]> git.saurik.com Git - apple/security.git/blob - OSX/authd/authorization.plist
projects / apple / security.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Security-59754.80.3.tar.gz
[apple/security.git] / OSX / authd / authorization.plist
1 <?xml version="1.0" encoding="UTF-8"?>
2 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3 <plist version="1.0">
4 <dict>
5 <key>comment</key>
6 <string>The name of the requested right is matched against the keys. An exact match has priority, otherwise the longest match from the start is used. Note that the right will only match wildcard rules (ending in a ".") during this reduction.
7
8 allow rule: this is always allowed
9 &lt;key&gt;com.apple.TestApp.benign&lt;/key&gt;
10 &lt;string&gt;allow&lt;/string&gt;
11
12 deny rule: this is always denied
13 &lt;key&gt;com.apple.TestApp.dangerous&lt;/key&gt;
14 &lt;string&gt;deny&lt;/string&gt;
15
16 user rule: successful authentication as a user in the specified group(5) allows the associated right.
17
18 The shared property specifies whether a credential generated on success is shared with other apps (i.e., those in the same "session"). This property defaults to false if not specified.
19
20 The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule.
21
22 The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified.
23
24 See remaining rules for examples.
25 </string>
26 <key>rights</key>
27 <dict>
28 <key></key>
29 <dict>
30 <key>class</key>
31 <string>rule</string>
32 <key>comment</key>
33 <string>Matches otherwise unmatched rights (i.e., is a default).</string>
34 <key>rule</key>
35 <string>default</string>
36 </dict>
37 <key>com.apple.</key>
38 <dict>
39 <key>rule</key>
40 <string>default</string>
41 </dict>
42 <key>com.apple.AOSNotification.FindMyMac.modify</key>
43 <dict>
44 <key>allow-root</key>
45 <true/>
46 <key>class</key>
47 <string>rule</string>
48 <key>k-of-n</key>
49 <integer>1</integer>
50 <key>rule</key>
51 <array>
52 <string>is-root</string>
53 <string>is-admin</string>
54 <string>default</string>
55 </array>
56 </dict>
57 <key>com.apple.AOSNotification.FindMyMac.remove</key>
58 <dict>
59 <key>allow-root</key>
60 <true/>
61 <key>authenticate-user</key>
62 <true/>
63 <key>class</key>
64 <string>rule</string>
65 <key>k-of-n</key>
66 <integer>1</integer>
67 <key>rule</key>
68 <array>
69 <string>is-root</string>
70 <string>is-admin</string>
71 <string>default</string>
72 </array>
73 <key>shared</key>
74 <false/>
75 <key>version</key>
76 <integer>1</integer>
77 </dict>
78 <key>com.apple.DiskManagement.</key>
79 <dict>
80 <key>class</key>
81 <string>rule</string>
82 <key>comment</key>
83 <string>Used by diskmanagementd to allow access to its privileged functions</string>
84 <key>k-of-n</key>
85 <integer>1</integer>
86 <key>rule</key>
87 <array>
88 <string>is-root</string>
89 <string>is-admin</string>
90 <string>on-console</string>
91 <string>default</string>
92 </array>
93 </dict>
94 <key>com.apple.DiskManagement.internal.</key>
95 <dict>
96 <key>class</key>
97 <string>rule</string>
98 <key>comment</key>
99 <string>Used by diskmanagementd to allow access to its privileged functions</string>
100 <key>k-of-n</key>
101 <integer>1</integer>
102 <key>rule</key>
103 <array>
104 <string>is-root</string>
105 <string>is-admin</string>
106 <string>default</string>
107 </array>
108 </dict>
109 <key>com.apple.DiskManagement.reserveKEK</key>
110 <dict>
111 <key>allow-root</key>
112 <true/>
113 <key>class</key>
114 <string>user</string>
115 <key>comment</key>
116 <string>Used by diskmanagementd to allow use of the reserve KEK.</string>
117 <key>group</key>
118 <string>admin</string>
119 <key>shared</key>
120 <false/>
121 </dict>
122 <key>com.apple.KerberosAgent</key>
123 <dict>
124 <key>class</key>
125 <string>evaluate-mechanisms</string>
126 <key>comment</key>
127 <string>Used to acquire Kerberos credentials.</string>
128 <key>mechanisms</key>
129 <array>
130 <string>KerberosAgent:kerberos-dialog</string>
131 <string>KerberosAgent:kerberos-authenticate,privileged</string>
132 </array>
133 </dict>
134 <key>com.apple.OpenScripting.additions.send</key>
135 <dict>
136 <key>allow-root</key>
137 <true/>
138 <key>class</key>
139 <string>user</string>
140 <key>comment</key>
141 <string>Used to send restricted scripting addition commands to processes that require authorization to handle the events.</string>
142 <key>group</key>
143 <string>admin</string>
144 </dict>
145 <key>com.apple.ReportPanic.fixRight</key>
146 <dict>
147 <key>allow-root</key>
148 <true/>
149 <key>authenticate-user</key>
150 <true/>
151 <key>class</key>
152 <string>user</string>
153 <key>group</key>
154 <string>admin</string>
155 <key>require-apple-signed</key>
156 <true/>
157 <key>shared</key>
158 <false/>
159 <key>timeout</key>
160 <integer>10</integer>
161 </dict>
162 <key>com.apple.Safari.parental-controls</key>
163 <dict>
164 <key>allow-root</key>
165 <true/>
166 <key>class</key>
167 <string>rule</string>
168 <key>comment</key>
169 <string>Checked when changing parental controls for Safari.</string>
170 <key>k-of-n</key>
171 <integer>1</integer>
172 <key>rule</key>
173 <array>
174 <string>is-admin</string>
175 <string>authenticate-admin</string>
176 </array>
177 <key>shared</key>
178 <false/>
179 <key>timeout</key>
180 <integer>60</integer>
181 </dict>
182 <key>com.apple.Safari.show-credit-card-numbers</key>
183 <dict>
184 <key>class</key>
185 <string>user</string>
186 <key>comment</key>
187 <string>This right is used by Safari to show credit card numbers.</string>
188 <key>session-owner</key>
189 <true/>
190 <key>shared</key>
191 <false/>
192 <key>timeout</key>
193 <integer>10</integer>
194 </dict>
195 <key>com.apple.Safari.show-passwords</key>
196 <dict>
197 <key>class</key>
198 <string>user</string>
199 <key>comment</key>
200 <string>This right is used by Safari to show passwords.</string>
201 <key>session-owner</key>
202 <true/>
203 <key>shared</key>
204 <false/>
205 <key>timeout</key>
206 <integer>10</integer>
207 </dict>
208 <key>com.apple.Safari.install-ephemeral-extensions</key>
209 <dict>
210 <key>class</key>
211 <string>user</string>
212 <key>comment</key>
213 <string>This is the right used by Safari to install an ephemeral extension without a developer certificate present.</string>
214 <key>session-owner</key>
215 <true/>
216 <key>shared</key>
217 <false/>
218 <key>timeout</key>
219 <integer>0</integer>
220 </dict>
221 <key>com.apple.Safari.allow-apple-events-to-run-javascript</key>
222 <dict>
223 <key>class</key>
224 <string>user</string>
225 <key>comment</key>
226 <string>This right is used by Safari to allow Apple Events to run JavaScript on web pages.</string>
227 <key>session-owner</key>
228 <true/>
229 <key>shared</key>
230 <false/>
231 </dict>
232 <key>com.apple.Safari.allow-unsigned-app-extensions</key>
233 <dict>
234 <key>class</key>
235 <string>user</string>
236 <key>comment</key>
237 <string>This right is used by Safari to allow unsigned extensions in the Develop Menu.</string>
238 <key>session-owner</key>
239 <true/>
240 <key>shared</key>
241 <false/>
242 </dict>
243 <key>com.apple.Safari.allow-javascript-in-smart-search-field</key>
244 <dict>
245 <key>class</key>
246 <string>user</string>
247 <key>comment</key>
248 <string>This right is used by Safari to allow JavaScript to be used in the Smart Search Field.</string>
249 <key>session-owner</key>
250 <true/>
251 <key>shared</key>
252 <false/>
253 </dict>
254 <key>com.apple.ServiceManagement.blesshelper</key>
255 <dict>
256 <key>allow-root</key>
257 <true/>
258 <key>class</key>
259 <string>user</string>
260 <key>comment</key>
261 <string>Used by the ServiceManagement framework to add a privileged helper tool to the system launchd.</string>
262 <key>group</key>
263 <string>admin</string>
264 <key>timeout</key>
265 <integer>30</integer>
266 <key>version</key>
267 <integer>1</integer>
268 </dict>
269 <key>com.apple.ServiceManagement.daemons.modify</key>
270 <dict>
271 <key>class</key>
272 <string>rule</string>
273 <key>comment</key>
274 <string>Used by the ServiceManagement framework to make changes to the system launchd's set of daemons.</string>
275 <key>k-of-n</key>
276 <integer>1</integer>
277 <key>rule</key>
278 <array>
279 <string>is-root</string>
280 <string>entitled-admin-or-authenticate-admin-nonshared</string>
281 </array>
282 <key>version</key>
283 <integer>1</integer>
284 </dict>
285 <key>com.apple.SoftwareUpdate.modify-settings</key>
286 <dict>
287 <key>class</key>
288 <string>rule</string>
289 <key>comment</key>
290 <string>Checked by the Admin framework when making changes to the Software Update preference pane.</string>
291 <key>rule</key>
292 <string>root-or-entitled-admin-or-app-specific-admin</string>
293 </dict>
294 <key>com.apple.SoftwareUpdate.scan</key>
295 <dict>
296 <key>class</key>
297 <string>rule</string>
298 <key>comment</key>
299 <string>Checked when user is updating software.</string>
300 <key>rule</key>
301 <string>root-or-entitled-admin-or-authenticate-admin</string>
302 </dict>
303 <key>com.apple.XType.fontmover.install</key>
304 <dict>
305 <key>allow-root</key>
306 <true/>
307 <key>class</key>
308 <string>user</string>
