etc/authorization.plist

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   3 <plist version="1.0">
   4 <dict>
   5         <key>comment</key>
   6         <string>The name of the requested right is matched against the keys.  An exact match has priority, otherwise the longest match from the start is used.  Note that the right will only match wildcard rules (ending in a ".") during this reduction.
   7
   8 allow rule: this is always allowed
   9 &lt;key&gt;com.apple.TestApp.benign&lt;/key&gt;
  10 &lt;string&gt;allow&lt;/string&gt;
  11
  12 deny rule: this is always denied
  13 &lt;key&gt;com.apple.TestApp.dangerous&lt;/key&gt;
  14 &lt;string&gt;deny&lt;/string&gt;
  15
  16 user rule: successful authentication as a user in the specified group(5) allows the associated right.
  17
  18 The shared property specifies whether a credential generated on success is shared with other apps (i.e., those in the same "session"). This property defaults to false if not specified.
  19
  20 The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule.
  21
  22 The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0.  This defaults to false if not specified.
  23
  24 See remaining rules for examples.
  25 </string>
  26         <key>rights</key>
  27         <dict>
  28                 <key></key>
  29                 <dict>
  30                         <key>class</key>
  31                         <string>rule</string>
  32                         <key>comment</key>
  33                         <string>Matches otherwise unmatched rights (i.e., is a default).</string>
  34                         <key>rule</key>
  35                         <string>default</string>
  36                 </dict>
  37                 <key>config.add.</key>
  38                 <dict>
  39                         <key>class</key>
  40                         <string>allow</string>
  41                         <key>comment</key>
  42                         <string>Wildcard right for adding rights.  Anyone is allowed to add any (non-wildcard) rights.</string>
  43                 </dict>
  44                 <key>config.config.</key>
  45                 <dict>
  46                         <key>class</key>
  47                         <string>deny</string>
  48                         <key>comment</key>
  49                         <string>Wildcard right for any change to meta-rights for db modification.  Not allowed programmatically (just edit this file).</string>
  50                 </dict>
  51                 <key>config.modify.</key>
  52                 <dict>
  53                         <key>class</key>
  54                         <string>rule</string>
  55                         <key>comment</key>
  56                         <string>Wildcard right for modifying rights.  Admins are allowed to modify any (non-wildcard) rights.  Root does not require authentication.</string>
  57                         <key>k-of-n</key>
  58                         <integer>1</integer>
  59                         <key>rule</key>
  60                         <array>
  61                                 <string>is-root</string>
  62                                 <string>authenticate-admin</string>
  63                         </array>
  64                 </dict>
  65                 <key>config.remove.</key>
  66                 <dict>
  67                         <key>class</key>
  68                         <string>rule</string>
  69                         <key>comment</key>
  70                         <string>Wildcard right for deleting rights.  Admins are allowed to delete any (non-wildcard) rights.  Root does not require authentication.</string>
  71                         <key>k-of-n</key>
  72                         <integer>1</integer>
  73                         <key>rule</key>
  74                         <array>
  75                                 <string>is-root</string>
  76                                 <string>authenticate-admin</string>
  77                         </array>
  78                 </dict>
  79                 <key>config.remove.system.</key>
  80                 <dict>
  81                         <key>class</key>
  82                         <string>deny</string>
  83                         <key>comment</key>
  84                         <string>Wildcard right for deleting system rights.</string>
  85                 </dict>
  86                 <key>com.apple.</key>
  87                 <dict>
  88                         <key>rule</key>
  89                         <string>default</string>
  90                 </dict>
  91                 <key>system.</key>
  92                 <dict>
  93                         <key>rule</key>
  94                         <string>default</string>
  95                 </dict>
  96                 <key>sys.openfile.</key>
  97                 <dict>
  98                         <key>class</key>
  99                         <string>user</string>
 100                         <key>comment</key>
 101                         <string>See authopen(1) for information on the use of this right.</string>
 102                         <key>group</key>
 103                         <string>admin</string>
 104                         <key>shared</key>
 105                         <false/>
 106                         <key>timeout</key>
 107                         <integer>300</integer>
 108                 </dict>
 109                 <key>system.device.dvd.setregion.initial</key>
 110                 <dict>
 111                         <key>class</key>
