%d) reading the file.\n", (int)errorCode);
 161                 goto bail;
 162         }
 163
 164         // Reconstitute the dictionary using the XML data.
 165         propertyList = CFPropertyListCreateWithData(kCFAllocatorDefault, resourceData, kCFPropertyListImmutable, NULL, &errorString);
 166         if (NULL == propertyList) {
 167                 CFShow(errorString);
 168                 goto bail;
 169         }
 170
 171         // Some error checking.
 172         if (!CFPropertyListIsValid(propertyList, kCFPropertyListXMLFormat_v1_0) || CFGetTypeID(propertyList) != CFDictionaryGetTypeID()) {
 173                 fprintf(stderr, "The file is invalid.\n");
 174                 CFRelease(propertyList);
 175                 propertyList = NULL;
 176                 goto bail;
 177         }
 178
 179 bail:
 180         if (NULL != fileURL)
 181                 CFRelease(fileURL);
 182         if (NULL != property)
 183                 CFRelease(property);
 184         if (NULL != resourceData)
 185                 CFRelease(resourceData);
 186
 187         return propertyList;
 188 }
 189
 190 static Boolean
 191 write_plist_to_file(CFPropertyListRef propertyList, CFStringRef filePath)
 192 {
 193         CFTypeRef   property = NULL;
 194         CFURLRef        fileURL = NULL;
 195         CFDataRef       xmlData = NULL;
 196         Boolean         status = FALSE;
 197         SInt32          errorCode = -1;
 198         CFErrorRef      errorRef = NULL;
 199
 200         // Convert the path to a URL.
 201         fileURL = CFURLCreateWithFileSystemPath(kCFAllocatorDefault, filePath, kCFURLPOSIXPathStyle, false);
 202         if (NULL == fileURL) {
 203                 goto bail;
 204         }
 205         property = CFURLCreatePropertyFromResource(kCFAllocatorDefault, fileURL, kCFURLFileExists, NULL);
 206         if (NULL == property) {
 207                 goto bail;
 208         }
 209         if (!CFBooleanGetValue(property)) {
 210                 fprintf(stderr, "The file does not exist.\n");
 211                 goto bail;
 212         }
 213
 214         // Convert the property list into XML data.
 215         xmlData = CFPropertyListCreateData(kCFAllocatorDefault, propertyList, kCFPropertyListXMLFormat_v1_0, 0, &errorRef);
 216         if (errorRef) {
 217                 fprintf(stderr, "The file could not be written.\n");
 218                 goto bail;
 219         }
 220
 221         // Write the XML data to the file.
 222         if (!CFURLWriteDataAndPropertiesToResource(fileURL, xmlData, NULL, &errorCode)) {
 223                 fprintf(stderr, "The file could not be written.\n");
 224                 goto bail;
 225         }
 226
 227         status = TRUE;
 228 bail:
 229     CFReleaseNull(property);
 230         if (NULL != xmlData)
 231                 CFRelease(xmlData);
 232         if (NULL != fileURL)
 233                 CFRelease(fileURL);
 234
 235         return status;
 236 }
 237
 238 static void merge_dictionaries(const void *key, const void *value, void *mergeDict)
 239 {
 240         CFDictionarySetValue(mergeDict, key, value);
 241 }
 242
 243 int
 244 authorizationdb(int argc, char * const * argv)
 245 {
 246         AuthorizationRef auth_ref = NULL;
 247         int ch;
 248     while ((ch = getopt(argc, argv, "i")) != -1)
 249         {
 250                 switch  (ch)
 251                 {
 252                 case 'i':
 253                         auth_ref = read_auth_ref_from_stdin();
 254                         break;
 255                 case '?':
 256                 default:
 257                         return 2;
 258                 }
 259         }
 260
 261         argc -= optind;
 262         argv += optind;
 263
 264         if (argc == 0)
 265                 return 2; // required right parameter(s)
 266
 267         OSStatus status;
 268
 269         if (argc > 1)
 270         {
 271                 if (!auth_ref && AuthorizationCreate(NULL, NULL, 0, &auth_ref))
 272                         return -1;
 273
 274                 if (!strcmp("read", argv[0]))
 275                 {
 276                         CFDictionaryRef right_definition;