309 <key>group</key>
310 <string>admin</string>
311 <key>shared</key>
312 <true/>
313 <key>timeout</key>
314 <integer>300</integer>
315 </dict>
316 <key>com.apple.XType.fontmover.remove</key>
317 <dict>
318 <key>allow-root</key>
319 <true/>
320 <key>class</key>
321 <string>user</string>
322 <key>group</key>
323 <string>admin</string>
324 <key>shared</key>
325 <true/>
326 <key>timeout</key>
327 <integer>300</integer>
328 </dict>
329 <key>com.apple.XType.fontmover.restore</key>
330 <dict>
331 <key>class</key>
332 <string>rule</string>
333 <key>rule</key>
334 <string>root-or-entitled-admin-or-authenticate-admin</string>
335 </dict>
336 <key>com.apple.activitymonitor.kill</key>
337 <dict>
338 <key>class</key>
339 <string>rule</string>
340 <key>comment</key>
341 <string>Used by Activity Monitor to authorize killing processes not owned by the user.</string>
342 <key>rule</key>
343 <string>entitled-admin-or-authenticate-admin</string>
344 <key>shared</key>
345 <false/>
346 <key>timeout</key>
347 <integer>0</integer>
348 </dict>
349 <key>com.apple.appserver.privilege.admin</key>
350 <dict>
351 <key>class</key>
352 <string>rule</string>
353 <key>comment</key>
354 <string>For administrative access to the Application Server management tool.</string>
355 <key>rule</key>
356 <string>appserver-admin</string>
357 </dict>
358 <key>com.apple.appserver.privilege.user</key>
359 <dict>
360 <key>class</key>
361 <string>rule</string>
362 <key>comment</key>
363 <string>For user access to the Application Server management tool.</string>
364 <key>k-of-n</key>
365 <integer>1</integer>
366 <key>rule</key>
367 <array>
368 <string>appserver-admin</string>
369 <string>appserver-user</string>
370 </array>
371 </dict>
372 <key>com.apple.builtin.confirm-access</key>
373 <dict>
374 <key>class</key>
375 <string>evaluate-mechanisms</string>
376 <key>mechanisms</key>
377 <array>
378 <string>builtin:confirm-access</string>
379 </array>
380 <key>tries</key>
381 <integer>1</integer>
382 </dict>
383 <key>com.apple.builtin.confirm-access-password</key>
384 <dict>
385 <key>class</key>
386 <string>evaluate-mechanisms</string>
387 <key>mechanisms</key>
388 <array>
389 <string>builtin:confirm-access-password</string>
390 </array>
391 </dict>
392 <key>com.apple.builtin.generic-new-passphrase</key>
393 <dict>
394 <key>class</key>
395 <string>evaluate-mechanisms</string>
396 <key>mechanisms</key>
397 <array>
398 <string>builtin:generic-new-passphrase</string>
399 </array>
400 </dict>
401 <key>com.apple.builtin.generic-unlock</key>
402 <dict>
403 <key>class</key>
404 <string>evaluate-mechanisms</string>
405 <key>mechanisms</key>
406 <array>
407 <string>builtin:generic-unlock</string>
408 </array>
409 </dict>
410 <key>com.apple.builtin.sc-kc-new-passphrase</key>
411 <dict>
412 <key>class</key>
413 <string>evaluate-mechanisms</string>
414 <key>mechanisms</key>
415 <array>
416 <string>builtin:generic-new-passphrase</string>
417 </array>
418 </dict>
419 <key>com.apple.container-repair</key>
420 <dict>
421 <key>class</key>
422 <string>user</string>
423 <key>group</key>
424 <string>admin</string>
425 <key>shared</key>
426 <false/>
427 <key>timeout</key>
428 <integer>30</integer>
429 </dict>
430 <key>com.apple.dashboard.advisory.allow</key>
431 <dict>
432 <key>class</key>
433 <string>user</string>
434 <key>group</key>
435 <string>admin</string>
436 <key>shared</key>
437 <false/>
438 <key>timeout</key>
439 <integer>300</integer>
440 </dict>
441 <key>com.apple.desktopservices</key>
442 <dict>
443 <key>class</key>
444 <string>user</string>
445 <key>comment</key>
446 <string>For privileged file operations from within the Finder.</string>
447 <key>group</key>
448 <string>admin</string>
449 <key>shared</key>
450 <false/>
451 <key>timeout</key>
452 <integer>0</integer>
453 </dict>
454 <key>com.apple.desktopservices.scripted</key>
455 <dict>
456 <key>class</key>
457 <string>user</string>
458 <key>comment</key>
459 <string>For scripting-initiated privileged file operations from within the Finder.</string>
460 <key>group</key>
461 <string>admin</string>
462 <key>shared</key>
463 <false/>
464 <key>timeout</key>
465 <integer>0</integer>
466 </dict>
467 <key>com.apple.docset.install</key>
468 <dict>
469 <key>class</key>
470 <string>user</string>
471 <key>comment</key>
472 <string>Used by Xcode to restrict access to a daemon it uses to install and update documentation sets.</string>
473 <key>group</key>
474 <string>admin</string>
475 <key>shared</key>
476 <false/>
477 </dict>
478 <key>com.apple.iBooksX.ParentalControl</key>
479 <dict>
480 <key>class</key>
481 <string>user</string>
482 <key>comment</key>
483 <string>Checked when making changes to the Parental Controls for iBooks.</string>
484 <key>group</key>
485 <string>admin</string>
486 <key>shared</key>
487 <false/>
488 </dict>
489 <key>com.apple.icloud.passwordreset</key>
490 <dict>
491 <key>class</key>
492 <string>user</string>
493 <key>comment</key>
494 <string>Authenticate as the session owner to reset iCloud password</string>
495 <key>session-owner</key>
496 <true/>
497 <key>timeout</key>
498 <integer>0</integer>
499 <key>password-only</key>
500 <true/>
501 <key>version</key>
502 <integer>1</integer>
503 </dict>
504 <key>com.apple.library-repair</key>
505 <dict>
506 <key>class</key>
507 <string>user</string>
508 <key>group</key>
509 <string>admin</string>
510 </dict>
511 <key>com.apple.lldb.LaunchUsingXPC</key>
512 <dict>
513 <key>class</key>
514 <string>user</string>
515 <key>group</key>
516 <string>admin</string>
517 </dict>
518 <key>com.apple.opendirectoryd.linkidentity</key>
519 <dict>
520 <key>class</key>
521 <string>rule</string>
522 <key>rule</key>
523 <string>entitled-session-owner-or-authenticate-session-owner</string>
524 </dict>
525 <key>com.apple.ctk.pair</key>
526 <dict>
527 <key>class</key>
528 <string>rule</string>
529 <key>rule</key>
530 <string>kcunlock</string>
531 </dict>
532 <key>com.apple.ctkbind.admin</key>
533 <dict>
534 <key>class</key>
535 <string>user</string>
536 <key>group</key>
537 <string>admin</string>
538 <key>shared</key>
539 <false/>
540 </dict>
541 <key>com.apple.pf.rule</key>
542 <dict>
543 <key>authenticate-user</key>
544 <true/>
545 <key>class</key>
546 <string>user</string>
547 <key>group</key>
548 <string>admin</string>
549 <key>timeout</key>
550 <integer>0</integer>
551 </dict>
552 <key>com.apple.security.assessment.update</key>
553 <dict>
554 <key>class</key>
555 <string>rule</string>
556 <key>rule</key>
557 <string>root-or-entitled-admin-or-authenticate-admin</string>
558 </dict>
559 <key>com.apple.server.admin.streaming</key>
560 <dict>
561 <key>allow-root</key>
562 <true/>
563 <key>class</key>
564 <string>rule</string>
565 <key>comment</key>
566 <string>For making administrative requests to the QuickTime Streaming Server.</string>
567 <key>k-of-n</key>
568 <integer>1</integer>
569 <key>rule</key>
570 <array>
571 <string>is-admin</string>
572 <string>authenticate-admin</string>
573 </array>
574 <key>shared</key>
575 <false/>
576 <key>timeout</key>
577 <integer>0</integer>
578 </dict>
579 <key>com.apple.trust-settings.admin</key>
580 <dict>
581 <key>comment</key>
582 <string>For modifying Trust Settings in the Admin domain. Requires entitlement or admin authentication.</string>
583 <key>class</key>
584 <string>rule</string>
585 <key>k-of-n</key>
586 <integer>1</integer>
587 <key>rule</key>
588 <array>
589 <string>entitled</string>
590 <string>authenticate-admin</string>
591 </array>
592 </dict>
593 <key>com.apple.trust-settings.user</key>
594 <dict>
595 <key>comment</key>
596 <string>For modifying per-user Trust Settings.</string>
597 <key>rule</key>
598 <string>entitled-session-owner-or-authenticate-session-owner</string>
599 </dict>
600 <key>com.apple.uninstalld.uninstall</key>
601 <dict>
602 <key>authenticate-user</key>
603 <false/>
604 <key>class</key>
605 <string>user</string>
606 <key>entitled</key>
607 <true/>
608 <key>version</key>
609 <integer>1</integer>
610 </dict>
611 <key>config.add.</key>
612 <dict>
613 <key>class</key>
614 <string>allow</string>
615 <key>comment</key>
616 <string>Wildcard right for adding rights. Anyone is allowed to add any (non-wildcard) rights.</string>
617 </dict>
618 <key>config.config.</key>
619 <dict>
620 <key>class</key>
621 <string>deny</string>
622 <key>comment</key>
623 <string>Wildcard right for any change to meta-rights for db modification. Not allowed programmatically (just edit this file).</string>
624 </dict>
625 <key>config.modify.</key>
626 <dict>
627 <key>class</key>
628 <string>rule</string>
629 <key>comment</key>
630 <string>Wildcard right for modifying rights. Admins are allowed to modify any (non-wildcard) rights. Root does not require authentication.</string>
631 <key>k-of-n</key>
632 <integer>1</integer>
633 <key>rule</key>
634 <array>
635 <string>is-root</string>
636 <string>authenticate-admin</string>
637 </array>
638 </dict>
639 <key>config.remove.</key>
640 <dict>
641 <key>class</key>
642 <string>rule</string>
643 <key>comment</key>
644 <string>Wildcard right for deleting rights. Admins are allowed to delete any (non-wildcard) rights. Root does not require authentication.</string>
645 <key>k-of-n</key>