 112                         <string>user</string>
 113                         <key>comment</key>
 114                         <string>Used by the DVD player to set the region code the first time.  Note that changing the region code after it has been set requires a different right (system.device.dvd.setregion.change).</string>
 115                         <key>group</key>
 116                         <string>admin</string>
 117                         <key>shared</key>
 118                         <true/>
 119                 </dict>
 120                 <key>system.login.console</key>
 121                 <dict>
 122                         <key>class</key>
 123                         <string>evaluate-mechanisms</string>
 124                         <key>comment</key>
 125                         <string>Login mechanism based rule.  Not for general use, yet.</string>
 126                         <key>mechanisms</key>
 127                         <array>
 128                                 <string>builtin:smartcard-sniffer,privileged</string>
 129                                 <string>loginwindow:login</string>
 130                                 <string>builtin:reset-password,privileged</string>
 131                                 <string>builtin:auto-login,privileged</string>
 132                                 <string>builtin:authenticate,privileged</string>
 133                                 <string>loginwindow:success</string>
 134                                 <string>HomeDirMechanism:login,privileged</string>
 135                                 <string>HomeDirMechanism:status</string>
 136                                 <string>MCXMechanism:login</string>
 137                                 <string>loginwindow:done</string>
 138                         </array>
 139                 </dict>
 140                 <key>system.login.done</key>
 141                 <dict>
 142                         <key>class</key>
 143                         <string>evaluate-mechanisms</string>
 144                         <key>mechanisms</key>
 145                         <array>
 146                         </array>
 147                 </dict>
 148                 <key>system.login.screensaver</key>
 149                 <dict>
 150                         <key>class</key>
 151                         <string>rule</string>
 152                         <key>comment</key>
 153                         <string>The owner or any administrator can unlock the screensaver.</string>
 154                         <key>rule</key>
 155                         <string>authenticate-session-owner-or-admin</string>
 156                 </dict>
 157                 <key>system.login.tty</key>
 158                 <dict>
 159                         <key>class</key>
 160                         <string>evaluate-mechanisms</string>
 161                         <key>tries</key>
 162                         <integer>1</integer>
 163                         <key>mechanisms</key>
 164                         <array>
 165                                 <string>push_hints_to_context</string>
 166                                 <string>authinternal</string>
 167                         </array>
 168                 </dict>
 169                 <key>system.keychain.create.loginkc</key>
 170                 <dict>
 171                         <key>allow-root</key>
 172                         <false/>
 173                         <key>class</key>
 174                         <string>evaluate-mechanisms</string>
 175                         <key>comment</key>
 176                         <string>Used by the Security framework when you add an item to an unconfigured default keychain.</string>
 177                         <key>mechanisms</key>
 178                         <array>
 179                                 <string>loginKC:queryCreate</string>
 180                                 <string>loginKC:showPasswordUI</string>
 181                                 <string>authinternal</string>
 182                         </array>
 183                         <key>session-owner</key>
 184                         <true/>
 185                         <key>shared</key>
 186                         <false/>
 187                 </dict>
 188                 <key>system.keychain.modify</key>
 189                 <dict>
 190                         <key>class</key>
 191                         <string>user</string>
 192                         <key>comment</key>
 193                         <string>Used by Keychain Access when editing a system keychain.</string>
 194                         <key>group</key>
 195                         <string>admin</string>
 196                         <key>shared</key>
 197                         <true/>
 198                         <key>timeout</key>
 199                         <integer>30</integer>
 200                 </dict>
 201                 <key>system.preferences</key>
 202                 <dict>
 203                         <key>allow-root</key>
 204                         <true/>
 205                         <key>class</key>
 206                         <string>user</string>
 207                         <key>comment</key>
 208                         <string>Checked by the Admin framework when making changes to certain System Preferences.</string>
 209                         <key>group</key>
 210                         <string>admin</string>
 211                         <key>shared</key>
 212                         <true/>
 213                 </dict>