 277                         status = AuthorizationRightGet(argv[1], &right_definition);
 278                         if (!status)
 279                         {
 280                                 write_dict_to_stdout(right_definition);
 281                                 CFRelease(right_definition);
 282                         }
 283                 }
 284                 else if (!strcmp("write", argv[0]))
 285                 {
 286                         if (argc == 2)
 287                         {
 288                                 CFDictionaryRef right_definition = read_dict_from_stdin();
 289                                 if (!right_definition)
 290                                         return -1;
 291                                 status = AuthorizationRightSet(auth_ref, argv[1], right_definition, NULL, NULL, NULL);
 292                                 CFRelease(right_definition);
 293                         }
 294                         else if (argc == 3)
 295                         {
 296                                 // argv[2] is shortcut string
 297                                 CFStringRef shortcut_definition = CFStringCreateWithCStringNoCopy(NULL, argv[2], kCFStringEncodingUTF8, kCFAllocatorNull);
 298                                 if (!shortcut_definition)
 299                                         return -1;
 300                                 status = AuthorizationRightSet(auth_ref, argv[1], shortcut_definition, NULL, NULL, NULL);
 301                                 CFRelease(shortcut_definition);
 302                         }
 303                         else
 304                                 return 2; // take one optional argument - no more
 305
 306                 }
 307                 else if (!strcmp("remove", argv[0]))
 308                 {
 309                         status = AuthorizationRightRemove(auth_ref, argv[1]);
 310                 }
 311                 else if (!strcmp("smartcard", argv[0]))
 312                 {
 313                         if (argc == 2)
 314             {
 315                 if(!strcmp("status", argv[1]))
 316                 {
 317                     const CFStringRef SMARTCARD_LINE = CFSTR("builtin:smartcard-sniffer,privileged");
 318                     const CFStringRef MECHANISMS = CFSTR("mechanisms");
 319                     const CFStringRef BUILTIN_LINE = CFSTR("builtin:policy-banner");
 320                     const char* SYSTEM_LOGIN_CONSOLE = "system.login.console";
 321                     const char* AUTHENTICATE = "authenticate";
 322
 323                     CFIndex requiredLine1 = -1;
 324                     CFIndex requiredLine2 = -1;
 325
 326                     CFDictionaryRef right_definition;
 327                     status = AuthorizationRightGet(SYSTEM_LOGIN_CONSOLE, &right_definition);
 328                     if(!status)
 329                     {
 330                         CFArrayRef mechanisms;
 331
 332                         Boolean res = CFDictionaryGetValueIfPresent(right_definition, MECHANISMS, (void*)&mechanisms);
 333                         if(res)
 334                         {
 335                             // now parse all array elements until "builtin:policy-banner" is found
 336                             CFIndex c = CFArrayGetCount(mechanisms);
 337                             CFStringRef mechanismName;
 338
 339                             for (CFIndex i = 0; i < c; ++i)
 340                             {
 341                                 mechanismName = CFArrayGetValueAtIndex(mechanisms, i);
 342                                 if(CFStringCompare(mechanismName, BUILTIN_LINE, 0) == kCFCompareEqualTo)
 343                                 {
 344                                     if(i + 1 < c)
 345                                     {
 346                                         mechanismName = CFArrayGetValueAtIndex(mechanisms, i + 1);
 347                                         if(CFStringCompare(mechanismName, SMARTCARD_LINE, 0) == kCFCompareEqualTo)
 348                                         {
 349                                             requiredLine1 = i + 1;
 350                                         }