646 <integer>1</integer>
647 <key>rule</key>
648 <array>
649 <string>is-root</string>
650 <string>authenticate-admin</string>
651 </array>
652 </dict>
653 <key>config.remove.system.</key>
654 <dict>
655 <key>class</key>
656 <string>deny</string>
657 <key>comment</key>
658 <string>Wildcard right for deleting system rights.</string>
659 </dict>
660 <key>sys.openfile.</key>
661 <dict>
662 <key>class</key>
663 <string>user</string>
664 <key>comment</key>
665 <string>See authopen(1) for information on the use of this right.</string>
666 <key>group</key>
667 <string>admin</string>
668 <key>shared</key>
669 <false/>
670 <key>timeout</key>
671 <integer>300</integer>
672 </dict>
673 <key>system.</key>
674 <dict>
675 <key>rule</key>
676 <string>default</string>
677 </dict>
678 <key>system.burn</key>
679 <dict>
680 <key>class</key>
681 <string>allow</string>
682 <key>comment</key>
683 <string>For burning media.</string>
684 </dict>
685 <key>com.apple.installassistant.requestpassword</key>
686 <dict>
687 <key>authenticate-user</key>
688 <true/>
689 <key>class</key>
690 <string>user</string>
691 <key>comment</key>
692 <string>Authenticate as an administrator, password only.</string>
693 <key>group</key>
694 <string>admin</string>
695 <key>password-only</key>
696 <true/>
697 <key>shared</key>
698 <false/>
699 <key>timeout</key>
700 <integer>0</integer>
701 </dict>
702 <key>system.csfde.requestpassword.weak</key>
703 <dict>
704 <key>class</key>
705 <string>rule</string>
706 <key>comment</key>
707 <string>Used by CoreStorage Full Disk Encryption to request the user's password, allowing alternative authentication methods.</string>
708 <key>rule</key>
709 <array>
710 <string>authenticate-admin-or-staff-extract-weak</string>
711 </array>
712 </dict>
713 <key>system.csfde.requestpassword</key>
714 <dict>
715 <key>class</key>
716 <string>rule</string>
717 <key>comment</key>
718 <string>Used by CoreStorage Full Disk Encryption to request the user's password.</string>
719 <key>rule</key>
720 <array>
721 <string>authenticate-admin-or-staff-extract</string>
722 </array>
723 <key>version</key>
724 <integer>1</integer>
725 </dict>
726 <key>system.device.dvd.setregion.initial</key>
727 <dict>
728 <key>class</key>
729 <string>user</string>
730 <key>comment</key>
731 <string>Used by the DVD player to set the region code the first time. Note that changing the region code after it has been set requires a different right (system.device.dvd.setregion.change).</string>
732 <key>group</key>
733 <string>admin</string>
734 <key>shared</key>
735 <true/>
736 </dict>
737 <key>system.disk.unlock</key>
738 <dict>
739 <key>class</key>
740 <string>evaluate-mechanisms</string>
741 <key>comment</key>
742 <string>Do not modify.</string>
743 <key>mechanisms</key>
744 <array>
745 <string>DiskUnlock:prompt</string>
746 <string>DiskUnlock:unlock,privileged</string>
747 </array>
748 </dict>
749 <key>system.global-login-items.</key>
750 <dict>
751 <key>class</key>
752 <string>rule</string>
753 <key>k-of-n</key>
754 <integer>1</integer>
755 <key>rule</key>
756 <array>
757 <string>default</string>
758 </array>
759 <key>version</key>
760 <integer>1</integer>
761 </dict>
762 <key>system.hdd.smart</key>
763 <dict>
764 <key>class</key>
765 <string>allow</string>
766 <key>comment</key>
767 <string>For modifying SMART settings.</string>
768 </dict>
769 <key>system.identity.write.</key>
770 <dict>
771 <key>class</key>
772 <string>rule</string>
773 <key>comment</key>
774 <string>For creating, changing or deleting local user accounts and groups.</string>
775 <key>k-of-n</key>
776 <integer>1</integer>
777 <key>rule</key>
778 <array>
779 <string>is-admin</string>
780 <string>authenticate-admin</string>
781 </array>
782 </dict>
783 <key>system.identity.write.credential</key>
784 <dict>
785 <key>class</key>
786 <string>rule</string>
787 <key>comment</key>
788 <string>Checked when changing authentication credentials (password or certificate) for a local user account.</string>
789 <key>rule</key>
790 <string>default</string>
791 </dict>
792 <key>system.identity.write.self</key>
793 <dict>
794 <key>authenticate-user</key>
795 <false/>
796 <key>class</key>
797 <string>user</string>
798 <key>comment</key>
799 <string>Checked when changing authentication credentials (password or certificate) for the current user's account.</string>
800 <key>session-owner</key>
801 <true/>
802 </dict>
803 <key>system.install.app-store-software</key>
804 <dict>
805 <key>class</key>
806 <string>rule</string>
807 <key>comment</key>
808 <string>Checked when user is installing software from the App Store.</string>
809 <key>rule</key>
810 <string>entitled-appstore-or-entitled-authenticate-appstore</string>
811 </dict>
812 <key>system.install.app-store-software.standard-user</key>
813 <dict>
814 <key>authenticate-user</key>
815 <true/>
816 <key>class</key>
817 <string>user</string>
818 <key>comment</key>
819 <string>Checked when user is installing new software.</string>
820 <key>entitled</key>
821 <true/>
822 <key>group</key>
823 <string>admin</string>
824 <key>timeout</key>
825 <integer>10</integer>
826 </dict>
827 <key>system.install.software.mdm-provided</key>
828 <dict>
829 <key>allow-root</key>
830 <true/>
831 <key>version</key>
832 <integer>1</integer>
833 <key>class</key>
834 <string>rule</string>
835 <key>rule</key>
836 <string>entitled</string>
837 </dict>
838 <key>system.install.apple-config-data</key>
839 <dict>
840 <key>allow-root</key>
841 <true/>
842 <key>class</key>
843 <string>rule</string>
844 <key>rule</key>
845 <string>entitled</string>
846 </dict>
847 <key>system.install.apple-software</key>
848 <dict>
849 <key>class</key>
850 <string>rule</string>
851 <key>comment</key>
852 <string>Checked when user is installing Apple software.</string>
853 <key>rule</key>
854 <string>root-or-entitled-admin-or-authenticate-admin</string>
855 </dict>
856 <key>system.install.apple-software.standard-user</key>
857 <dict>
858 <key>authenticate-user</key>
859 <true/>
860 <key>class</key>
861 <string>user</string>
862 <key>comment</key>
863 <string>Checked when user is installing new software.</string>
864 <key>entitled</key>
865 <true/>
866 <key>group</key>
867 <string>admin</string>
868 <key>timeout</key>
869 <integer>10</integer>
870 </dict>
871 <key>system.install.software</key>
872 <dict>
873 <key>allow-root</key>
874 <true/>
875 <key>class</key>
876 <string>user</string>
877 <key>comment</key>
878 <string>Checked when user is installing new software.</string>
879 <key>group</key>
880 <string>admin</string>
881 <key>shared</key>
882 <false/>
883 <key>timeout</key>
884 <integer>900</integer>
885 <key>version</key>
886 <integer>2</integer>
887 </dict>
888 <key>system.install.software.iap</key>
889 <dict>
890 <key>allow-root</key>
891 <true/>
892 <key>authenticate-user</key>
893 <false/>
894 <key>class</key>
895 <string>user</string>
896 <key>entitled</key>
897 <true/>
898 </dict>
899 <key>system.keychain.create.loginkc</key>
900 <dict>
901 <key>allow-root</key>
902 <false/>
903 <key>class</key>
904 <string>evaluate-mechanisms</string>
905 <key>comment</key>
906 <string>Used by the Security framework when you add an item to an unconfigured default keychain.</string>
907 <key>mechanisms</key>
908 <array>
909 <string>loginKC:queryCreate</string>
910 <string>loginKC:showPasswordUI</string>
911 </array>
912 <key>version</key>
913 <integer>1</integer>
914 <key>session-owner</key>
915 <true/>
916 <key>shared</key>
917 <false/>
918 </dict>
919 <key>system.keychain.modify</key>
920 <dict>
921 <key>class</key>
922 <string>user</string>
923 <key>comment</key>
924 <string>Used by Keychain Access when editing a system keychain.</string>
925 <key>group</key>
926 <string>admin</string>
927 <key>shared</key>
928 <true/>
929 <key>timeout</key>
930 <integer>30</integer>
931 </dict>
932 <key>system.login.console</key>
933 <dict>
934 <key>class</key>
935 <string>evaluate-mechanisms</string>
936 <key>comment</key>
937 <string>Login mechanism based rule. Not for general use, yet.</string>
938 <key>mechanisms</key>
939 <array>
940 <string>builtin:policy-banner</string>
941 <string>builtin:prelogin</string>
942 <string>loginwindow:login</string>
943 <string>builtin:login-begin</string>
944 <string>builtin:reset-password,privileged</string>
945 <string>loginwindow:FDESupport,privileged</string>
946 <string>builtin:forward-login,privileged</string>
947 <string>builtin:auto-login,privileged</string>
948 <string>builtin:authenticate,privileged</string>
949 <string>PKINITMechanism:auth,privileged</string>
950 <string>builtin:login-success</string>
951 <string>loginwindow:success</string>
952 <string>HomeDirMechanism:login,privileged</string>
953 <string>HomeDirMechanism:status</string>
954 <string>MCXMechanism:login</string>
955 <string>CryptoTokenKit:login</string>
956 <string>loginwindow:done</string>
957 </array>
958 <key>version</key>
959 <integer>8</integer>
960 </dict>
961 <key>system.login.filevault</key>
962 <dict>
963 <key>class</key>
964 <string>evaluate-mechanisms</string>
965 <key>comment</key>
966 <string>Login mechanism based rule for Filevault.</string>
967 <key>mechanisms</key>
968 <array>
