From: Apple Date: Tue, 29 Oct 2013 00:03:36 +0000 (+0000) Subject: securityd-55199.tar.gz X-Git-Tag: v55199^0 X-Git-Url: https://git.saurik.com/apple/securityd.git/commitdiff_plain/a9d7a7012bf470d922aff83afc85bc252a103107 securityd-55199.tar.gz --- diff --git a/config/project.xcconfig b/config/project.xcconfig index 39c7976..1af4d3c 100644 --- a/config/project.xcconfig +++ b/config/project.xcconfig @@ -1,4 +1,4 @@ -ARCHS = $(ARCHS_STANDARD_32_64_BIT) +ARCHS = $(ARCHS_STANDARD_64_BIT) CODE_SIGN_IDENTITY = -; GCC_VERSION = com.apple.compilers.llvm.clang.1_0 DEBUG_INFORMATION_FORMAT = dwarf-with-dsym diff --git a/etc/authmerge.sh b/etc/authmerge.sh deleted file mode 100755 index 621c898..0000000 --- a/etc/authmerge.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/bin/sh -set -e - -MERGE_FILE=authorization.merge -ETC_DIR=${DSTROOT}/private/etc -SRC=${SRCROOT}/etc - -if [ -f ${SRC}/${MERGE_FILE} ]; then - echo "Installing ${MERGE_FILE}..." - mkdir -p ${ETC_DIR} - plutil -lint ${SRC}/${MERGE_FILE} - cp ${SRC}/${MERGE_FILE} ${ETC_DIR}/${MERGE_FILE} -else - echo "file not found: ${SRC}/${MERGE_FILE}" -fi - diff --git a/etc/authorization.merge b/etc/authorization.merge deleted file mode 100644 index a4a3d0a..0000000 --- a/etc/authorization.merge +++ /dev/null @@ -1,146 +0,0 @@ - - - - - rights - - com.apple.container-repair - - class - user - default-button - - ar - تصليح - ca - Reparar - cs - Opravit - da - Reparer - de - Reparieren - el - Επισκευή - en - Repair - es - Reparar - fi - Korjaa - fr - Réparer - he - תקן - hr - Popravi - hu - Javítás - it - Ripara - ja - 修復 - ko - 복구 - nb - Reparer - nl - Herstel - pl - Napraw - pt - Reparar - pt-PT - Reparar - ro - Repară - ru - Исправить - sk - OpraviÅ¥ - sv - Reparera - th - ซ่อมแซม - tr - Onar - uk - Полагодити - zh-Hans - 修复 - zh-Hant - 修復 - - default-prompt - - ar - يحتاج __APPNAME__ إلى إصلاح مكتبتك لتشغيل التطبيات. - ca - __APPNAME__ necessita reparar la vostra biblioteca per poder executar aplicacions. - cs - __APPNAME__ potřebuje opravit vaÅ¡i knihovnu, aby bylo možné spouÅ¡tět aplikace. - da - __APPNAME__ skal reparere dit bibliotek for at kunne afvikle programmer. - de - __APPNAME__ muss Ihre Library reparieren, um Programme auszuführen. - el - Η εφαρμογή «__APPNAME__» πρέπει να επισκευάσει τη Βιβλιοθήκη σας ώστε να εκτελεί εφαρμογές. - en - __APPNAME__ needs to repair your Library to run applications. - es - __APPNAME__ necesita reparar su biblioteca para poder ejecutar aplicaciones. - fi - Kohteen__APPNAME__ pitää korjata kirjastosi, jotta se voi suorittaa ohjelmia. - fr - __APPNAME__ doit réparer votre Bibliothèque pour exécuter les applications. - he - על-מנת שניתן יהיה להפעיל יישומים, על __APPNAME__ לתקן את הספריה שלך. - hr - __APPNAME__ treba popraviti vaÅ¡u medijateku kako bi se mogle pokrenuti aplikacije. - hu - A(z) __APPNAME__ alkalmazásnak ki kell javítania az Ön Könyvtárát az alkalmazások futtatásához. - it - Per poter eseguire applicazioni, __APPNAME__ deve riparare la libreria. - ja - __APPNAME__ は、アプリケーションを実行するためにライブラリを修復する必要があります。 - ko - 응용 프로그램을 실행하려면 __APPNAME__이(가) 사용자의 라이브러리를 복구해야 합니다. - nb - __APPNAME__ mÃ¥ reparere biblioteket ditt for Ã¥ kunne bruke programmer. - nl - __APPNAME__ moet uw Bibliotheek herstellen om programma's te kunnen uitvoeren. - pl - __APPNAME__ musi naprawić bibliotekę, aby móc uruchamiać programy. - pt - __APPNAME__ necessita reparar sua biblioteca para poder executar aplicativos. - pt-PT - __APPNAME__ tem de reparar a Biblioteca antes de poder executar aplicações. - ro - __APPNAME__ trebuie să repare biblioteca dvs. pentru a putea rula aplicații. - ru - Программе «__APPNAME__» необходимо исправить Вашу библиотеку для запуска программ. - sk - __APPNAME__ potrebuje kvôli spúšťaniu aplikácií opraviÅ¥ vaÅ¡u knižniciu. - sv - __APPNAME__ mÃ¥ste reparera ditt bibliotek för att kunna använda program. - th - __APPNAME__ จำเป็นต้องซ่อมแซมคลังของคุณเพื่อสั่งทำงานแอปพลิเคชั่น - tr - Uygulamaları çalıştırmak için Kitaplık klasörünüzün __APPNAME__ tarafından onarılması gerekiyor. - uk - Програмі __APPNAME__ потрібно полагодити вашу папку «Бібліотека», щоб мати змогу запускати програми. - zh-Hans - “__APPNAME__”需要修复您的资源库才能运行应用程序。 - zh-Hant - “__APPNAME__”需要修復您的資料庫來執行應用程式。 - - group - admin - shared - - timeout - 30 - - - - diff --git a/etc/authorization.plist b/etc/authorization.plist deleted file mode 100644 index 091f40f..0000000 --- a/etc/authorization.plist +++ /dev/null @@ -1,9506 +0,0 @@ - - - - - comment - The name of the requested right is matched against the keys. An exact match has priority, otherwise the longest match from the start is used. Note that the right will only match wildcard rules (ending in a ".") during this reduction. - -allow rule: this is always allowed -<key>com.apple.TestApp.benign</key> -<string>allow</string> - -deny rule: this is always denied -<key>com.apple.TestApp.dangerous</key> -<string>deny</string> - -user rule: successful authentication as a user in the specified group(5) allows the associated right. - -The shared property specifies whether a credential generated on success is shared with other apps (i.e., those in the same "session"). This