 351                                         break;
 352                                     }
 353                                 }
 354                             }
 355                         }
 356                     CFRelease(right_definition);
 357                     }
 358                     status = AuthorizationRightGet(AUTHENTICATE, &right_definition);
 359                     if(!status)
 360                     {
 361                         CFArrayRef mechanisms;
 362
 363                         Boolean res = CFDictionaryGetValueIfPresent(right_definition, MECHANISMS, (void*)&mechanisms);
 364                         if(res)
 365                         {
 366                             // now parse all array elements until "builtin:policy-banner" is found
 367                             CFIndex c = CFArrayGetCount(mechanisms);
 368                             CFStringRef mechanismName;
 369
 370                             if(c > 0)
 371                             {
 372                                 mechanismName = CFArrayGetValueAtIndex(mechanisms, 0);
 373                                 if(CFStringCompare(mechanismName, SMARTCARD_LINE, 0) == kCFCompareEqualTo)
 374                                 {
 375                                     requiredLine2 = 0;
 376                                 }
 377                             }
 378                         }
 379                         CFRelease(right_definition);
 380                     }
 381                     printf("Current smartcard login state: %s (system.login.console %s, authentication rule %s)\n", requiredLine1 != -1 && requiredLine2 != -1 ?"enabled":"disabled", requiredLine1 != -1 ? "enabled":"disabled", requiredLine2 != -1 ? "enabled":"disabled");
 382
 383                 }
 384                 else if(!strcmp("disable", argv[1]))
 385                     status = AuthorizationEnableSmartCard(auth_ref, FALSE);
 386                 else if(!strcmp("enable", argv[1]))
 387                     status = AuthorizationEnableSmartCard(auth_ref, TRUE);
 388                 else
 389                    return 2; // unrecognized parameter
 390             }
 391             else
 392                 return 2; // required parameter missing
 393                 }
 394                 else if (!strcmp("merge", argv[0])) {
 395                         status = 1;
 396                         CFStringRef sourcePath = NULL;
 397                         CFStringRef destPath = NULL;
 398                         CFPropertyListRef sourcePlist = NULL;
 399                         CFPropertyListRef destPlist = NULL;
 400                         CFDictionaryRef sourceRights = NULL;
 401                         CFDictionaryRef sourceRules = NULL;
 402                         CFDictionaryRef destRights = NULL;
 403                         CFDictionaryRef destRules = NULL;
 404                         CFIndex rightsCount = 0;
 405                         CFIndex rulesCount = 0;
 406                         CFMutableDictionaryRef mergeRights = NULL;
 407                         CFMutableDictionaryRef mergeRules = NULL;
 408                         CFMutableDictionaryRef outDict = NULL;
 409
 410                         if (argc < 2 || argc > 3)
 411                                 return 2;
 412
 413                         if (!strcmp("-", argv[1])) {
 414                                 // Merging from <STDIN>.
 415                                 sourcePlist = read_dict_from_stdin();
 416                         } else {
 417                                 sourcePath = CFStringCreateWithCString(kCFAllocatorDefault, argv[1], kCFStringEncodingUTF8);
 418                                 if (NULL == sourcePath) {
 419                                         goto bail;
 420                                 }
 421                                 sourcePlist = read_plist_from_file(sourcePath);
 422                         }
 423                         if (NULL == sourcePlist)
 424                                 goto bail;
 425                         if (argc == 2) {
 426                                 // Merging to /etc/authorization.