969 <string>builtin:policy-banner</string>
970 <string>loginwindow:login</string>
971 <string>builtin:login-begin</string>
972 <string>builtin:authenticate,privileged</string>
973 <string>builtin:login-success</string>
974 <string>loginwindow:success</string>
975 <string>loginwindow:done</string>
976 </array>
977 </dict>
978 <key>system.login.fus</key>
979 <dict>
980 <key>class</key>
981 <string>evaluate-mechanisms</string>
982 <key>comment</key>
983 <string>Login mechanism based rule. Not for general use, yet.</string>
984 <key>mechanisms</key>
985 <array>
986 <string>builtin:smartcard-sniffer,privileged</string>
987 <string>loginwindow:login</string>
988 <string>builtin:reset-password,privileged</string>
989 <string>builtin:auto-login,privileged</string>
990 <string>builtin:authenticate-nocred,privileged</string>
991 <string>loginwindow:success</string>
992 <string>loginwindow:done</string>
993 </array>
994 <key>version</key>
995 <integer>1</integer>
996 </dict>
997 <key>system.login.done</key>
998 <dict>
999 <key>class</key>
1000 <string>evaluate-mechanisms</string>
1001 <key>mechanisms</key>
1002 <array/>
1003 </dict>
1004 <key>system.login.screensaver</key>
1005 <dict>
1006 <key>class</key>
1007 <string>rule</string>
1008 <key>comment</key>
1009 <string>The owner or any administrator can unlock the screensaver, set rule to "authenticate-session-owner-or-admin" to enable SecurityAgent.</string>
1010 <key>rule</key>
1011 <string>use-login-window-ui</string>
1012 <key>version</key>
1013 <integer>1</integer>
1014 </dict>
1015 <key>system.login.tty</key>
1016 <dict>
1017 <key>class</key>
1018 <string>rule</string>
1019 <key>rule</key>
1020 <array>
1021 <string>default</string>
1022 </array>
1023 <key>version</key>
1024 <integer>1</integer>
1025 </dict>
1026 <key>system.preferences</key>
1027 <dict>
1028 <key>allow-root</key>
1029 <true/>
1030 <key>class</key>
1031 <string>user</string>
1032 <key>comment</key>
1033 <string>Checked by the Admin framework when making changes to certain System Preferences.</string>
1034 <key>group</key>
1035 <string>admin</string>
1036 <key>shared</key>
1037 <true/>
1038 </dict>
1039 <key>system.preferences.accessibility</key>
1040 <dict>
1041 <key>class</key>
1042 <string>user</string>
1043 <key>comment</key>
1044 <string>Checked when making changes to the Accessibility Preferences.</string>
1045 <key>group</key>
1046 <string>admin</string>
1047 <key>shared</key>
1048 <false/>
1049 <key>timeout</key>
1050 <integer>0</integer>
1051 </dict>
1052 <key>system.preferences.accounts</key>
1053 <dict>
1054 <key>allow-root</key>
1055 <true/>
1056 <key>class</key>
1057 <string>user</string>
1058 <key>comment</key>
1059 <string>Checked by the Admin framework when making changes to the Users &amp; Groups preference pane.</string>
1060 <key>group</key>
1061 <string>admin</string>
1062 <key>shared</key>
1063 <false/>
1064 </dict>
1065 <key>system.preferences.datetime</key>
1066 <dict>
1067 <key>allow-root</key>
1068 <true/>
1069 <key>class</key>
1070 <string>user</string>
1071 <key>comment</key>
1072 <string>Checked by the Admin framework when making changes to the Date &amp; Time preference pane.</string>
1073 <key>group</key>
1074 <string>admin</string>
1075 <key>shared</key>
1076 <false/>
1077 <key>version</key>
1078 <integer>1</integer>
1079 </dict>
1080 <key>system.preferences.energysaver</key>
1081 <dict>
1082 <key>allow-root</key>
1083 <true/>
1084 <key>class</key>
1085 <string>user</string>
1086 <key>comment</key>
1087 <string>Checked by the Admin framework when making changes to the Energy Saver preference pane.</string>
1088 <key>group</key>
1089 <string>admin</string>
1090 <key>shared</key>
1091 <true/>
1092 </dict>
1093 <key>system.preferences.location</key>
1094 <dict>
1095 <key>class</key>
1096 <string>rule</string>
1097 <key>comment</key>
1098 <string>For changing the network location from the Apple menu.</string>
1099 <key>k-of-n</key>
1100 <integer>1</integer>
1101 <key>rule</key>
1102 <array>
1103 <string>on-console</string>
1104 <string>is-admin</string>
1105 <string>is-root</string>
1106 </array>
1107 </dict>
1108 <key>system.preferences.network</key>
1109 <dict>
1110 <key>allow-root</key>
1111 <true/>
1112 <key>class</key>
1113 <string>user</string>
1114 <key>comment</key>
1115 <string>Checked by the Admin framework when making changes to the Network preference pane.</string>
1116 <key>group</key>
1117 <string>admin</string>
1118 <key>shared</key>
1119 <true/>
1120 </dict>
1121 <key>system.preferences.nvram</key>
1122 <dict>
1123 <key>class</key>
1124 <string>rule</string>
1125 <key>k-of-n</key>
1126 <integer>1</integer>
1127 <key>rule</key>
1128 <array>
1129 <string>entitled</string>
1130 <string>admin</string>
1131 </array>
1132 </dict>
1133 <key>system.preferences.parental-controls</key>
1134 <dict>
1135 <key>class</key>
1136 <string>user</string>
1137 <key>comment</key>
1138 <string>Checked when making changes to the Parental Controls preference pane.</string>
1139 <key>group</key>
1140 <string>admin</string>
1141 <key>shared</key>
1142 <false/>
1143 </dict>
1144 <key>system.preferences.printing</key>
1145 <dict>
1146 <key>allow-root</key>
1147 <true/>
1148 <key>class</key>
1149 <string>user</string>
1150 <key>comment</key>
1151 <string>Checked by the Admin framework when making changes to the Printing preference pane.</string>
1152 <key>group</key>
1153 <string>admin</string>
1154 <key>shared</key>
1155 <true/>
1156 </dict>
1157 <key>system.preferences.security</key>
1158 <dict>
1159 <key>allow-root</key>
1160 <true/>
1161 <key>class</key>
1162 <string>user</string>
1163 <key>comment</key>
1164 <string>Checked by the Admin framework when making changes to the Security preference pane.</string>
1165 <key>group</key>
1166 <string>admin</string>
1167 <key>shared</key>
1168 <false/>
1169 </dict>
1170 <key>system.preferences.security.remotepair</key>
1171 <dict>
1172 <key>class</key>
1173 <string>user</string>
1174 <key>comment</key>
1175 <string>Used by Bezel Services to gate IR remote pairing.</string>
1176 <key>entitled-group</key>
1177 <true/>
1178 <key>group</key>
1179 <string>admin</string>
1180 <key>shared</key>
1181 <true/>
1182 <key>timeout</key>
1183 <integer>30</integer>
1184 <key>version</key>
1185 <integer>1</integer>
1186 </dict>
1187 <key>system.preferences.sharing</key>
1188 <dict>
1189 <key>allow-root</key>
1190 <true/>
1191 <key>class</key>
1192 <string>user</string>
1193 <key>comment</key>
1194 <string>Checked by the Admin framework when making changes to the Sharing preference pane.</string>
1195 <key>group</key>
1196 <string>admin</string>
1197 <key>shared</key>
1198 <true/>
1199 </dict>
1200 <key>system.preferences.softwareupdate</key>
1201 <dict>
1202 <key>allow-root</key>
1203 <true/>
1204 <key>class</key>
1205 <string>user</string>
1206 <key>comment</key>
1207 <string>Checked by the Admin framework when making changes to the Software Update preference pane.</string>
1208 <key>group</key>
1209 <string>admin</string>
1210 <key>shared</key>
1211 <true/>
1212 </dict>
1213 <key>system.preferences.startupdisk</key>
1214 <dict>
1215 <key>allow-root</key>
1216 <true/>
1217 <key>class</key>
1218 <string>user</string>
1219 <key>comment</key>
1220 <string>Checked by the Admin framework when making changes to the Startup Disk preference pane.</string>
1221 <key>group</key>
1222 <string>admin</string>
1223 <key>shared</key>
1224 <false/>
1225 <key>version</key>
1226 <integer>1</integer>
1227 </dict>
1228 <key>system.preferences.timemachine</key>
1229 <dict>
1230 <key>allow-root</key>
1231 <true/>
1232 <key>class</key>
1233 <string>user</string>
1234 <key>comment</key>
1235 <string>Checked by the Admin framework when making changes to the Time Machine preference pane.</string>
1236 <key>group</key>
1237 <string>admin</string>
1238 <key>shared</key>
1239 <true/>
1240 </dict>
1241 <key>system.preferences.version-cue</key>
1242 <dict>
1243 <key>class</key>
1244 <string>rule</string>
1245 <key>comment</key>
1246 <string>For gating modifications to Adobe Version Cue preferences.</string>
1247 <key>rule</key>
1248 <string>authenticate-admin</string>
1249 </dict>
1250 <key>system.print.admin</key>
1251 <dict>
1252 <key>class</key>
1253 <string>rule</string>
1254 <key>rule</key>
1255 <string>root-or-lpadmin</string>
1256 </dict>
1257 <key>system.print.operator</key>
1258 <dict>
1259 <key>allow-root</key>
1260 <true/>
1261 <key>class</key>
1262 <string>user</string>
1263 <key>group</key>
1264 <string>_lpoperator</string>
1265 <key>shared</key>
1266 <true/>
1267 </dict>
1268 <key>system.printingmanager</key>
1269 <dict>
1270 <key>class</key>
1271 <string>rule</string>
1272 <key>comment</key>
1273 <string>For printing to locked printers.</string>
1274 <key>k-of-n</key>
1275 <integer>1</integer>
1276 <key>rule</key>
1277 <array>
1278 <string>is-admin</string>
1279 <string>authenticate-admin</string>
1280 </array>
1281 </dict>
1282 <key>system.privilege.admin</key>
1283 <dict>
1284 <key>allow-root</key>
1285 <true/>
1286 <key>class</key>
1287 <string>user</string>
1288 <key>comment</key>
1289 <string>Used by AuthorizationExecuteWithPrivileges(...).