 214                 <key>system.preferences.accounts</key>
 215                 <dict>
 216                         <key>allow-root</key>
 217                         <true/>
 218                         <key>class</key>
 219                         <string>user</string>
 220                         <key>comment</key>
 221                         <string>Checked by the Admin framework when making changes to the Accounts preference pane.</string>
 222                         <key>group</key>
 223                         <string>admin</string>
 224                         <key>shared</key>
 225                         <false/>
 226                 </dict>
 227                 <key>system.preferences.parental-controls</key>
 228                 <dict>
 229                         <key>class</key>
 230                         <string>user</string>
 231                         <key>comment</key>
 232                         <string>Checked when making changes to the Parental Controls preference pane.</string>
 233                         <key>group</key>
 234                         <string>admin</string>
 235                         <key>shared</key>
 236                         <false/>
 237                 </dict>
 238                 <key>system.preferences.accessibility</key>
 239                 <dict>
 240                         <key>allow-root</key>
 241                         <true/>
 242                         <key>class</key>
 243                         <string>user</string>
 244                         <key>comment</key>
 245                         <string>Checked by the Admin framework when enabling or disabling the Accessibility APIs.</string>
 246                         <key>group</key>
 247                         <string>admin</string>
 248                         <key>shared</key>
 249                         <false/>
 250                         <key>timeout</key>
 251                         <integer>0</integer>
 252                 </dict>
 253                 <key>system.preferences.security</key>
 254                 <dict>
 255                         <key>allow-root</key>
 256                         <true/>
 257                         <key>class</key>
 258                         <string>user</string>
 259                         <key>comment</key>
 260                         <string>Checked by the Admin framework when making changes to the Security preference pane.</string>
 261                         <key>group</key>
 262                         <string>admin</string>
 263                         <key>shared</key>
 264                         <false/>
 265                 </dict>
 266                 <key>system.printingmanager</key>
 267                 <dict>
 268                         <key>class</key>
 269                         <string>rule</string>
 270                         <key>comment</key>
 271                         <string>For printing to locked printers.</string>
 272                         <key>rule</key>
 273                         <string>authenticate-admin</string>
 274                 </dict>
 275                 <key>system.print.admin</key>
 276                 <dict>
 277                         <key>allow-root</key>
 278                         <true/>
 279                         <key>class</key>
 280                         <string>user</string>
 281                         <key>group</key>
 282                         <string>lpadmin</string>
 283                         <key>shared</key>
 284                         <true/>
 285                 </dict>
 286                 <key>system.print.operator</key>
 287                 <dict>
 288                         <key>allow-root</key>
 289                         <true/>
 290                         <key>class</key>
 291                         <string>user</string>
 292                         <key>group</key>
 293                         <string>_lpoperator</string>
 294                         <key>shared</key>
 295                         <true/>
 296                 </dict>
 297                 <key>system.identity.write.</key>
 298                 <dict>
 299                         <key>class</key>
 300                         <string>rule</string>
 301                         <key>comment</key>
 302                         <string>For creating, changing or deleting local user accounts and groups.</string>
 303                         <key>k-of-n</key>
 304                         <integer>1</integer>
 305                         <key>rule</key>
 306                         <array>
 307                                 <string>is-admin</string>
 308                                 <string>authenticate-admin</string>
 309                         </array>
 310                 </dict>
 311                 <key>system.identity.write.credential</key>
 312                 <dict>
 313                         <key>class</key>
 314                         <string>rule</string>
 315                         <key>comment</key>
 316                         <string>Checked when changing authentication credentials (password or certificate) for a local user account.</string>
 317                         <key>rule</key>
 318                         <string>default</string>
 319                 </dict>
 320                 <key>system.identity.write.self</key>
 321                 <dict>
 322                         <key>class</key>
 323                         <string>user</string>
 324                         <key>comment</key>