 427                                 destPath = CFStringCreateWithCString(kCFAllocatorDefault, "/etc/authorization", kCFStringEncodingUTF8);
 428                         } else {
 429                                 destPath = CFStringCreateWithCString(kCFAllocatorDefault, argv[2], kCFStringEncodingUTF8);
 430                         }
 431                         if (NULL == destPath) {
 432                                 goto bail;
 433                         }
 434                         destPlist = read_plist_from_file(destPath);
 435                         if (NULL == destPlist)
 436                                 goto bail;
 437
 438                         sourceRights = CFDictionaryGetValue(sourcePlist, CFSTR("rights"));
 439                         sourceRules = CFDictionaryGetValue(sourcePlist, CFSTR("rules"));
 440                         destRights = CFDictionaryGetValue(destPlist, CFSTR("rights"));
 441                         destRules = CFDictionaryGetValue(destPlist, CFSTR("rules"));
 442                         if (sourceRights)
 443                                 rightsCount += CFDictionaryGetCount(sourceRights);
 444                         if (destRights)
 445                                 rightsCount += CFDictionaryGetCount(destRights);
 446                         mergeRights = CFDictionaryCreateMutable(NULL, rightsCount, &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 447                         if (NULL == mergeRights) {
 448                                 goto bail;
 449                         }
 450                         if (sourceRules)
 451                                 rulesCount += CFDictionaryGetCount(sourceRules);
 452                         if (destRules)
 453                                 rulesCount += CFDictionaryGetCount(destRules);
 454                         mergeRules = CFDictionaryCreateMutable(NULL, rulesCount, &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 455                         if (NULL == mergeRules) {
 456                                 goto bail;
 457                         }
 458
 459                         if (destRights)
 460                                 CFDictionaryApplyFunction(destRights, merge_dictionaries, mergeRights);
 461                         if (destRules)
 462                                 CFDictionaryApplyFunction(destRules, merge_dictionaries, mergeRules);
 463                         if (sourceRights)
 464                                 CFDictionaryApplyFunction(sourceRights, merge_dictionaries, mergeRights);
 465                         if (sourceRules)
 466                                 CFDictionaryApplyFunction(sourceRules, merge_dictionaries, mergeRules);
 467
 468                         outDict = CFDictionaryCreateMutable(NULL, 3, &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 469                         if (NULL == outDict) {
 470                                 goto bail;
 471                         }
 472                         if (CFDictionaryContainsKey(sourcePlist, CFSTR("comment")))
 473                                 CFDictionaryAddValue(outDict, CFSTR("comment"), CFDictionaryGetValue(sourcePlist, CFSTR("comment")));
 474                         else if (CFDictionaryContainsKey(destPlist, CFSTR("comment")))
 475                                 CFDictionaryAddValue(outDict, CFSTR("comment"), CFDictionaryGetValue(destPlist, CFSTR("comment")));
 476                         CFDictionaryAddValue(outDict, CFSTR("rights"), mergeRights);
 477                         CFDictionaryAddValue(outDict, CFSTR("rules"), mergeRules);
 478                         if (!write_plist_to_file(outDict, destPath))
 479                                 goto bail;
 480
 481                         status = noErr;
 482 bail:
 483                         if (sourcePath)
 484                                 CFRelease(sourcePath);
 485                         if (destPath)
 486                                 CFRelease(destPath);
 487                         if (sourcePlist)
 488                                 CFRelease(sourcePlist);
 489                         if (destPlist)
 490                                 CFRelease(destPlist);
 491                         if (outDict)
 492                                 CFRelease(outDict);
 493                 }
 494                 else
 495                         return 2;
 496         }
 497         else
 498                 return 2;
 499
 500         if (auth_ref)