1290 AuthorizationExecuteWithPrivileges() is used by programs requesting
1291 to run a tool as root (e.g., some installers).</string>
1292 <key>group</key>
1293 <string>admin</string>
1294 <key>shared</key>
1295 <false/>
1296 <key>timeout</key>
1297 <integer>300</integer>
1298 </dict>
1299 <key>system.privilege.taskport</key>
1300 <dict>
1301 <key>allow-root</key>
1302 <false/>
1303 <key>class</key>
1304 <string>user</string>
1305 <key>comment</key>
1306 <string>Used by task_for_pid(...).
1307 Task_for_pid is called by programs requesting full control over another program
1308 for things like debugging or performance analysis. This authorization only applies
1309 if the requesting and target programs are run by the same user; it will never
1310 authorize access to the program of another user. WARNING: administrators are advised not to modify this right.</string>
1311 <key>group</key>
1312 <string>_developer</string>
1313 <key>shared</key>
1314 <true/>
1315 <key>timeout</key>
1316 <integer>36000</integer>
1317 </dict>
1318 <key>system.privilege.taskport.debug</key>
1319 <dict>
1320 <key>allow-root</key>
1321 <false/>
1322 <key>class</key>
1323 <string>user</string>
1324 <key>comment</key>
1325 <string>For use by Apple. WARNING: administrators are advised
1326 not to modify this right.</string>
1327 <key>group</key>
1328 <string>_developer</string>
1329 <key>shared</key>
1330 <true/>
1331 <key>timeout</key>
1332 <integer>36000</integer>
1333 </dict>
1334 <key>system.privilege.taskport.safe</key>
1335 <dict>
1336 <key>class</key>
1337 <string>allow</string>
1338 <key>comment</key>
1339 <string>For use by Apple.</string>
1340 </dict>
1341 <key>system.restart</key>
1342 <dict>
1343 <key>class</key>
1344 <string>evaluate-mechanisms</string>
1345 <key>comment</key>
1346 <string>Checked if the foreground console user tries to restart the system while other users are logged in via fast-user switching.</string>
1347 <key>mechanisms</key>
1348 <array>
1349 <string>RestartAuthorization:restart</string>
1350 <string>builtin:authenticate,privileged</string>
1351 <string>RestartAuthorization:success</string>
1352 </array>
1353 </dict>
1354 <key>system.services.directory.configure</key>
1355 <dict>
1356 <key>class</key>
1357 <string>rule</string>
1358 <key>k-of-n</key>
1359 <integer>1</integer>
1360 <key>rule</key>
1361 <array>
1362 <string>is-root</string>
1363 <string>entitled</string>
1364 <string>authenticate-admin-nonshared</string>
1365 </array>
1366 <key>comment</key>
1367 <string>For making Directory Services changes.</string>
1368 <key>version</key>
1369 <integer>3</integer>
1370 </dict>
1371 <key>system.services.networkextension.filtering</key>
1372 <dict>
1373 <key>allow-root</key>
1374 <true/>
1375 <key>class</key>
1376 <string>user</string>
1377 <key>comment</key>
1378 <string>For making changes to the Content Filtering configuration using NetworkExtension.</string>
1379 <key>entitled-group</key>
1380 <true/>
1381 <key>group</key>
1382 <string>admin</string>
1383 <key>vpn-entitled-group</key>
1384 <true/>
1385 </dict>
1386 <key>system.services.networkextension.vpn</key>
1387 <dict>
1388 <key>allow-root</key>
1389 <true/>
1390 <key>class</key>
1391 <string>user</string>
1392 <key>comment</key>
1393 <string>For making changes to the VPN configuration using NetworkExtension.</string>
1394 <key>entitled-group</key>
1395 <true/>
1396 <key>group</key>
1397 <string>admin</string>
1398 <key>vpn-entitled-group</key>
1399 <true/>
1400 </dict>
1401 <key>system.services.systemconfiguration.network</key>
1402 <dict>
1403 <key>class</key>
1404 <string>rule</string>
1405 <key>comment</key>
1406 <string>For making change to network configuration via System Configuration.</string>
1407 <key>k-of-n</key>
1408 <integer>1</integer>
1409 <key>rule</key>
1410 <array>
1411 <string>is-root</string>
1412 <string>entitled</string>
1413 <string>_mbsetupuser-nonshared</string>
1414 <string>authenticate-admin-nonshared</string>
1415 </array>
1416 <key>entitled-group</key>
1417 <true/>
1418 <key>version</key>
1419 <integer>2</integer>
1420 <key>vpn-entitled-group</key>
1421 <true/>
1422 </dict>
1423 <key>system.sharepoints.</key>
1424 <dict>
1425 <key>allow-root</key>
1426 <true/>
1427 <key>class</key>
1428 <string>user</string>
1429 <key>comment</key>
1430 <string>Checked when making changes to the Sharepoints.</string>
1431 <key>group</key>
1432 <string>admin</string>
1433 <key>shared</key>
1434 <true/>
1435 </dict>
1436 <key>system.shutdown</key>
1437 <dict>
1438 <key>class</key>
1439 <string>evaluate-mechanisms</string>
1440 <key>comment</key>
1441 <string>Checked if the foreground console user tries to shut down the system while other users are logged in via fast-user switching.</string>
1442 <key>mechanisms</key>
1443 <array>
1444 <string>RestartAuthorization:shutdown</string>
1445 <string>builtin:authenticate,privileged</string>
1446 <string>RestartAuthorization:success</string>
1447 </array>
1448 </dict>
1449 <key>system.volume.</key>
1450 <dict>
1451 <key>class</key>
1452 <string>rule</string>
1453 <key>comment</key>
1454 <string>system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount)</string>
1455 <key>k-of-n</key>
1456 <integer>1</integer>
1457 <key>rule</key>
1458 <array>
1459 <string>is-root</string>
1460 <string>is-admin</string>
1461 <string>authenticate-admin-30</string>
1462 </array>
1463 </dict>
1464 <key>system.volume.external.</key>
1465 <dict>
1466 <key>class</key>
1467 <string>rule</string>
1468 <key>comment</key>
1469 <string>system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount)</string>
1470 <key>k-of-n</key>
1471 <integer>1</integer>
1472 <key>rule</key>
1473 <array>
1474 <string>is-root</string>
1475 <string>is-admin</string>
1476 <string>on-console</string>
1477 <string>authenticate-admin-30</string>
1478 </array>
1479 </dict>
1480 <key>system.volume.external.adopt</key>
1481 <dict>
1482 <key>class</key>
1483 <string>rule</string>
1484 <key>comment</key>
1485 <string>system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount)</string>
1486 <key>k-of-n</key>
1487 <integer>1</integer>
1488 <key>rule</key>
1489 <array>
1490 <string>is-root</string>
1491 <string>is-admin</string>
1492 <string>authenticate-admin-30</string>
1493 </array>
1494 </dict>
1495 <key>system.volume.network.</key>
1496 <dict>
1497 <key>class</key>
1498 <string>rule</string>
1499 <key>comment</key>
1500 <string>system.volume.network.unmount</string>
1501 <key>k-of-n</key>
1502 <integer>1</integer>
1503 <key>rule</key>
1504 <array>
1505 <string>is-root</string>
1506 <string>is-admin</string>
1507 <string>on-console</string>
1508 <string>authenticate-admin-30</string>
1509 </array>
1510 </dict>
1511 <key>system.volume.optical.</key>
1512 <dict>
1513 <key>class</key>
1514 <string>rule</string>
1515 <key>comment</key>
1516 <string>system.volume.optical.(adopt|encode|mount|rename|unmount)</string>
1517 <key>k-of-n</key>
1518 <integer>1</integer>
1519 <key>rule</key>
1520 <array>
1521 <string>is-root</string>
1522 <string>is-admin</string>
1523 <string>on-console</string>
1524 <string>authenticate-admin-30</string>
1525 </array>
1526 </dict>
1527 <key>system.volume.optical.adopt</key>
1528 <dict>
1529 <key>class</key>
1530 <string>rule</string>
1531 <key>comment</key>
1532 <string>system.volume.optical.adopt</string>
1533 <key>k-of-n</key>
1534 <integer>1</integer>
1535 <key>rule</key>
1536 <array>
1537 <string>is-root</string>
1538 <string>is-admin</string>
1539 <string>authenticate-admin-30</string>
1540 </array>
1541 </dict>
1542 <key>system.volume.removable.</key>
1543 <dict>
1544 <key>class</key>
1545 <string>rule</string>
1546 <key>comment</key>