 325                         <string>Checked when changing authentication credentials (password or certificate) for the current user's account.</string>
 326                         <key>authenticate-user</key>
 327                         <false/>
 328                         <key>session-owner</key>
 329                         <true/>
 330                 </dict>
 331                 <key>system.global-login-items.</key>
 332                 <dict>
 333                         <key>class</key>
 334                         <string>rule</string>
 335                         <key>k-of-n</key>
 336                         <integer>1</integer>
 337                         <key>rule</key>
 338                         <array>
 339                                 <string>is-admin</string>
 340                                 <string>default</string>
 341                         </array>
 342                 </dict>
 343                 <key>system.sharepoints.</key>
 344                 <dict>
 345                         <key>allow-root</key>
 346                         <true/>
 347                         <key>class</key>
 348                         <string>user</string>
 349                         <key>comment</key>
 350                         <string>Checked when making changes to the Sharepoints.</string>
 351                         <key>group</key>
 352                         <string>admin</string>
 353                         <key>shared</key>
 354                         <true/>
 355                 </dict>
 356                 <key>com.apple.activitymonitor.kill</key>
 357                 <dict>
 358                         <key>class</key>
 359                         <string>user</string>
 360                         <key>comment</key>
 361                         <string>Used by Activity Monitor to authorize killing processes not owned by the user.</string>
 362                         <key>group</key>
 363                         <string>admin</string>
 364                         <key>shared</key>
 365                         <false/>
 366                         <key>timeout</key>
 367                         <integer>0</integer>
 368                 </dict>
 369                 <key>com.apple.Safari.parental-controls</key>
 370                 <dict>
 371                         <key>allow-root</key>
 372                         <true/>
 373                         <key>class</key>
 374                         <string>user</string>
 375                         <key>comment</key>
 376                         <string>Checked when changing parental controls for Safari.</string>
 377                         <key>group</key>
 378                         <string>admin</string>
 379                         <key>shared</key>
 380                         <false/>
 381                         <key>timeout</key>
 382                         <integer>0</integer>
 383                 </dict>
 384                 <key>com.apple.docset.install</key>
 385                 <dict>
 386                         <key>class</key>
 387                         <string>user</string>
 388                         <key>comment</key>
 389                         <string>Used by Xcode to restrict access to a daemon it uses to install and update documentation sets.</string>
 390                         <key>group</key>
 391                         <string>admin</string>
 392                         <key>shared</key>
 393                         <false/>
 394                 </dict>
 395                 <key>com.apple.DiskManagement.</key>
 396                 <dict>
 397                         <key>class</key>
 398                         <string>rule</string>
 399                         <key>comment</key>
 400                         <string>Used by diskmanagementd to allow access to its privileged functions</string>
 401                         <key>k-of-n</key>
 402                         <integer>1</integer>
 403                         <key>rule</key>
 404                         <array>
 405                                 <string>is-root</string>
 406                                 <string>is-admin</string>
 407                                 <string>default</string>
 408                         </array>
 409                         <key>shared</key>
 410                         <true/>
 411                 </dict>
 412                 <key>system.privilege.admin</key>
 413                 <dict>
 414                         <key>allow-root</key>
 415                         <true/>
 416                         <key>class</key>
 417                         <string>user</string>
 418                         <key>comment</key>
 419                         <string>Used by AuthorizationExecuteWithPrivileges(...).
 420                 AuthorizationExecuteWithPrivileges() is used by programs requesting
 421                 to run a tool as root (e.g., some installers).</string>
 422                         <key>group</key>
 423                         <string>admin</string>
 424                         <key>shared</key>
 425                         <false/>
 426                         <key>timeout</key>
 427                         <integer>300</integer>
 428                 </dict>
 429                 <key>system.privilege.taskport</key>
 430                 <dict>
 431                         <key>allow-root</key>
 432                         <false/>
 433                         <key>class</key>
 434                         <string>user</string>
 435                         <key>comment</key>
 436                         <string>Used by task_for_pid(...).