 501                 AuthorizationFree(auth_ref, 0);
 502
 503         if (!do_quiet)
 504                 fprintf(stderr, "%s (%d)\n", status ? "NO" : "YES", (int)status);
 505
 506         return (status ? -1 : 0);
 507 }
 508
 509 int
 510 authorize(int argc, char * const *argv)
 511 {
 512         int ch;
 513         OSStatus status;
 514
 515         Boolean user_interaction_allowed = FALSE, extend_rights = TRUE;
 516         Boolean partial_rights = FALSE, destroy_rights = FALSE;
 517         Boolean pre_authorize = FALSE, internalize = FALSE, externalize = FALSE;
 518         Boolean wait = FALSE, explicit_credentials = FALSE;
 519         Boolean isolate_explicit_credentials = FALSE, least_privileged = FALSE;
 520         char *login = NULL;
 521
 522     while ((ch = getopt(argc, argv, "ucC:EpdPieqwxl")) != -1)
 523         {
 524                 switch  (ch)
 525                 {
 526                 case 'u':
 527                         user_interaction_allowed = TRUE;
 528                         break;
 529                 case 'c':
 530                         explicit_credentials = TRUE;
 531                         break;
 532                 case 'C':
 533                         explicit_credentials = TRUE;
 534                         login = optarg;
 535                         break;
 536                 case 'e':
 537                         externalize = TRUE;
 538                         break;
 539                 case 'E':
 540                         extend_rights = FALSE;
 541                         break;
 542                 case 'p':
 543                         partial_rights = TRUE;
 544                         break;
 545                 case 'd':
 546                         destroy_rights = TRUE;
 547                         break;
 548                 case 'P':
 549                         pre_authorize = TRUE;
 550                         break;
 551                 case 'i':
 552                         internalize = TRUE;
 553                         break;
 554                 case 'w':
 555                         wait = TRUE;
 556                         externalize = TRUE;
 557                         break;
 558                 case 'x':
 559                         isolate_explicit_credentials = TRUE;
 560                         break;
 561                 case 'l':
 562                         least_privileged = TRUE;
 563                         break;
 564                 case '?':
 565                 default:
 566                         return 2; /* @@@ Return 2 triggers usage message. */
 567                 }
 568         }
 569
 570         argc -= optind;
 571         argv += optind;
 572
 573         if (argc == 0)
 574                 return 2; // required right parameter(s)
 575
 576 // set up AuthorizationFlags
 577         AuthorizationFlags flags = kAuthorizationFlagDefaults |
 578                 (user_interaction_allowed ? kAuthorizationFlagInteractionAllowed : 0) |
 579                 (extend_rights ? kAuthorizationFlagExtendRights : 0) |
 580                 (partial_rights ? kAuthorizationFlagPartialRights : 0) |
 581                 (pre_authorize ? kAuthorizationFlagPreAuthorize : 0) |
 582                 (least_privileged ? kAuthorizationFlagLeastPrivileged : 0);
 583
 584 // set up AuthorizationRightSet
 585         AuthorizationItem rights[argc];
 586         memset(rights, '\0', argc * sizeof(AuthorizationItem));
 587         AuthorizationItemSet rightset = { argc, rights };
 588         while (argc > 0)
 589                 rights[--argc].name = *argv++;
 590
 591         AuthorizationRef auth_ref = NULL;
 592
 593 // internalize AuthorizationRef
 594         if (internalize)
 595         {
 596                 auth_ref = read_auth_ref_from_stdin();
 597                 if (!auth_ref)
 598                         return 1;
 599         }
 600
 601         if (!auth_ref && AuthorizationCreate(NULL, NULL,
 602                                 (least_privileged ? kAuthorizationFlagLeastPrivileged : 0),
 603                                 &auth_ref))
 604                 return -1;
 605
 606 // prepare environment if needed
 607         AuthorizationEnvironment *envp = NULL;
 608         if (explicit_credentials) {
 609                 if (!login)
 610                         login = getlogin();
 611                 char *pass = getpass("Password:");
 612                 if (!(login && pass))
 613                         return 1;
 614                 static AuthorizationItem authenv[] = {