1547 <string>system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount)</string>
1548 <key>k-of-n</key>
1549 <integer>1</integer>
1550 <key>rule</key>
1551 <array>
1552 <string>is-root</string>
1553 <string>is-admin</string>
1554 <string>on-console</string>
1555 <string>authenticate-admin-30</string>
1556 </array>
1557 </dict>
1558 <key>system.volume.removable.adopt</key>
1559 <dict>
1560 <key>class</key>
1561 <string>rule</string>
1562 <key>comment</key>
1563 <string>system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount)</string>
1564 <key>k-of-n</key>
1565 <integer>1</integer>
1566 <key>rule</key>
1567 <array>
1568 <string>is-root</string>
1569 <string>is-admin</string>
1570 <string>authenticate-admin-30</string>
1571 </array>
1572 </dict>
1573 <key>com.apple.installassistant.macos</key>
1574 <dict>
1575 <key>allow-root</key>
1576 <true/>
1577 <key>class</key>
1578 <string>user</string>
1579 <key>comment</key>
1580 <string>Used by Install Assistant</string>
1581 <key>group</key>
1582 <string>admin</string>
1583 <key>shared</key>
1584 <false/>
1585 <key>timeout</key>
1586 <integer>300</integer>
1587 </dict>
1588 <key>com.apple.security.syntheticinput</key>
1589 <dict>
1590 <key>class</key>
1591 <string>rule</string>
1592 <key>rule</key>
1593 <string>authenticate-session-owner</string>
1594 </dict>
1595 <key>com.apple.security.sudo</key>
1596 <dict>
1597 <key>class</key>
1598 <string>rule</string>
1599 <key>k-of-n</key>
1600 <integer>2</integer>
1601 <key>rule</key>
1602 <array>
1603 <string>entitled</string>
1604 <string>authenticate-session-owner</string>
1605 </array>
1606 </dict>
1607 <key>system.preferences.continuity</key>
1608 <dict>
1609 <key>class</key>
1610 <string>rule</string>
1611 <key>comment</key>
1612 <string>Used by Password And Continuity PrefPane to request the user's password.</string>
1613 <key>rule</key>
1614 <array>
1615 <string>authenticate-staff-extract-context</string>
1616 </array>
1617 </dict>
1618 <key>com.apple.configurationprofiles.userprofile.trustcert</key>
1619 <dict>
1620 <key>class</key>
1621 <string>rule</string>
1622 <key>comment</key>
1623 <string>Install user configuration profile with certificate requiring trust change.</string>
1624 <key>rule</key>
1625 <array>
1626 <string>authenticate-session-owner-or-admin</string>
1627 </array>
1628 </dict>
1629 <key>com.apple.configurationprofiles.userenrollment.install</key>
1630 <dict>
1631 <key>class</key>
1632 <string>user</string>
1633 <key>comment</key>
1634 <string>This right is used by UserManagement to ask user to acquire password from users.</string>
1635 <key>session-owner</key>
1636 <true/>
1637 <key>extract-password</key>
1638 <true/>
1639 <key>password-only</key>
1640 <true/>
1641 <key>shared</key>
1642 <false/>
1643 <key>version</key>
1644 <integer>1</integer>
1645 </dict>
1646 <key>com.apple.configurationprofiles.deviceenrollment.install</key>
1647 <dict>
1648 <key>class</key>
1649 <string>user</string>
1650 <key>comment</key>
1651 <string>This right is used by UserManagement to ask for an admin password.</string>
1652 <key>group</key>
1653 <string>admin</string>
1654 <key>password-only</key>
1655 <true/>
1656 <key>shared</key>
1657 <false/>
1658 <key>version</key>
1659 <integer>1</integer>
1660 </dict>
1661 <key>com.apple.configurationprofiles.deviceenrollment.uninstall</key>
1662 <dict>
1663 <key>class</key>
1664 <string>user</string>
1665 <key>comment</key>
1666 <string>This right is used by UserManagement to ask for an admin password.</string>
1667 <key>group</key>
1668 <string>admin</string>
1669 <key>password-only</key>
1670 <true/>
1671 <key>shared</key>
1672 <false/>
1673 <key>version</key>
1674 <integer>1</integer>
1675 </dict>
1676 <key>com.apple.safaridriver.allow</key>
1677 <dict>
1678 <key>comment</key>
1679 <string>This right is used by safaridriver to allow running it.</string>
1680 <key>class</key>
1681 <string>rule</string>
1682 <key>k-of-n</key>
1683 <integer>1</integer>
1684 <key>rule</key>
1685 <array>
1686 <string>is-admin</string>
1687 <string>is-webdeveloper</string>
1688 <string>authenticate-webdeveloper</string>
1689 </array>
1690 <key>version</key>
1691 <integer>1</integer>
1692 </dict>
1693 <key>com.apple.app-sandbox.create-symlink</key>
1694 <dict>
1695 <key>comment</key>
1696 <string>Authorize an app-sandboxed application to install a symlink into /usr/local/bin.</string>
1697 <key>class</key>
1698 <string>rule</string>
1699 <key>rule</key>
1700 <string>authenticate-admin-nonshared</string>
1701 <key>shared</key>
1702 <false/>
1703 <key>timeout</key>
1704 <integer>60</integer>
1705 </dict>
1706 <key>com.apple.app-sandbox.set-attributes</key>
1707 <dict>
1708 <key>comment</key>
1709 <string>Authorize an app-sandboxed application to change permissions on a privileged file.</string>
1710 <key>class</key>
1711 <string>rule</string>
1712 <key>rule</key>
1713 <string>authenticate-admin-nonshared</string>
1714 <key>shared</key>
1715 <false/>
1716 <key>timeout</key>
1717 <integer>60</integer>
1718 </dict>
1719 <key>com.apple.app-sandbox.replace-file</key>
1720 <dict>
1721 <key>comment</key>
1722 <string>Authorize an app-sandboxed application to save (overwrite) a file in a privileged location.</string>
1723 <key>class</key>
1724 <string>rule</string>
1725 <key>rule</key>
1726 <string>authenticate-admin-nonshared</string>
1727 <key>shared</key>
1728 <false/>
1729 <key>timeout</key>
1730 <integer>60</integer>
1731 </dict>
1732 <key>com.apple.applepay.reset</key>
1733 <dict>
1734 <key>class</key>
1735 <string>user</string>
1736 <key>comment</key>
1737 <string>Used by nfcd.</string>
1738 <key>group</key>
1739 <string>admin</string>
1740 <key>shared</key>
1741 <false/>
1742 <key>timeout</key>
1743 <integer>300</integer>
1744 </dict>
1745 <key>com.apple.tcc.util.admin</key>
1746 <dict>
1747 <key>comment</key>
1748 <string>For modification of TCC settings.</string>
1749 <key>class</key>
1750 <string>rule</string>
1751 <key>rule</key>
1752 <string>authenticate-admin-nonshared</string>
1753 <key>shared</key>
1754 <false/>
1755 </dict>
1756 <key>com.apple.system-extensions.admin</key>
1757 <dict>
1758 <key>comment</key>
1759 <string>Authorize a 3rd party application which wants to manipulate system extensions.</string>
1760 <key>class</key>
1761 <string>rule</string>
1762 <key>rule</key>
1763 <string>authenticate-admin-nonshared</string>
1764 <key>shared</key>
1765 <false/>
1766 </dict>
1767 <key>com.apple.system-migration.launch</key>
1768 <dict>
1769 <key>comment</key>
1770 <string>Used by Migration Assistant.</string>
1771 <key>class</key>
1772 <string>rule</string>
1773 <key>rule</key>
1774 <string>authenticate-admin-nonshared</string>
1775 <key>shared</key>
1776 <false/>
1777 </dict>
1778 <key>com.apple.system-migration.launch-password</key>
1779 <dict>
1780 <key>comment</key>
1781 <string>Used by Migration Assistant.</string>
1782 <key>class</key>
1783 <string>rule</string>
1784 <key>rule</key>
1785 <string>authenticate-admin-nonshared-password</string>
1786 <key>shared</key>
1787 <false/>
1788 </dict>
1789 <key>com.apple.system-migration.cleanup</key>
1790 <dict>
1791 <key>comment</key>
1792 <string>Used by System Migration.</string>
1793 <key>class</key>
1794 <string>rule</string>
1795 <key>rule</key>
1796 <string>authenticate-admin-nonshared</string>
1797 <key>shared</key>
1798 <false/>
1799 </dict>
1800 </dict>
1801 <key>rules</key>
1802 <dict>
1803 <key>admin</key>
1804 <dict>
1805 <key>class</key>
1806 <string>user</string>
1807 <key>group</key>
1808 <string>admin</string>
1809 <key>shared</key>
1810 <true/>
1811 </dict>
1812 <key>allow</key>
1813 <dict>
1814 <key>class</key>
1815 <string>allow</string>