 437                 Task_for_pid is called by programs requesting full control over another program
 438                 for things like debugging or performance analysis. This authorization only applies
 439                 if the requesting and target programs are run by the same user; it will never
 440                 authorize access to the program of another user.  WARNING: administrators are advised not to modify this right.</string>
 441                         <key>group</key>
 442                         <string>_developer</string>
 443                         <key>shared</key>
 444                         <true/>
 445                         <key>timeout</key>
 446                         <integer>36000</integer>
 447                 </dict>
 448                 <key>system.privilege.taskport.safe</key>
 449                 <dict>
 450                         <key>class</key>
 451                         <string>allow</string>
 452                         <key>comment</key>
 453                         <string>For use by Apple.</string>
 454                 </dict>
 455                 <key>system.privilege.taskport.debug</key>
 456                 <dict>
 457                         <key>allow-root</key>
 458                         <false/>
 459                         <key>class</key>
 460                         <string>user</string>
 461                         <key>comment</key>
 462                         <string>For use by Apple.  WARNING: administrators are advised
 463             not to modify this right.</string>
 464                         <key>group</key>
 465                         <string>_developer</string>
 466                         <key>shared</key>
 467                         <true/>
 468                         <key>timeout</key>
 469                         <integer>36000</integer>
 470                 </dict>
 471                 <key>system.restart</key>
 472                 <dict>
 473                         <key>class</key>
 474                         <string>evaluate-mechanisms</string>
 475                         <key>comment</key>
 476                         <string>Checked if the foreground console user tries to restart the system while other users are logged in via fast-user switching.</string>
 477                         <key>mechanisms</key>
 478                         <array>
 479                                 <string>builtin:smartcard-sniffer,privileged</string>
 480                                 <string>RestartAuthorization:restart</string>
 481                                 <string>builtin:authenticate,privileged</string>
 482                                 <string>RestartAuthorization:success</string>
 483                         </array>
 484                 </dict>
 485                 <key>system.shutdown</key>
 486                 <dict>
 487                         <key>class</key>
 488                         <string>evaluate-mechanisms</string>
 489                         <key>comment</key>
 490                         <string>Checked if the foreground console user tries to shut down the system while other users are logged in via fast-user switching.</string>
 491                         <key>mechanisms</key>
 492                         <array>
 493                                         <string>builtin:smartcard-sniffer,privileged</string>
 494                                         <string>RestartAuthorization:shutdown</string>
 495                                         <string>builtin:authenticate,privileged</string>
 496                                         <string>RestartAuthorization:success</string>
 497                         </array>
 498                 </dict>
 499                 <key>system.burn</key>
 500                 <dict>
 501                         <key>class</key>
 502                         <string>allow</string>
 503                         <key>comment</key>
 504                         <string>For burning media.</string>
 505                 </dict>
 506                 <key>system.services.directory.configure</key>
 507                 <dict>
 508                         <key>class</key>
 509                         <string>user</string>
 510                         <key>group</key>
 511                         <string>admin</string>
 512                         <key>allow-root</key>
 513                         <true/>
 514                         <key>shared</key>
 515                         <true/>
 516                         <key>timeout</key>
 517                         <integer>300</integer>
 518                         <key>comment</key>
 519                         <string>For making Directory Services changes.</string>
 520                 </dict>
 521                 <key>com.apple.server.admin.streaming</key>
 522                 <dict>
 523                         <key>class</key>
 524                         <string>user</string>
 525                         <key>comment</key>
 526                         <string>For making administrative requests to the QuickTime Streaming Server.</string>
 527                         <key>group</key>
 528                         <string>admin</string>
 529                         <key>shared</key>
 530                         <false/>
 531                         <key>allow-root</key>
 532                         <true/>
 533                         <key>timeout</key>
 534                         <integer>0</integer>
 535                 </dict>
 536                 <key>com.apple.trust-settings.admin</key>
 537                 <dict>
 538                         <key>comment</key>
 539                         <string>For modifying Trust Settings in the Local Admin domain.</string>