 615                         { kAuthorizationEnvironmentUsername },
 616                         { kAuthorizationEnvironmentPassword },
 617                         { kAuthorizationEnvironmentShared }                     // optional (see below)
 618                 };
 619                 static AuthorizationEnvironment env = { 0, authenv };
 620                 authenv[0].valueLength = strlen(login);
 621                 authenv[0].value = login;
 622                 authenv[1].valueLength = strlen(pass);
 623                 authenv[1].value = pass;
 624                 if (isolate_explicit_credentials)
 625                         env.count = 2;          // do not send kAuthorizationEnvironmentShared
 626                 else
 627                         env.count = 3;          // do send kAuthorizationEnvironmentShared
 628                 envp = &env;
 629         }
 630
 631 // perform Authorization
 632         AuthorizationRights *granted_rights = NULL;
 633         status = AuthorizationCopyRights(auth_ref, &rightset, envp, flags, &granted_rights);
 634
 635 // externalize AuthorizationRef
 636         if (externalize)
 637                 write_auth_ref_to_stdout(auth_ref);
 638
 639         if (!do_quiet)
 640                 fprintf(stderr, "%s (%d) ", status ? "NO" : "YES", (int)status);
 641
 642         if (!do_quiet && !status && granted_rights)
 643         {
 644                 uint32_t index;
 645                 fprintf(stderr, "{ %d: ", (int)granted_rights->count);
 646                 for (index = 0; index < granted_rights->count; index++)
 647                 {
 648                         fprintf(stderr, "\"%s\"%s %c ", granted_rights->items[index].name,
 649                                 (kAuthorizationFlagCanNotPreAuthorize & granted_rights->items[index].flags) ? " (cannot-preauthorize)" : "",
 650                                 (index+1 != granted_rights->count) ? ',' : '}');
 651                 }
 652                 AuthorizationFreeItemSet(granted_rights);
 653         }
 654
 655         if (!do_quiet)
 656                 fprintf(stderr, "\n");
 657
 658 // wait for client to pick up AuthorizationRef
 659         if (externalize && wait)
 660                 while (-1 != write(STDOUT_FILENO, NULL, 0))
 661                         usleep(100);
 662
 663 // drop AuthorizationRef
 664         if (auth_ref)
 665                 AuthorizationFree(auth_ref, destroy_rights ? kAuthorizationFlagDestroyRights : 0);
 666
 667         return (status ? -1 : 0);
 668 }
 669
 670
 671 int
 672 execute_with_privileges(int argc, char * const *argv)
 673 {
 674         AuthorizationRef auth_ref = NULL;
 675         int ch;
 676     while ((ch = getopt(argc, argv, "i")) != -1)
 677         {
 678                 switch  (ch)
 679                 {
 680                 case 'i':
 681                         auth_ref = read_auth_ref_from_stdin();
 682                         break;
 683                 case '?':
 684                 default:
 685                         return 2;
 686                 }
 687         }
 688
 689         argc -= optind;
 690         argv += optind;
 691
 692         if (argc == 0)
 693                 return 2; // required tool parameter(s)
 694
 695         OSStatus status;
 696
 697         if (!auth_ref && AuthorizationCreate(NULL, NULL, 0, &auth_ref))
 698                 return -1;
 699
 700         FILE *communications_pipe = NULL;
 701
 702         status = AuthorizationExecuteWithPrivileges(auth_ref,argv[0], 0, (argc > 1) ? &argv[1] : NULL, &communications_pipe);
 703
 704         if (!do_quiet)
 705                 fprintf(stderr, "%s (%d) ", status ? "NO" : "YES", (int)status);
 706
 707         if (!status)
 708         {
 709                 ssize_t bytes_read = 0;
 710                 uint8_t buffer[4096];
 711
 712                 while ((bytes_read = read(STDIN_FILENO, &buffer, sizeof(buffer))))
 713                 {
 714                         if ((bytes_read == -1) && ((errno != EAGAIN) || (errno != EINTR)))
 715                                 break;
 716                         else
 717                                 while ((-1 == write(fileno(communications_pipe), buffer, bytes_read)) &&
 718                                                 ((errno == EAGAIN) || (errno == EINTR)))
 719                                                         usleep(100);
 720                 }
 721         }
 722
 723         return (status ? -1 : 0);
 724 }
 725