1816 <key>comment</key>
1817 <string>Allow anyone.</string>
1818 </dict>
1819 <key>app-specific-admin</key>
1820 <dict>
1821 <key>class</key>
1822 <string>user</string>
1823 <key>group</key>
1824 <string>admin</string>
1825 </dict>
1826 <key>appserver-admin</key>
1827 <dict>
1828 <key>class</key>
1829 <string>user</string>
1830 <key>group</key>
1831 <string>appserveradm</string>
1832 </dict>
1833 <key>appserver-user</key>
1834 <dict>
1835 <key>class</key>
1836 <string>user</string>
1837 <key>group</key>
1838 <string>appserverusr</string>
1839 </dict>
1840 <key>authenticate</key>
1841 <dict>
1842 <key>class</key>
1843 <string>evaluate-mechanisms</string>
1844 <key>mechanisms</key>
1845 <array>
1846 <string>builtin:authenticate</string>
1847 <string>builtin:reset-password,privileged</string>
1848 <string>builtin:authenticate,privileged</string>
1849 </array>
1850 <key>version</key>
1851 <integer>1</integer>
1852 </dict>
1853 <key>kcunlock</key>
1854 <dict>
1855 <key>class</key>
1856 <string>evaluate-mechanisms</string>
1857 <key>extract-password</key>
1858 <true/>
1859 <key>mechanisms</key>
1860 <array>
1861 <string>builtin:unlock-keychain</string>
1862 <string>builtin:kc-verify,privileged</string>
1863 </array>
1864 <key>version</key>
1865 <integer>1</integer>
1866 </dict>
1867 <key>authenticate-admin</key>
1868 <dict>
1869 <key>class</key>
1870 <string>user</string>
1871 <key>comment</key>
1872 <string>Authenticate as an administrator.</string>
1873 <key>group</key>
1874 <string>admin</string>
1875 <key>shared</key>
1876 <true/>
1877 <key>timeout</key>
1878 <integer>0</integer>
1879 </dict>
1880 <key>authenticate-admin-nonshared</key>
1881 <dict>
1882 <key>class</key>
1883 <string>user</string>
1884 <key>comment</key>
1885 <string>Authenticate as an administrator.</string>
1886 <key>group</key>
1887 <string>admin</string>
1888 <key>timeout</key>
1889 <integer>30</integer>
1890 <key>version</key>
1891 <integer>1</integer>
1892 </dict>
1893 <key>authenticate-admin-nonshared-password</key>
1894 <dict>
1895 <key>class</key>
1896 <string>user</string>
1897 <key>comment</key>
1898 <string>Authenticate as an administrator with the password.</string>
1899 <key>group</key>
1900 <string>admin</string>
1901 <key>password-only</key>
1902 <true/>
1903 <key>timeout</key>
1904 <integer>30</integer>
1905 <key>version</key>
1906 <integer>1</integer>
1907 </dict>
1908 <key>_mbsetupuser-nonshared</key>
1909 <dict>
1910 <key>class</key>
1911 <string>user</string>
1912 <key>authenticate-user</key>
1913 <false/>
1914 <key>comment</key>
1915 <string>Succeeds if user is from _mbsetupuser group.</string>
1916 <key>group</key>
1917 <string>_mbsetupuser</string>
1918 <key>timeout</key>
1919 <integer>30</integer>
1920 </dict>
1921 <key>authenticate-admin-30</key>
1922 <dict>
1923 <key>class</key>
1924 <string>user</string>
1925 <key>comment</key>
1926 <string>Like the default rule, but
1927 credentials remain valid for only 30 seconds after they've
1928 been obtained. An acquired credential is shared by all clients.
1929 </string>
1930 <key>group</key>
1931 <string>admin</string>
1932 <key>shared</key>
1933 <true/>
1934 <key>timeout</key>
1935 <integer>30</integer>
1936 </dict>
1937 <key>authenticate-admin-extract-weak</key>
1938 <dict>
1939 <key>class</key>
1940 <string>user</string>
1941 <key>comment</key>
1942 <string>Authenticate as an administrator + allow password extraction.</string>
1943 <key>extract-password</key>
1944 <true/>
1945 <key>group</key>
1946 <string>admin</string>
1947 <key>require-apple-signed</key>
1948 <true/>
1949 <key>timeout</key>
1950 <integer>0</integer>
1951 </dict>
1952 <key>authenticate-staff-extract-weak</key>
1953 <dict>
1954 <key>class</key>
1955 <string>user</string>
1956 <key>comment</key>
1957 <string>Authenticate as group staff + allow password to be extracted.</string>
1958 <key>extract-password</key>
1959 <true/>
1960 <key>group</key>
1961 <string>staff</string>
1962 <key>require-apple-signed</key>
1963 <true/>
1964 <key>timeout</key>
1965 <integer>0</integer>
1966 </dict>
1967 <key>authenticate-admin-extract</key>
1968 <dict>
1969 <key>class</key>
1970 <string>user</string>
1971 <key>comment</key>
1972 <string>Authenticate as an administrator + allow password extraction.</string>
1973 <key>extract-password</key>
1974 <true/>
1975 <key>password-only</key>
1976 <true/>
1977 <key>group</key>
1978 <string>admin</string>
1979 <key>require-apple-signed</key>
1980 <true/>
1981 <key>timeout</key>
1982 <integer>0</integer>
1983 <key>version</key>
1984 <integer>1</integer>
1985 </dict>
1986 <key>authenticate-staff-extract</key>
1987 <dict>
1988 <key>class</key>
1989 <string>user</string>
1990 <key>comment</key>
1991 <string>Authenticate as group staff + allow password to be extracted.</string>
1992 <key>extract-password</key>
1993 <true/>
1994 <key>password-only</key>
1995 <true/>
1996 <key>group</key>
1997 <string>staff</string>
1998 <key>require-apple-signed</key>
1999 <true/>
2000 <key>timeout</key>
2001 <integer>0</integer>
2002 <key>version</key>
2003 <integer>1</integer>
2004 </dict>
2005 <key>authenticate-staff-extract-context</key>
2006 <dict>
2007 <key>class</key>
2008 <string>rule</string>
2009 <key>k-of-n</key>
2010 <integer>2</integer>
2011 <key>rule</key>
2012 <array>
2013 <string>authenticate-staff-extract</string>
2014 <string>localauthentication-context</string>
2015 </array>
2016 </dict>
2017 <key>authenticate-admin-or-staff-extract-weak</key>
2018 <dict>
2019 <key>class</key>
2020 <string>rule</string>
2021 <key>k-of-n</key>
2022 <integer>1</integer>
2023 <key>rule</key>
2024 <array>
2025 <string>authenticate-admin-extract-weak</string>
2026 <string>authenticate-staff-extract-weak</string>
2027 </array>
2028 </dict>
2029 <key>authenticate-admin-or-staff-extract</key>
2030 <dict>
2031 <key>class</key>
2032 <string>rule</string>
2033 <key>k-of-n</key>
2034 <integer>1</integer>
2035 <key>rule</key>
2036 <array>
2037 <string>authenticate-admin-extract</string>
2038 <string>authenticate-staff-extract</string>
2039 </array>
2040 </dict>
2041 <key>authenticate-appstore-30</key>
2042 <dict>
2043 <key>class</key>
2044 <string>user</string>
2045 <key>group</key>
2046 <string>_appstore</string>
2047 <key>shared</key>
2048 <true/>
2049 <key>timeout</key>
2050 <integer>30</integer>
2051 </dict>
2052 <key>authenticate-developer</key>
2053 <dict>
2054 <key>class</key>
2055 <string>user</string>
2056 <key>comment</key>
2057 <string>Authenticate as a developer.</string>
2058 <key>group</key>
2059 <string>_developer</string>
2060 <key>shared</key>
2061 <true/>
2062 <key>timeout</key>
2063 <integer>36000</integer>
2064 </dict>
2065 <key>authenticate-session-owner</key>
2066 <dict>
2067 <key>class</key>
2068 <string>user</string>
2069 <key>comment</key>
2070 <string>Authenticate as the session owner.</string>
2071 <key>session-owner</key>
2072 <true/>
2073 </dict>
2074 <key>authenticate-session-owner-or-admin</key>
2075 <dict>
2076 <key>allow-root</key>
2077 <false/>
2078 <key>class</key>
2079 <string>user</string>
2080 <key>comment</key>
2081 <string>Authenticate either as the owner or as an administrator.</string>
2082 <key>group</key>
2083 <string>admin</string>
2084 <key>session-owner</key>
2085 <true/>
2086 <key>shared</key>
2087 <false/>
2088 </dict>
2089 <key>authenticate-session-user</key>
2090 <dict>
2091 <key>class</key>
2092 <string>user</string>
2093 <key>comment</key>
2094 <string>Same as authenticate-session-owner.</string>
2095 <key>session-owner</key>
2096 <true/>
2097 </dict>
2098 <key>default</key>
2099 <dict>
2100 <key>class</key>
2101 <string>user</string>
2102 <key>comment</key>
2103 <string>Default rule.