 540                         <key>allow-root</key>
 541                         <true/>
 542                         <key>class</key>
 543                         <string>user</string>
 544                         <key>group</key>
 545                         <string>admin</string>
 546                 </dict>
 547                 <key>com.apple.trust-settings.user</key>
 548                 <dict>
 549                         <key>rule</key>
 550                         <string>authenticate-session-owner</string>
 551                         <key>comment</key>
 552                         <string>For modifying per-user Trust Settings.</string>
 553                 </dict>
 554                 <key>system.install.admin.user</key>
 555                 <dict>
 556                         <key>class</key>
 557                         <string>user</string>
 558                         <key>comment</key>
 559                         <string>Checked when user is installing in admin domain (/Applications).</string>
 560                         <key>group</key>
 561                         <string>admin</string>
 562                         <key>shared</key>
 563                         <false/>
 564                         <key>timeout</key>
 565                         <integer>300</integer>
 566                 </dict>
 567                 <key>system.install.root.user</key>
 568                 <dict>
 569                         <key>class</key>
 570                         <string>user</string>
 571                         <key>comment</key>
 572                         <string>Checked when user is installing in root domain (/System).</string>
 573                         <key>group</key>
 574                         <string>admin</string>
 575                         <key>shared</key>
 576                         <false/>
 577                         <key>timeout</key>
 578                         <integer>300</integer>
 579                 </dict>
 580                 <key>system.install.root.admin</key>
 581                 <dict>
 582                         <key>class</key>
 583                         <string>user</string>
 584                         <key>comment</key>
 585                         <string>Checked when admin is installing in root domain (/System).</string>
 586                         <key>group</key>
 587                         <string>admin</string>
 588                         <key>shared</key>
 589                         <false/>
 590                         <key>timeout</key>
 591                         <integer>300</integer>
 592                 </dict>
 593                 <key>com.apple.appserver.privilege.admin</key>
 594                 <dict>
 595                         <key>class</key>
 596                         <string>rule</string>
 597                         <key>comment</key>
 598                         <string>For administrative access to the Application Server management tool.</string>
 599                         <key>rule</key>
 600                         <string>appserver-admin</string>
 601                 </dict>
 602                 <key>com.apple.appserver.privilege.user</key>
 603                 <dict>
 604                         <key>class</key>
 605                         <string>rule</string>
 606                         <key>comment</key>
 607                         <string>For user access to the Application Server management tool.</string>
 608                         <key>k-of-n</key>
 609                         <integer>1</integer>
 610                         <key>rule</key>
 611                         <array>
 612                                 <string>appserver-admin</string>
 613                                 <string>appserver-user</string>
 614                         </array>
 615                 </dict>
 616                 <key>com.apple.dashboard.advisory.allow</key>
 617                 <dict>
 618                         <key>class</key>
 619                         <string>user</string>
 620                         <key>group</key>
 621                         <string>admin</string>
 622                         <key>shared</key>
 623                         <false/>
 624                         <key>timeout</key>
 625                         <integer>300</integer>
 626                 </dict>
 627                 <key>com.apple.desktopservices</key>
 628                 <dict>
 629                         <key>class</key>
 630                         <string>user</string>
 631                         <key>comment</key>
 632                         <string>For privileged file operations from within the Finder.</string>
 633                         <key>group</key>
 634                         <string>admin</string>
 635                         <key>shared</key>
 636                         <false/>
 637                         <key>timeout</key>
 638                         <integer>0</integer>
 639                 </dict>
 640                 <key>com.apple.builtin.generic-new-passphrase</key>
 641                 <dict>
 642                         <key>class</key>
 643                         <string>evaluate-mechanisms</string>
 644                         <key>mechanisms</key>
 645                         <array>
 646                                 <string>builtin:generic-new-passphrase</string>
 647                         </array>
 648                 </dict>
 649                 <key>com.apple.builtin.generic-unlock</key>
 650                 <dict>
 651                         <key>class</key>
 652                         <string>evaluate-mechanisms</string>