2104 Credentials remain valid for 5 minutes after they've been obtained.
2105 An acquired credential is shared by all clients.
2106 </string>
2107 <key>group</key>
2108 <string>admin</string>
2109 <key>shared</key>
2110 <true/>
2111 <key>timeout</key>
2112 <integer>300</integer>
2113 </dict>
2114 <key>entitled</key>
2115 <dict>
2116 <key>class</key>
2117 <string>evaluate-mechanisms</string>
2118 <key>mechanisms</key>
2119 <array>
2120 <string>builtin:entitled,privileged</string>
2121 </array>
2122 <key>tries</key>
2123 <integer>1</integer>
2124 </dict>
2125 <key>entitled-admin</key>
2126 <dict>
2127 <key>class</key>
2128 <string>rule</string>
2129 <key>k-of-n</key>
2130 <integer>2</integer>
2131 <key>rule</key>
2132 <array>
2133 <string>is-admin</string>
2134 <string>entitled</string>
2135 </array>
2136 </dict>
2137 <key>entitled-admin-nonshared</key>
2138 <dict>
2139 <key>class</key>
2140 <string>rule</string>
2141 <key>k-of-n</key>
2142 <integer>2</integer>
2143 <key>rule</key>
2144 <array>
2145 <string>is-admin-nonshared</string>
2146 <string>entitled</string>
2147 </array>
2148 </dict>
2149 <key>entitled-admin-or-authenticate-admin-nonshared</key>
2150 <dict>
2151 <key>class</key>
2152 <string>rule</string>
2153 <key>k-of-n</key>
2154 <integer>1</integer>
2155 <key>rule</key>
2156 <array>
2157 <string>entitled-admin-nonshared</string>
2158 <string>authenticate-admin-nonshared</string>
2159 </array>
2160 </dict>
2161 <key>entitled-admin-or-authenticate-admin</key>
2162 <dict>
2163 <key>class</key>
2164 <string>rule</string>
2165 <key>k-of-n</key>
2166 <integer>1</integer>
2167 <key>rule</key>
2168 <array>
2169 <string>entitled-admin</string>
2170 <string>authenticate-admin-30</string>
2171 </array>
2172 </dict>
2173 <key>entitled-appstore</key>
2174 <dict>
2175 <key>class</key>
2176 <string>rule</string>
2177 <key>k-of-n</key>
2178 <integer>2</integer>
2179 <key>rule</key>
2180 <array>
2181 <string>is-appstore</string>
2182 <string>entitled</string>
2183 </array>
2184 </dict>
2185 <key>entitled-appstore-or-entitled-authenticate-appstore</key>
2186 <dict>
2187 <key>class</key>
2188 <string>rule</string>
2189 <key>k-of-n</key>
2190 <integer>1</integer>
2191 <key>rule</key>
2192 <array>
2193 <string>entitled-appstore</string>
2194 <string>entitled-authenticate-appstore</string>
2195 </array>
2196 </dict>
2197 <key>entitled-authenticate-admin</key>
2198 <dict>
2199 <key>class</key>
2200 <string>rule</string>
2201 <key>k-of-n</key>
2202 <integer>2</integer>
2203 <key>rule</key>
2204 <array>
2205 <string>entitled</string>
2206 <string>authenticate-admin-30</string>
2207 </array>
2208 </dict>
2209 <key>entitled-authenticate-appstore</key>
2210 <dict>
2211 <key>class</key>
2212 <string>rule</string>
2213 <key>k-of-n</key>
2214 <integer>2</integer>
2215 <key>rule</key>
2216 <array>
2217 <string>entitled</string>
2218 <string>authenticate-appstore-30</string>
2219 </array>
2220 </dict>
2221 <key>entitled-session-owner</key>
2222 <dict>
2223 <key>class</key>
2224 <string>rule</string>
2225 <key>k-of-n</key>
2226 <integer>2</integer>
2227 <key>rule</key>
2228 <array>
2229 <string>is-session-owner</string>
2230 <string>entitled</string>
2231 </array>
2232 </dict>
2233 <key>entitled-session-owner-or-authenticate-session-owner</key>
2234 <dict>
2235 <key>class</key>
2236 <string>rule</string>
2237 <key>k-of-n</key>
2238 <integer>1</integer>
2239 <key>rule</key>
2240 <array>
2241 <string>entitled-session-owner</string>
2242 <string>authenticate-session-owner</string>
2243 </array>
2244 </dict>
2245 <key>is-admin</key>
2246 <dict>
2247 <key>authenticate-user</key>
2248 <false/>
2249 <key>class</key>
2250 <string>user</string>
2251 <key>comment</key>
2252 <string>Verify that the user asking for authorization is an administrator.</string>
2253 <key>group</key>
2254 <string>admin</string>
2255 <key>shared</key>
2256 <true/>
2257 </dict>
2258 <key>is-admin-nonshared</key>
2259 <dict>
2260 <key>authenticate-user</key>
2261 <false/>
2262 <key>class</key>
2263 <string>user</string>
2264 <key>comment</key>
2265 <string>Verify that the user asking for authorization is an administrator - nonshared right.</string>
2266 <key>group</key>
2267 <string>admin</string>
2268 </dict>
2269 <key>is-appstore</key>
2270 <dict>
2271 <key>authenticate-user</key>
2272 <false/>
2273 <key>class</key>
2274 <string>user</string>
2275 <key>group</key>
2276 <string>_appstore</string>
2277 <key>shared</key>
2278 <true/>
2279 </dict>
2280 <key>is-developer</key>
2281 <dict>
2282 <key>authenticate-user</key>
2283 <false/>
2284 <key>class</key>
2285 <string>user</string>
2286 <key>comment</key>
2287 <string>Verify that the user asking for authorization is a developer.</string>
2288 <key>group</key>
2289 <string>_developer</string>
2290 </dict>
2291 <key>is-lpadmin</key>
2292 <dict>
2293 <key>authenticate-user</key>
2294 <false/>
2295 <key>class</key>
2296 <string>user</string>
2297 <key>group</key>
2298 <string>_lpadmin</string>
2299 </dict>
2300 <key>is-root</key>
2301 <dict>
2302 <key>allow-root</key>
2303 <true/>
2304 <key>authenticate-user</key>
2305 <false/>
2306 <key>class</key>
2307 <string>user</string>
2308 <key>comment</key>
2309 <string>Verify that the process that created this AuthorizationRef is running as root.</string>
2310 </dict>
2311 <key>is-session-owner</key>
2312 <dict>
2313 <key>allow-root</key>
2314 <false/>
2315 <key>authenticate-user</key>
2316 <false/>
2317 <key>class</key>
2318 <string>user</string>
2319 <key>comment</key>
2320 <string>Verify that the requesting process is running as the session owner.</string>
2321 <key>session-owner</key>
2322 <true/>
2323 </dict>
2324 <key>lpadmin</key>
2325 <dict>
2326 <key>class</key>
2327 <string>user</string>
2328 <key>group</key>
2329 <string>_lpadmin</string>
2330 <key>shared</key>
2331 <true/>
2332 </dict>
2333 <key>on-console</key>
2334 <dict>
2335 <key>class</key>
2336 <string>evaluate-mechanisms</string>
2337 <key>mechanisms</key>
2338 <array>
2339 <string>builtin:on-console</string>
2340 </array>
2341 <key>tries</key>
2342 <integer>1</integer>
2343 </dict>
2344 <key>root-or-entitled-admin-or-admin</key>
2345 <dict>
2346 <key>class</key>
2347 <string>rule</string>
2348 <key>k-of-n</key>
2349 <integer>1</integer>
2350 <key>rule</key>
2351 <array>
2352 <string>is-root</string>
2353 <string>entitled-admin</string>
2354 <string>admin</string>
2355 </array>
2356 </dict>
2357 <key>root-or-entitled-admin-or-app-specific-admin</key>
2358 <dict>
2359 <key>class</key>
2360 <string>rule</string>
2361 <key>k-of-n</key>
2362 <integer>1</integer>
2363 <key>rule</key>
2364 <array>
2365 <string>is-root</string>
2366 <string>entitled-admin</string>
2367 <string>app-specific-admin</string>
2368 </array>
2369 </dict>
2370 <key>root-or-entitled-admin-or-authenticate-admin</key>
2371 <dict>
2372 <key>class</key>
2373 <string>rule</string>
2374 <key>k-of-n</key>
2375 <integer>1</integer>
2376 <key>rule</key>
2377 <array>
2378 <string>is-root</string>
2379 <string>entitled-admin-or-authenticate-admin</string>
2380 </array>
2381 </dict>
2382 <key>root-or-lpadmin</key>
2383 <dict>
2384 <key>class</key>
2385 <string>rule</string>
2386 <key>k-of-n</key>
2387 <integer>1</integer>
2388 <key>rule</key>
2389 <array>
2390 <string>is-root</string>
2391 <string>is-lpadmin</string>
2392 <string>lpadmin</string>
2393 </array>
2394 </dict>
2395 <key>use-login-window-ui</key>
2396 <dict>
2397 <key>allow-root</key>
2398 <false/>
2399 <key>class</key>
2400 <string>user</string>
2401 <key>comment</key>
2402 <string>Authenticate either as the owner or as an administrator.</string>
2403 <key>group</key>
2404 <string>admin</string>
2405 <key>session-owner</key>
2406 <true/>
2407 <key>shared</key>
2408 <false/>
2409 </dict>
2410 <key>localauthentication-context</key>
2411 <dict>
2412 <key>class</key>
2413 <string>evaluate-mechanisms</string>
2414 <key>comment</key>
2415 <string>Used by LocalAuthentication to pass externalized context.</string>
2416 <key>mechanisms</key>
2417 <array>
2418 <string>LocalAuthentication:context</string>
2419 </array>
2420 </dict>
2421 <key>is-webdeveloper</key>
2422 <dict>
2423 <key>authenticate-user</key>
2424 <false/>
2425 <key>class</key>
2426 <string>user</string>
2427 <key>comment</key>
2428 <string>Verify that the user asking for authorization is a web developer.</string>
2429 <key>group</key>
2430 <string>_webdeveloper</string>
2431 </dict>
2432 <key>authenticate-webdeveloper</key>
2433 <dict>
2434 <key>class</key>
2435 <string>user</string>
2436 <key>comment</key>
2437 <string>Authenticate as a web developer.</string>
2438 <key>group</key>
2439 <string>_webdeveloper</string>
2440 <key>shared</key>
2441 <true/>
2442 <key>timeout</key>
2443 <integer>36000</integer>
2444 </dict>
2445 </dict>
2446 </dict>
2447 </plist>
2448
mirror of Security