 653                         <key>mechanisms</key>
 654                         <array>
 655                                 <string>builtin:generic-unlock</string>
 656                         </array>
 657                 </dict>
 658                 <key>com.apple.builtin.confirm-access</key>
 659                 <dict>
 660                         <key>class</key>
 661                         <string>evaluate-mechanisms</string>
 662                         <key>tries</key>
 663                         <integer>1</integer>
 664                         <key>mechanisms</key>
 665                         <array>
 666                                 <string>builtin:confirm-access</string>
 667                         </array>
 668                 </dict>
 669                 <key>com.apple.builtin.confirm-access-password</key>
 670                 <dict>
 671                         <key>class</key>
 672                         <string>evaluate-mechanisms</string>
 673                         <key>mechanisms</key>
 674                         <array>
 675                                 <string>builtin:confirm-access-password</string>
 676                         </array>
 677                 </dict>
 678                 <key>com.apple.ZFSManager.</key>
 679                 <dict>
 680                         <key>class</key>
 681                         <string>rule</string>
 682                         <key>comment</key>
 683                         <string>Used by zfsmanager to allow access to destructive zfs functions</string>
 684                         <key>k-of-n</key>
 685                         <integer>1</integer>
 686                         <key>rule</key>
 687                         <array>
 688                                 <string>is-root</string>
 689                                 <string>is-admin</string>
 690                                 <string>default</string>
 691                         </array>
 692                         <key>shared</key>
 693                         <true/>
 694                 </dict>
 695         <key>com.apple.ServiceManagement.blesshelper</key>
 696                 <dict>
 697                         <key>comment</key>
 698                         <string>Used by the ServiceManagement framework to add a privileged helper tool to the system launchd.</string>
 699                         <key>class</key>
 700                         <string>rule</string>
 701                         <key>k-of-n</key>
 702                         <integer>1</integer>
 703                         <key>rule</key>
 704                         <array>
 705                                 <string>is-root</string>
 706                                 <string>authenticate-admin-30</string>
 707                         </array>
 708                 </dict>
 709         <key>com.apple.ServiceManagement.daemons.modify</key>
 710                 <dict>
 711                         <key>comment</key>
 712                         <string>Used by the ServiceManagement framework to make changes to the system launchd's set of daemons.</string>
 713                         <key>class</key>
 714                         <string>rule</string>
 715                         <key>k-of-n</key>
 716                         <integer>1</integer>
 717                         <key>rule</key>
 718                         <array>
 719                                 <string>is-root</string>
 720                                 <string>authenticate-admin-30</string>
 721                         </array>
 722                 </dict>
 723                 <key>com.apple.pcastagentconfigd.</key>
 724                 <dict>
 725                         <key>comment</key>
 726                         <string>Wildcard for rights checked by Podcast Producer when making changes to your camera binding.</string>
 727                         <key>class</key>
 728                         <string>user</string>
 729                         <key>group</key>
 730                         <string>admin</string>
 731                         <key>allow-root</key>
 732                         <true/>
 733                         <key>shared</key>
 734                         <false/>
 735                 </dict>
 736         </dict>
 737         <key>rules</key>
 738         <dict>
 739                 <key>allow</key>
 740                 <dict>
 741                         <key>class</key>
 742                         <string>allow</string>
 743                         <key>comment</key>
 744                         <string>Allow anyone.</string>
 745                 </dict>
 746                 <key>authenticate-admin</key>
 747                 <dict>
 748                         <key>class</key>
 749                         <string>user</string>
 750                         <key>comment</key>
 751                         <string>Authenticate as an administrator.</string>
 752                         <key>group</key>
 753                         <string>admin</string>
 754                         <key>shared</key>
 755                         <true/>
 756                         <key>timeout</key>
 757                         <integer>0</integer>
 758                 </dict>
 759                 <key>authenticate-admin-30</key>
 760                 <dict>
 761                         <key>class</key>
 762                         <string>user</string>
 763                         <key>comment</key>
 764                         <string>Like the default rule, but
 765             credentials remain valid for only 30 seconds after they've
 766             been obtained.  An acquired credential is shared by all clients.
 767                         </string>
 768                         <key>group</key>
 769                         <string>admin</string>
 770                         <key>shared</key>
 771                         <true/>
 772                         <key>timeout</key>
 773                         <integer>30</integer>
 774                 </dict>
 775                 <key>authenticate-developer</key>
 776                 <dict>
 777                         <key>class</key>
 778                         <string>user</string>
 779                         <key>comment</key>
 780                         <string>Authenticate as a developer.</string>
 781                         <key>group</key>
 782                         <string>_developer</string>
 783                         <key>shared</key>
 784                         <true/>
 785                         <key>timeout</key>
 786                         <integer>36000</integer>
 787                 </dict>
 788                 <key>authenticate-session-owner</key>
 789                 <dict>
 790                         <key>class</key>
 791                         <string>user</string>
 792                         <key>comment</key>
 793                         <string>Authenticate as the session owner.</string>
 794                         <key>session-owner</key>
 795                         <true/>
 796                 </dict>
 797                 <key>authenticate-session-user</key>
 798                 <dict>
 799                         <key>class</key>
 800                         <string>user</string>
 801                         <key>comment</key>
 802                         <string>Same as authenticate-session-owner.</string>
 803                         <key>session-owner</key>
 804                         <true/>
 805                 </dict>
 806                 <key>authenticate-session-owner-or-admin</key>
 807                 <dict>
 808                         <key>allow-root</key>
 809                         <false/>
 810                         <key>class</key>
 811                         <string>user</string>
 812                         <key>comment</key>
 813                         <string>Authenticate either as the owner or as an administrator.</string>
 814                         <key>group</key>
 815                         <string>admin</string>
 816                         <key>session-owner</key>
 817                         <true/>
 818                         <key>shared</key>
 819                         <false/>
 820                 </dict>
 821                 <key>is-admin</key>
 822                 <dict>
 823                         <key>class</key>
 824                         <string>user</string>
 825                         <key>comment</key>
 826                         <string>Verify that the user asking for authorization is an administrator.</string>
 827                         <key>group</key>
 828                         <string>admin</string>
 829                         <key>authenticate-user</key>
 830                         <false/>
 831                         <key>shared</key>
 832                         <string>true</string>
 833                 </dict>
 834                 <key>is-developer</key>
 835                 <dict>
 836                         <key>class</key>
 837                         <string>user</string>
 838                         <key>comment</key>
 839                         <string>Verify that the user asking for authorization is a developer.</string>
 840                         <key>group</key>
 841                         <string>_developer</string>
 842                         <key>authenticate-user</key>
 843                         <false/>
 844                 </dict>
 845                 <key>is-root</key>
 846                 <dict>
 847                         <key>allow-root</key>
 848                         <true/>
 849                         <key>class</key>
 850                         <string>user</string>
 851                         <key>authenticate-user</key>
 852                         <false/>
 853                         <key>comment</key>
 854                         <string>Verify that the process that created this AuthorizationRef is running as root.</string>
 855                 </dict>
 856                 <key>appserver-user</key>
 857                 <dict>
 858                         <key>class</key>
 859                         <string>user</string>
 860                         <key>group</key>
 861                         <string>appserverusr</string>
 862                 </dict>
 863                 <key>appserver-admin</key>
 864                 <dict>
 865                         <key>class</key>
 866                         <string>user</string>
 867                         <key>group</key>
 868                         <string>appserveradm</string>
 869                 </dict>
 870                 <key>default</key>
 871                 <dict>
 872                         <key>class</key>
 873                         <string>user</string>
 874                         <key>comment</key>
 875                         <string>Default rule.
 876             Credentials remain valid for 5 minutes after they've been obtained.
 877             An acquired credential is shared by all clients.
 878                         </string>
 879                         <key>group</key>
 880                         <string>admin</string>
 881                         <key>shared</key>
 882                         <true/>
 883                         <key>timeout</key>
 884                         <integer>300</integer>
 885                 </dict>
 886                 <key>authenticate</key>
 887                 <dict>
 888                         <key>class</key>
 889                         <string>evaluate-mechanisms</string>
 890                         <key>mechanisms</key>
 891                         <array>
 892                                 <string>builtin:smartcard-sniffer,privileged</string>
 893                                 <string>builtin:authenticate</string>
 894                                 <string>builtin:authenticate,privileged</string>
 895                         </array>
 896                 </dict>
 897         </dict>
 898 </dict>
 899 </plist>