property defaults to false if not specified. - -The timeout property specifies the maximum age of a (cached/shared) credential accepted for this rule. - -The allow-root property specifies whether a right should be allowed automatically if the requesting process is running with uid == 0. This defaults to false if not specified. - -See remaining rules for examples. - - rights - - - - class - rule - comment - Matches otherwise unmatched rights (i.e., is a default). - rule - default - - com.apple. - - rule - default - - com.apple.AOSNotification.FindMyMac.modify - - allow-root - - class - rule - default-button - - ar - السماح - ca - Permetre - cs - Povolit - da - Tillad - de - Erlauben - el - Να επιτρέπεται - en - Allow - es - Permitir - fi - Salli - fr - Autoriser - he - אפשר - hr - Dozvoli - hu - Engedélyezés - it - Consenti - ja - 許可 - ko - 허용 - nb - Tillat - nl - Sta toe - pl - Pozwól - pt - Permitir - pt-PT - Permitir - ro - Permite - ru - Разрешить - sk - PovoliÅ¥ - sv - TillÃ¥t - th - อนุญาต - tr - Ä°zin Ver - uk - Дозволити - zh-Hans - 允许 - zh-Hant - 允許 - - default-prompt - - ar - يرغب __APPNAME__ بعمل تغييرات للعثور على الـ Mac الخاص بي. - ca - __APPNAME__ vol efectuar canvis a “Buscar el meu Mac”. - cs - __APPNAME__ žádá o povolení k provedení změn ve službě Hledat můj Mac. - da - __APPNAME__ vil foretage ændringer i Find min Mac. - de - __APPNAME__ möchte Änderungen an „Meinen Mac suchen“ vornehmen. - el - Η εφαρμογή «__APPNAME__» θέλει να κάνει αλλαγές στην Εύρεση Mac μου. - en - __APPNAME__ wants to make changes to Find My Mac. - es - __APPNAME__ desea realizar cambios en “Buscar mi Mac”. - fi - __APPNAME__ haluaa tehdä muutoksia ohjelmaan Etsi Macini. - fr - __APPNAME__ veut apporter des modifications à Localiser mon Mac. - he - __APPNAME__ מעוניין לערוך שינויים ב״מצא את ה-Mac שלי״. - hr - __APPNAME__ želi promijeniti značajku Nađi moj Mac. - hu - A(z) __APPNAME__ módisításokat akar végezni a Mac keresésében. - it - __APPNAME__ desidera apportare modifiche a “Trova il mio Mac”. - ja - __APPNAME__ は、“Mac を探す”に変更を加えようとしています。 - ko - __APPNAME__이(가) 나의 Mac 찾기를 변경하려고 합니다. - nb - __APPNAME__ vil gjøre endringer i Finn Mac. - nl - __APPNAME__ wil wijzigingen aanbrengen in 'Zoek mijn Mac'. - pl - __APPNAME__ chce dokonać zmian w programie Znajdź mój Mac. - pt - __APPNAME__ deseja fazer alterações em “Buscar Meu Mac”. - pt-PT - O __APPNAME__ pretende fazer alterações a Encontrar o meu Mac. - ro - __APPNAME__ dorește să modifice Găsire Mac propriu. - ru - Программа «__APPNAME__» пытается внести изменения в функцию «Найти Mac». - sk - Aplikácia __APPNAME__ chce vykonaÅ¥ zmeny v NájsÅ¥ môj Mac. - sv - __APPNAME__ vill göra ändringar i Hitta min Mac. - th - __APPNAME__ ต้องการทำการเปลี่ยนแปลงไปยัง ค้นหา Mac ของฉัน - tr - __APPNAME__, Mac’imi Bul’da değişiklik yapmak istiyor. - uk - __APPNAME__ хоче внести зміни до функції «Знайти мій Mac». - zh-Hans - “__APPNAME__”想要对“查找我的 Mac”进行一些修改。 - zh-Hant - “__APPNAME__”想要更改“尋找我的 Mac”。 - - k-of-n - 1 - rule - - is-root - is-admin - default - - - com.apple.DiskManagement. - - class - rule - comment - Used by diskmanagementd to allow access to its privileged functions - default-button - - ar - تعديل القرص - ca - Modificar el disc - cs - Změnit Disk - da - Juster disk - de - Volume ändern - el - Τροποποίηση δίσκου - en - Modify Disk - es - Modificar disco - fi - Muokkaa levyä - fr - Modifier le disque - he - ערוך/י שינויים בכונן - hr - Preinači disk - hu - Lemez módosítása - it - Modifica disco - ja - ディスクを変更 - ko - 디스크 수정 - nb - Endre disk - nl - Wijzig schijf - pl - Modyfikuj dysk - pt - Modificar Disco - pt-PT - Modificar disco - ro - Modifică discul - ru - Модифицировать диск - sk - UpraviÅ¥ disk - sv - Ändra skiva - th - แก้ไขดิสก์ - tr - Diski Değiştir - uk - Змінити диск - zh-Hans - 修改磁盘 - zh-Hant - 修改磁碟 - - default-prompt - - ar - يحاول __APPNAME__ تعديل القرص المحدد. - ca - __APPNAME__ està intentant modificar el disc seleccionat. - cs - __APPNAME__ se pokouší změnit vybraný disk. - da - __APPNAME__ forsøger at ændre den valgte disk. - de - __APPNAME__ versucht, das ausgewählte Volume zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τον επιλεγμένο δίσκο. - en - __APPNAME__ is trying to modify the selected disk. - es - __APPNAME__ está intentando modificar el disco seleccionado. - fi - __APPNAME__ yrittää muokata valittua levyä. - fr - __APPNAME__ essaye de modifier le disque sélectionné. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בכונן הנבחר. - hr - __APPNAME__ pokuÅ¡ava preinačiti odabrani disk. - hu - A(z) __APPNAME__ megpróbálja módosítani a kijelölt lemezt. - it - __APPNAME__ sta cercando di modificare il disco selezionato. - ja - __APPNAME__ は、選択中のディスクを変更しようとしています。 - ko - __APPNAME__이(가) 선택한 디스크를 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre den markerte disken. - nl - __APPNAME__ probeert de geselecteerde schijf te wijzigen. - pl - __APPNAME__ próbuje zmodyfikować zaznaczony dysk. - pt - __APPNAME__ está tentando modificar o disco selecionado. - pt-PT - O __APPNAME__ está a tentar modificar o disco seleccionado. - ro - __APPNAME__ încearcă să modifice discul selectat. - ru - Программа «__APPNAME__» пытается модифицировать выбранный диск. - sk - __APPNAME__ sa pokúša upraviÅ¥ vybraný disk. - sv - __APPNAME__ försöker ändra den markerade skivan. - th - __APPNAME__ กำลังพยายามแก้ไขดิสก์ที่เลือก - tr - __APPNAME__, seçilen diski değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити вибраний диск. - zh-Hans - “__APPNAME__”正试图修改所选磁盘。 - zh-Hant - “__APPNAME__”正在嘗試修改所選磁碟。 - - k-of-n - 1 - rule - - is-root - is-admin - on-console - default - - - com.apple.DiskManagement.internal. - - class - rule - comment - Used by diskmanagementd to allow access to its privileged functions - default-button - - ar - تعديل القرص - ca - Modificar el disc - cs - Změnit Disk - da - Juster disk - de - Volume ändern - el - Τροποποίηση δίσκου - en - Modify Disk - es - Modificar disco - fi - Muokkaa levyä - fr - Modifier le disque - he - ערוך/י שינויים בכונן - hr - Preinači disk - hu - Lemez módosítása - it - Modifica disco - ja - ディスクを変更 - ko - 디스크 수정 - nb - Endre disk - nl - Wijzig schijf - pl - Modyfikuj dysk - pt - Modificar Disco - pt-PT - Modificar o disco - ro - Modifică discul - ru - Модифицировать диск - sk - UpraviÅ¥ disk - sv - Ändra skiva - th - แก้ไขดิสก์ - tr - Diski Değiştir - uk - Змінити диск - zh-Hans - 修改磁盘 - zh-Hant - 修改磁碟 - - default-prompt - - ar - يحاول __APPNAME__ تعديل القرص المحدد. - ca - __APPNAME__ està intentant modificar el disc seleccionat. - cs - __APPNAME__ se pokouší změnit vybraný disk. - da - __APPNAME__ forsøger at ændre den valgte disk. - de - __APPNAME__ versucht, das ausgewählte Volume zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τον επιλεγμένο δίσκο. - en - __APPNAME__ is trying to modify the selected disk. - es - __APPNAME__ está intentando modificar el disco seleccionado. - fi - __APPNAME__ yrittää muokata valittua levyä. - fr - __APPNAME__ essaye de modifier le disque sélectionné. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בכונן הנבחר. - hr - __APPNAME__ pokuÅ¡ava preinačiti odabrani disk. - hu - A(z) __APPNAME__ megpróbálja módosítani a kijelölt lemezt. - it - __APPNAME__ sta cercando di modificare il disco selezionato. - ja - __APPNAME__ は、選択中のディスクを変更しようとしています。 - ko - __APPNAME__이(가) 선택한 디스크를 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre den markerte disken. - nl - __APPNAME__ probeert de geselecteerde schijf te wijzigen. - pl - __APPNAME__ próbuje zmodyfikować zaznaczony dysk. - pt - __APPNAME__ está tentando modificar o disco selecionado. - pt-PT - O __APPNAME__ está a tentar modificar o disco seleccionado. - ro - __APPNAME__ încearcă să modifice discul selectat. - ru - Программа «__APPNAME__» пытается модифицировать выбранный диск. - sk - __APPNAME__ sa pokúša upraviÅ¥ vybraný disk. - sv - __APPNAME__ försöker ändra den markerade skivan. - th - __APPNAME__ กำลังพยายามแก้ไขดิสก์ที่เลือก - tr - __APPNAME__, seçilen diski değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити вибраний диск. - zh-Hans - “__APPNAME__”正试图修改所选磁盘。 - zh-Hant - “__APPNAME__”正在嘗試修改所選磁碟。 - - k-of-n - 1 - rule - - is-root - is-admin - default - - - com.apple.DiskManagement.reserveKEK - - allow-root - - class - user - comment - Used by diskmanagementd to allow use of the reserve KEK. - default-button - - ar - تعديل القرص - ca - Modificar el disc - cs - Změny na disku - da - Rediger disk - de - Volume verändern - el - Τροποποίηση δίσκου - en - Modify Disk - es - Modificar disco - fi - Muokkaa levyä - fr - Modifier le disque - he - ערוך/י שינויים בכונן - hr - Preinači disk - hu - Lemez módosítása - it - Modifica disco - ja - ディスクを変更 - ko - 디스크 수정 - nb - Endre disk - nl - Wijzig schijf - pl - Modyfikuj dysk - pt - Modificar Disco - pt-PT - Modificar disco - ro - Modifică discul - ru - Изменить диск - sk - UpraviÅ¥ disk - sv - Ändra skiva - th - แก้ไขดิสก์ - tr - Diski Değiştir - uk - Змінити диск - zh-Hans - 修改磁盘 - zh-Hant - 修改磁碟 - - default-prompt - - ar - يحاول __APPNAME__ تعديل القرص المشفر. - ca - __APPNAME__ està intentant modificar un disc encriptat. - cs - __APPNAME__ se pokouší provést změny na Å¡ifrovaném disku. - da - __APPNAME__ prøver at redigere en krypteret disk. - de - __APPNAME__ versucht, ein verschlüsseltes Volume zu verändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει έναν κωδικοποιημένο δίσκο. - en - __APPNAME__ is trying to modify an encrypted disk. - es - __APPNAME__ está intentando modificar un disco encriptado. - fi - __APPNAME__ yrittää muokata salattua levyä. - fr - __APPNAME__ essaie de modifier un disque chiffré. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בכונן מוצפן. - hr - __APPNAME__ pokuÅ¡ava preinačiti kriptirani disk. - hu - A(z) __APPNAME__ egy titkosított lemezt próbál módosítani. - it - __APPNAME__ sta tentando di modificare un disco criptato. - ja - __APPNAME__ が暗号化ディスクを変更しようとしています。 - ko - __APPNAME__에서 암호화된 디스크를 수정하려고 시도 중입니다. - nb - __APPNAME__ prøver Ã¥ endre en kryptert disk. - nl - __APPNAME__ probeert een gecodeerde schijf te wijzigen. - pl - __APPNAME__ próbuje zmodyfikować zaszyfrowany dysk. - pt - __APPNAME__ está tentando modificar um disco criptografado. - pt-PT - __APPNAME__ está a tentar modificar um disco cifrado. - ro - __APPNAME__ încearcă să modifice un disc criptat. - ru - __APPNAME__ пытается изменить зашифрованный диск. - sk - __APPNAME__ sa pokúša upraviÅ¥ Å¡ifrovaný disk. - sv - __APPNAME__ försöker ändra en krypterad skiva. - th - __APPNAME__ กำลังพยายามแก้ไขดิสก์ที่เข้ารหัส - tr - __APPNAME__ şifrelenmiş bir diski değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити зашифрований диск. - zh-Hans - “__APPNAME__”正试图修改已加密的磁盘。 - zh-Hant - “__APPNAME__”正在嘗試修改加密的磁碟。 - - group - admin - shared - - - com.apple.KerberosAgent - - class - evaluate-mechanisms - comment - Used to acquire Kerberos credentials. - mechanisms - - KerberosAgent:kerberos-dialog - KerberosAgent:kerberos-authenticate,privileged - - - com.apple.OpenScripting.additions.send - - allow-root - - class - user - comment - Used to send restricted scripting addition commands to processes that require authorization to handle the events. - default-button - - ar - إرسال الأوامر - ca - Enviar ordres - cs - Odeslat příkazy - da - Send kommandoer - de - Befehle senden - el - Αποστολή εντολών - en - Send Commands - es - Enviar comandos - fi - Lähetä komennot - fr - Envoyer des commandes - he - שלח/י פקודות - hr - Å alji naredbe - hu - Parancsok küldése - it - Invia comandi - ja - コマンドを送信 - ko - 명령 보내기 - nb - Send kommandoer - nl - Stuur commando's - pl - Wyślij polecenia - pt - Enviar Comandos - pt-PT - Enviar comandos - ro - Trimite comenzi - ru - Отправить команды - sk - OdoslaÅ¥ príkazy - sv - Skicka kommandon - th - ส่งคำสั่ง - tr - Komutları Gönder - uk - Відправити команди - zh-Hans - 发送命令 - zh-Hant - 傳送指令 - - default-prompt - - ar - يحاول __APPNAME__ إرسال أوامر إضافة برامج نصية محظورة إلى التطبيقات. - ca - __APPNAME__ està provant d’enviar a altres aplicacions ordres d’addició d’scripts restringides. - cs - __APPNAME__ se pokouší odeslat omezené příkazy skriptovacího doplňku jiným aplikacím. - da - __APPNAME__ forsøger at sende begrænsede instrukstilføjelseskommandoer til andre programmer. - de - __APPNAME__ versucht, Befehle für beschränkte Scripting Additions an andere Programme zu senden. - el - Η εφαρμογή __APPNAME__ προσπαθεί να στείλει περιορισμένες εντολές προσθήκης σεναρίων σε άλλες εφαρμογές. - en - __APPNAME__ is trying to send restricted scripting addition commands to other applications. - es - __APPNAME__ está intentando enviar comandos de adición de scripts restringidos a otras aplicaciones. - fi - __APPNAME__ yrittää lähettää rajoitettuja komentosarjalisäyskomentoja muille ohjelmille. - fr - __APPNAME__ essaye d’envoyer des commandes restreintes de compléments de pilotage vers d’autres applications. - he - ×´ __APPNAME__×´ מבקש לשלוח פקודות תוספת הסרטה מוגבלות ליישומים אחרים. - hr - __APPNAME__ pokuÅ¡ava poslati ograničene naredbe skripe drugim aplikacijama. - hu - A(z) __APPNAME__ megpróbál szkripthozzáadási parancsokat küldeni más alkalmazásoknak. - it - __APPNAME__ sta cercando di inviare alle applicazioni comandi con restrizioni per estensioni AppleScript. - ja - __APPNAME__ は、制限付きスクリプティングの追加コマンドをほかのアプリケーションに送信しようとしています。 - ko - __APPNAME__이(가) 다른 응용 프로그램으로 제한된 스크립팅 추가 명령을 보내려고 합니다. - nb - __APPNAME__ prøver Ã¥ sende begrensede prosedyretilleggkommandoer til andre programmer. - nl - __APPNAME__ probeert beperkte script-extracommando's naar andere programma's te sturen. - pl - __APPNAME__ próbuje wysłać zastrzeżone skryptowe polecenia dodania do innych programów. - pt - __APPNAME__ está tentando enviar comandos restringidos de adição de roteiros para outros aplicativos. - pt-PT - O __APPNAME__ está tentar enviar comandos restritos de adição a outras aplicações. - ro - __APPNAME__ încearcă să trimită comenzi de suplimente de scriptare restricționate către alte aplicații. - ru - Программа «__APPNAME__» пытается отправить команды дополнения к скрипту в другие программы. - sk - __APPNAME__ sa pokúša odoslaÅ¥ iným aplikáciám obmedzené príkazy skriptovacích dodatkov. - sv - __APPNAME__ försöker skicka begränsade skripttilläggkommandon till andra program. - th - __APPNAME__ กำลังพยายามส่งคำสั่งเพิ่มเติมที่ถูกจำกัดการเขียนสคริปต์ - tr - __APPNAME__, diğer uygulamalara sınırlı betik yazma eki komutları göndermeye çalışıyor. - uk - Програма «__APPNAME__» намагається відправити іншим програмам обмежені команди додатків скриптування. - zh-Hans - “__APPNAME__”正试图给其他应用程序发送受限制的脚本添加命令。 - zh-Hant - “__APPNAME__”正在嘗試將受限的工序指令附加程式的指令傳送到其他應用程式。 - - group - admin - - com.apple.Safari.parental-controls - - allow-root - - class - rule - comment - Checked when changing parental controls for Safari. - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י שינויים - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าติดตั้ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل إعدادات الإشراف العائلي لـ Safari. - ca - __APPNAME__ està intentant modificar la configuració dels controls parentals de Safari. - cs - __APPNAME__ se pokouší změnit nastavení Rodičovského dohledu pro Safari. - da - __APPNAME__ forsøger at ændre indstillingerne til børnesikring i Safari. - de - __APPNAME__ versucht, die Einstellungen für die Kindersicherheit in Safari zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις ρυθμίσεις του Γονικού ελέγχου για το Safari. - en - __APPNAME__ is trying to modify the Parental Controls settings for Safari. - es - __APPNAME__ está intentando modificar los ajustes de los controles parentales de Safari. - fi - __APPNAME__ yrittää muokata Safarin käyttörajoitusten asetuksia. - fr - __APPNAME__ essaye de modifier les réglages du contrôle parental de Safari. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בהגדרות כלי הבקרה להורים עבור Safari. - hr - __APPNAME__ pokuÅ¡ava preinačiti postavke roditeljskih kontrola za Safari. - hu - A(z) __APPNAME__ megpróbálja módosítani a Safari szülői felügyeleti beállításait. - it - __APPNAME__ sta cercando di modificare le impostazioni dei controlli censura di Safari. - ja - __APPNAME__ は、Safari の“ペアレンタルコントロール”環境設定を変更しようとしています。 - ko - __APPNAME__이(가) Safari에 대한 유해 콘텐츠 차단 설정을 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre foreldrekontrollinnstillingene for Safari. - nl - __APPNAME__ probeert de instellingen voor ouderlijk toezicht van Safari te wijzigen. - pl - __APPNAME__ próbuje zmienić ustawienia Nadzoru rodzicielskiego dla Safari. - pt - __APPNAME__ está tentando modificar os ajustes dos Controles Parentais para o Safari. - pt-PT - O __APPNAME__ está a tentar modificar as definições do Controlo Parental do Safari. - ro - __APPNAME__ încearcă să schimbe configurările de control parental pentru Safari. - ru - Программа «__APPNAME__» пытается модифицировать настройки Родительского контроля в Safari. - sk - __APPNAME__ sa pokúša upraviÅ¥ nastavenia rodičovskej ochrany v Safari. - sv - __APPNAME__ försöker ändra Föräldrakontrolls inställningar för Safari. - th - __APPNAME__ กำลังพยายามแก้ไขค่าติดตั้งการควบคุมโดยผู้ปกครองสำหรับ Safari - tr - __APPNAME__, Safari için Ebeveyn Denetimi ayarlarını değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри Батьківського контролю для Safari. - zh-Hans - “__APPNAME__”正试图修改 Safari的“家长控制”设置。 - zh-Hant - “__APPNAME__”正在嘗試修改 Safari 的“分級保護控制”設定。 - - k-of-n - 1 - rule - - is-admin - authenticate-admin - - shared - - timeout - 60 - - com.apple.Safari.show-passwords - - class - user - comment - This right is used by Safari to show passwords - default-prompt - - ar - يحاول __APPNAME__ إظهار كلمات السر. - ca - __APPNAME__ està intentant mostrar les contrasenyes. - cs - __APPNAME__ se pokouší zobrazit hesla. - da - __APPNAME__ prøver at vise adgangskoder. - de - __APPNAME__ versucht, Kennwörter einzublenden. - el - Η εφαρμογή «__APPNAME__» προσπαθεί να εμφανίσει συνθηματικά. - en - __APPNAME__ is trying to show passwords. - es - __APPNAME__ está intentando mostrar las contraseñas. - fi - __APPNAME__ yrittää näyttää salasanat. - fr - __APPNAME__ essaye d’afficher les mots de passe. - he - __APPNAME__ מנסה להציג סיסמאות. - hr - __APPNAME__ pokuÅ¡ava prikazati lozinke. - hu - A(z) __APPNAME__ megpróbálja megjeleníteni a jelszavakat. - it - __APPNAME__ tenta di mostrare le password. - ja - __APPNAME__ は、パスワードを表示しようとしています。 - ko - __APPNAME__이(가) 암호를 보려고 합니다. - nb - __APPNAME__ prøver Ã¥ vise passord. - nl - __APPNAME__ probeert wachtwoorden te tonen. - pl - __APPNAME__ próbuje pokazać hasła. - pt - __APPNAME__ está tentando mostrar senhas. - pt-PT - O __APPNAME__ está a tentar mostrar palavras‑passe. - ro - __APPNAME__ încearcă să afișeze parole. - ru - Программа «__APPNAME__» пытается показать пароли. - sk - Aplikácia __APPNAME__ sa pokúša zobraziÅ¥ heslá. - sv - __APPNAME__ försöker visa lösenord. - th - __APPNAME__ กำลังพยายามแสดงรหัสผ่าน - tr - __APPNAME__ parolaları göstermeye çalışıyor. - uk - __APPNAME__ намагається показати паролі. - zh-Hans - “__APPNAME__” 正在尝试显示密码。 - zh-Hant - “__APPNAME__” 正在嘗試顯示密碼。 - - session-owner - - shared - - timeout - 10 - - com.apple.ServiceManagement.blesshelper - - class - rule - comment - Used by the ServiceManagement framework to add a privileged helper tool to the system launchd. - default-button - - ar - تثبيت المساعد - ca - Instal·lar l’assistent - cs - Instalovat nástroj - da - Installer hjælpeprogram - de - Hilfsprogramm installieren - el - Εγκατάσταση του Βοηθού - en - Install Helper - es - Instalar asistente - fi - Asenna avustaja - fr - Installer l’utilitaire - he - התקן/י את כלי העזר - hr - Instaliraj pomoćnika - hu - Segédeszköz telepítése - it - Installa Helper - ja - ヘルパーをインストール - ko - ë³´ì¡° 응용 프로그램 설치 - nb - Installer hjelper - nl - Installeer Helper - pl - Zainstaluj narzędzie pomocnicze - pt - Instalar Auxiliar - pt-PT - Instalar Ferramenta de Ajuda - ro - Instalează ajutătorul - ru - Установить Helper - sk - InÅ¡talovaÅ¥ pomocníka - sv - Installera hjälpprogram - th - ตัวช่วยการติดตั้ง - tr - Yardımcıyı Yükle - uk - Інсталювати інструмент - zh-Hans - 安装帮助程序 - zh-Hant - 安裝輔助程式 - - default-prompt - - ar - يحاول __APPNAME__ تثبيت أداة مساعد جديدة. - ca - __APPNAME__ està intentant instal·lar una nova eina de l’assistent. - cs - __APPNAME__ se pokouší nainstalovat nový pomocný nástroj. - da - __APPNAME__ forsøger at installere et nyt hjælpeværktøj. - de - __APPNAME__ versucht, ein neues Hilfsprogramm zu installieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να εγκαταστήσει ένα νέο εργαλείο βοηθού. - en - __APPNAME__ is trying to install a new helper tool. - es - __APPNAME__ está intentando instalar una herramienta asociada. - fi - __APPNAME__ yrittää asentaa uutta avustajatyökalua. - fr - __APPNAME__ essaye d’installer un nouvel utilitaire. - he - ×´ __APPNAME__×´ מבקש להתקין כלי עזר חדש. - hr - __APPNAME__ pokuÅ¡ava instalirati novi pomoćni alat. - hu - A(z) __APPNAME__ megpróbál telepíteni egy új segédeszközt. - it - __APPNAME__ sta cercando di installare un nuovo Helper. - ja - __APPNAME__ は、新しいヘルパーツールをインストールしようとしています。 - ko - __APPNAME__이(가) 새로운 ë³´ì¡° 도구를 설치하려고 합니다. - nb - __APPNAME__ prøver Ã¥ installere et nytt hjelpeverktøy. - nl - __APPNAME__ probeert een nieuwe helpertool te installeren. - pl - __APPNAME__ próbuje zainstalować nowe narzędzie pomocnicze. - pt - __APPNAME__ está tentando instalar uma nova ferramenta auxiliar. - pt-PT - O __APPNAME__ está a tentar instalar uma nova ferramenta de ajuda. - ro - __APPNAME__ încearcă să instaleze un nou instrument ajutător. - ru - Программа «__APPNAME__» пытается установить новый инструмент справки. - sk - __APPNAME__ sa pokúša inÅ¡talovaÅ¥ nový nástroj pomocníka. - sv - __APPNAME__ försöker installera ett nytt hjälpverktyg. - th - __APPNAME__ กำลังพยายามติดตั้งเครื่องมือช่วยเหลือใหม่ - tr - __APPNAME__, yeni bir yardımcı araç yüklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається інсталювати новий допоміжний інструмент. - zh-Hans - “__APPNAME__”正试图安装新的帮助程序工具。 - zh-Hant - “__APPNAME__”正在嘗試安裝新的輔助工具。 - - k-of-n - 1 - rule - - is-root - authenticate-admin-30 - - - com.apple.ServiceManagement.daemons.modify - - class - rule - comment - Used by the ServiceManagement framework to make changes to the system launchd's set of daemons. - default-button - - ar - إضافة مساعد - ca - Afegir l’assistent - cs - Přidat nástroj - da - Tilføj hjælpeprogram - de - Hilfsprogramm hinzufügen - el - Προσθήκη του Βοηθού - en - Add Helper - es - Añadir asistente - fi - Lisää avustaja - fr - Ajouter l’utilitaire - he - הוסף/י את כלי העזר - hr - Dodaj pomoćnika - hu - Segédeszköz hozzáadása - it - Aggiungi Helper - ja - ヘルパーを追加 - ko - ë³´ì¡° 응용 프로그램 추가 - nb - Legg til hjelper - nl - Voeg Helper toe - pl - Dodaj narzędzie pomocnicze - pt - Adicionar Auxiliar - pt-PT - Adicionar Ferramenta de Ajuda - ro - Adaugă ajutătorul - ru - Добавить Helper - sk - PridaÅ¥ pomocníka - sv - Lägg till hjälpprogram - th - เพิ่มเครื่องมือช่วยเหลือ - tr - Yardımcı Ekle - uk - Додати інструмент - zh-Hans - 添加帮助程序 - zh-Hant - 加入輔助程式 - - default-prompt - - ar - يحاول __APPNAME__ إضافة أداة مساعد جديدة. - ca - __APPNAME__ està provant d’afegir una nova eina de l’assistent. - cs - __APPNAME__ se pokouší přidat nový pomocný nástroj. - da - __APPNAME__ forsøger at tilføje et nyt hjælpeværktøj. - de - __APPNAME__ versucht, ein neues Hilfsprogramm hinzufügen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να προσθέσει ένα νέο εργαλείο βοηθού. - en - __APPNAME__ is trying to add a new helper tool. - es - __APPNAME__ está intentando añadir una herramienta asociada. - fi - __APPNAME__ yrittää lisätä uuden avustajatyökalun. - fr - __APPNAME__ essaye d’ajouter un nouvel utilitaire. - he - ×´ __APPNAME__×´ מבקש להוסיף כלי עזר חדש. - hr - __APPNAME__ pokuÅ¡ava dodati novi pomoćni alat. - hu - A(z) __APPNAME__ megpróbál hozzáadni egy új segédeszközt. - it - __APPNAME__ sta cercando di aggiungere un nuovo Helper. - ja - __APPNAME__ は、新しいヘルパーツールを追加しようとしています。 - ko - __APPNAME__이(가) 새로운 ë³´ì¡° 도구를 추가하려고 합니다. - nb - __APPNAME__ prøver Ã¥ legge til et nytt hjelpeverktøy. - nl - __APPNAME__ probeert een nieuwe helpertool toe te voegen. - pl - __APPNAME__ próbuje dodać nowe narzędzie pomocnicze. - pt - __APPNAME__ está tentando adicionar uma nova ferramenta auxiliar. - pt-PT - O __APPNAME__ está a tentar adicionar uma nova ferramenta de ajuda. - ro - __APPNAME__ încearcă să adauge un nou instrument ajutător. - ru - Программа «__APPNAME__» пытается добавить новый инструмент справки. - sk - __APPNAME__ sa pokúša pridaÅ¥ nový nástroj pomocníka. - sv - __APPNAME__ försöker lägga till ett nytt hjälpverktyg. - th - __APPNAME__ กำลังพยายามเพิ่มเครื่องมือช่วยเหลือใหม่ - tr - __APPNAME__, yeni bir yardımcı araç eklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається додати новий допоміжний інструмент. - zh-Hans - “__APPNAME__”正试图添加一个新的帮助程序工具。 - zh-Hant - “__APPNAME__”正在嘗試加入新的輔助工具。 - - k-of-n - 1 - rule - - is-root - entitled-admin-or-authenticate-admin - - - com.apple.SoftwareUpdate.modify-settings - - class - rule - comment - Checked by the Admin framework when making changes to the Software Update preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فتح قفل تفضيلات محدث البرامج. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Actualització de Programari. - cs - __APPNAME__ se pokouší odemknout předvolby Aktualizace softwaru. - da - __APPNAME__ prøver at lÃ¥se vinduet Softwareopdatering op. - de - __APPNAME__ versucht, die Systemeinstellung „Softwareaktualisierung“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις ενημέρωσης λογισμικού. - en - __APPNAME__ is trying to unlock the Software Update preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Actualización de Software. - fi - __APPNAME__ yrittää avata Ohjelmiston päivitys -asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Mise à jour de logiciels. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״עדכוני תוכנה״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Ažuriranje softvera. - hu - A(z) __APPNAME__ megpróbálja feloldani a szoftverfrissítés beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze di Aggiornamento Software. - ja - __APPNAME__ が“ソフトウェア・アップデート”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 소프트웨어 업데이트 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Programvareoppdatering-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Software-update' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje uaktualnień programów. - pt - __APPNAME__ está tentando desbloquear as preferências Atualização de Software. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Actualização de Software. - ro - __APPNAME__ încearcă să deblocheze preferințele Actualizare software. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели «Обновление программ». - sk - __APPNAME__ sa pokúša odomknúť nastavenia aktualizácie softvéru. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Programuppdatering. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งการอัปเดตซอฟต์แวร์ - tr - __APPNAME__, Yazılım Güncelleme tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Оновлення системи. - zh-Hans - “__APPNAME__”正试图解锁“软件更新”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“軟體更新”偏好設定。 - - rule - root-or-entitled-admin-or-app-specific-admin - - com.apple.SoftwareUpdate.scan - - class - rule - comment - Checked when user is updating software. - default-button - - ar - تحقق - ca - Comprovar - cs - Ověřit - da - Søg - de - Überprüfen - el - Έλεγχος - en - Check - es - Comprobar - fi - Tarkista - fr - Rechercher - he - בדוק - hr - Potraži - hu - Ellenőrzés - it - Verifica - ja - 確認 - ko - 확인 - nb - Søk - nl - Markeer - pl - Sprawdź - pt - Verificar - pt-PT - Procurar - ro - Verifică disponibilitatea - ru - Проверить - sk - VyhľadaÅ¥ - sv - Kontrollera - th - ตรวจสอบ - tr - Denetle - uk - Перевірити - zh-Hans - 检查 - zh-Hant - 檢查 - - default-prompt - - ar - يحاول __APPNAME__ التحقق من برنامج جديد موّفَر من Apple. - ca - __APPNAME__ està intentant comprovar si hi ha programari nou subministrat per Apple. - cs - __APPNAME__ se pokouší ověřit dostupnost nového softwaru poskytovaného společností Apple. - da - __APPNAME__ prøver at søge efter ny software leveret af Apple. - de - __APPNAME__ versucht, neue von Apple bereitgestellte Software zu finden. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ελέγξει για νέο λογισμικό που παρέχεται από την Apple. - en - __APPNAME__ is trying to check for new Apple-provided software. - es - __APPNAME__ está intentando comprobar si hay software nuevo proporcionado por Apple. - fi - __APPNAME__ yrittää tarkistaa, onko uutta Applen ohjelmistoa saatavilla. - fr - __APPNAME__ essaie de rechercher des nouveaux logiciels fournis par Apple. - he - ×´ __APPNAME__×´ מבקש לחפש תוכנות חדשות מבית Apple. - hr - __APPNAME__ pokuÅ¡ava potražiti novi Apple softver. - hu - A(z) __APPNAME__ megpróbál ellenőrizni egy új, Apple által szolgáltatott szoftvert. - it - __APPNAME__ sta tentando di verificare se è disponibile nuovo software fornito da Apple. - ja - __APPNAME__ は、Apple 提供の新規ソフトウェアを確認しようとしています。 - ko - __APPNAME__이(가) Apple에서 제공한 새로운 소프트웨어를 확인하려고 합니다. - nb - __APPNAME__ prøver Ã¥ søke etter ny programvare som er levert av Apple. - nl - __APPNAME__ probeert te zoeken naar nieuwe van Apple afkomstige software. - pl - __APPNAME__ próbuje sprawdzić dostępność oprogramowania udostępnionego przez Apple. - pt - __APPNAME__ está tentando buscar novos softwares fornecidos pela Apple. - pt-PT - __APPNAME__ está a tentar procurar novo software da Apple. - ro - __APPNAME__ încearcă să verifice disponibilitatea de software nou furnizat de Apple. - ru - __APPNAME__ пытается проверить наличие нового ПО, предоставленного компанией Apple. - sk - __APPNAME__ sa pokúša vyhľadaÅ¥ nový softvér spoločnosti Apple. - sv - __APPNAME__ försöker kontrollera om ny programvara frÃ¥n Apple finns tillgänglig. - th - __APPNAME__ กำลังพยายามตรวจสอบซอฟต์แวร์ใหม่ที่ให้มาโดย Apple - tr - __APPNAME__, Apple tarafından sağlanan yeni yazılım olup olmadığını denetlemeye çalışıyor. - uk - Програма «__APPNAME__» намагаєтсья перевірити наявність нового програмного забезпечення Apple. - zh-Hans - __APPNAME__ 正在尝试检查是否存在新的 Apple 提供的软件。 - zh-Hant - __APPNAME__ 正在嘗試檢查 Apple 提供的新軟體。 - - rule - root-or-entitled-admin-or-authenticate-admin - - com.apple.XType.fontmover.install - - allow-root - - class - user - default-button - - ar - تثبيت - ca - Instal·lar - cs - Instalovat - da - Installer - de - Installieren - el - Εγκατάσταση - en - Install - es - Instalar - fi - Asenna - fr - Install - he - התקן - hr - Instaliraj - hu - Telepítés - it - Installa - ja - インストール - ko - 설치 - nb - Installer - nl - Installeer - pl - Instaluj - pt - Instalar - pt-PT - Instalar - pt_PT - Instalar - ro - Instalează - ru - Установить - sk - InÅ¡talovaÅ¥ - sv - Installera - th - ติดตั้ง - tr - Yükle - uk - Інсталювати - zh-Hans - 安装 - zh-Hant - 安裝 - zh_CN - 安装 - zh_TW - 安裝 - - default-prompt - - ar - يحاول __APPNAME__ تثبيت خطوط النظام الجديدة. - ca - __APPNAME__ està intentant instal·lar tipus de lletra del sistema nous. - cs - __APPNAME__ se pokouší nainstalovat nová systémová písma. - da - __APPNAME__ prøver at installere nye systemskrifter. - de - __APPNAME__ versucht neue Systemschriften zu installieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να εγκαταστήσει νέες γραμματοσειρές συστήματος. - en - __APPNAME__ is trying to install new system fonts. - es - __APPNAME__ está intentando instalar nuevos tipos de letra del sistema. - fi - __APPNAME__ yrittää asentaa uusia järjestelmäfontteja. - fr - __APPNAME__ essaie d’installer de nouvelles polices système. - he - ×´ __APPNAME__×´ מבקש להתקין גופני מערכת חדשים. - hr - __APPNAME__ pokuÅ¡ava instalirati nove fontove sustava. - hu - A(z) __APPNAME__ megpróbál új rendszer-betűtípust telepíteni. - it - __APPNAME__ sta tentando di installare nuovi font di sistema. - ja - __APPNAME__ は、新規システムフォントをインストールしようとしています。 - ko - __APPNAME__에서 새로운 시스템 서체를 설치하려고 합니다. - nb - __APPNAME__ prøver Ã¥ installere nye systemfonter. - nl - __APPNAME__ probeert nieuwe systeemlettertypen te installeren. - pl - __APPNAME__ próbuje zainstalować nowe czcionki systemowe. - pt - __APPNAME__ está tentando instalar novas fontes do sistema. - pt-PT - __APPNAME__ está a tentar instalar novos tipos de letra do sistema. - pt_PT - __APPNAME__ está a tentar instalar novos tipos de letra do sistema. - ro - __APPNAME__ încearcă să instaleze noi fonturi de sistem. - ru - Программа «__APPNAME__» пытается установить новые системные шрифты. - sk - __APPNAME__ sa pokúša inÅ¡talovaÅ¥ nové systémové písma. - sv - __APPNAME__ försöker installera nya systemtypsnitt. - th - __APPNAME__ กำลังพยายามติดตั้งแบบอักษรของระบบใหม่ - tr - __APPNAME__, yeni sistem fontları yüklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається інсталювати нові системні шрифти. - zh-Hans - “__APPNAME__”正试图安装新的系统字体。 - zh-Hant - “__APPNAME__”正在嘗試安裝新的系統字體。 - zh_CN - “__APPNAME__”正试图安装新的系统字体。 - zh_TW - “__APPNAME__”正在嘗試安裝新的系統字體。 - - group - admin - shared - - timeout - 300 - - com.apple.XType.fontmover.remove - - allow-root - - class - user - default-button - - ar - إزالة - ca - Eliminar - cs - Odstranit - da - Fjern - de - Fjern - el - Αφαίρεση - en - Remove - es - Eliminar - fi - Poista - fr - Remove - he - הסר/י - hr - Ukloni - hu - Eltávolítás - it - Rimuovi - ja - 取り除く - ko - 제거 - nb - Fjern - nl - Verwijder - pl - Usuń - pt - Remover - pt-PT - Remover - pt_PT - Remover - ro - Elimină - ru - Удалить - sk - OdstrániÅ¥ - sv - Ta bort - th - ลบ - tr - Sil - uk - Видалити - zh-Hans - 移除 - zh-Hant - 移除 - zh_CN - 移除 - zh_TW - 移除 - - default-prompt - - ar - يحاول __APPNAME__ إزالة خطوط النظام الموجودة. - ca - __APPNAME__ està intentant eliminar tipus de lleta del sistema existents. - cs - __APPNAME__ se pokouší odstranit existující systémová písma. - da - __APPNAME__ prøver at fjerne eksisterende systemskrifter. - de - __APPNAME__ versucht vorhandene Systemschriften zu entfernen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να αφαιρέσει υπάρχουσες γραμματοσειρές συστήματος. - en - __APPNAME__ is trying to remove existing system fonts. - es - __APPNAME__ está intentando eliminar tipos de letra del sistema. - fi - __APPNAME__ yrittää poistaa nykyistä järjestelmäfonttia. - fr - __APPNAME__ essaie de supprimer des polices système par défaut. - he - ×´ __APPNAME__×´ מבקש להסיר גופני מערכת קיימים. - hr - __APPNAME__ pokuÅ¡ava ukloniti postojeće fontove sustava. - hu - A(z) __APPNAME__ megpróbál eltávolítani egy meglévő rendszer-betűtípust. - it - __APPNAME__ sta tentando di rimuovere i font di un sistema esistente. - ja - __APPNAME__ は、既存のシステムフォントを取り除こうとしています。 - ko - __APPNAME__에서 기존의 시스템 서체를 제거하려고 합니다. - nb - __APPNAME__ prøver Ã¥ fjerne eksisterende systemfonter. - nl - __APPNAME__ probeert bestaande systeemlettertypen te verwijderen. - pl - __APPNAME__ próbuje usunąć istniejące czcionki systemowe. - pt - __APPNAME__ está tentando remover fontes existentes do sistema. - pt-PT - __APPNAME__ está a tentar remover tipos de letra do sistema. - pt_PT - __APPNAME__ está a tentar remover tipos de letra do sistema. - ro - __APPNAME__ încearcă să elimine fonturi de sistem existente. - ru - Программа «__APPNAME__» пытается удалить имеющиеся системные шрифты. - sk - __APPNAME__ sa pokúša odstrániÅ¥ existujúce systémové písma. - sv - __APPNAME__ försöker ta bort befintliga systemtypsnitt. - th - __APPNAME__ กำลังพยายามลบแบบอักษรของระบบที่มีอยู่แล้ว - tr - __APPNAME__, var olan sistem fontlarını silmeye çalışıyor. - uk - Програма «__APPNAME__» намагається видалити наявні системні шрифти. - zh-Hans - “__APPNAME__”正试图移除现有的系统字体。 - zh-Hant - “__APPNAME__”正在嘗試移除現有的系統字體。 - zh_CN - “__APPNAME__”正试图移除现有的系统字体。 - zh_TW - “__APPNAME__”正在嘗試移除現有的系統字體。 - - group - admin - shared - - timeout - 300 - - com.apple.XType.fontmover.restore - - class - rule - default-button - - ar - استعادة - ca - Restaurar - cs - Obnovit - da - Gendan - de - Wiederherstellen - el - Επαναφορά - en - Restore - es - Restaurar - fi - Palauta - fr - Restore - he - שחזר/י - hr - Obnovi - hu - Visszaállítás - it - Ripristina - ja - 復元 - ko - 복원 - nb - Gjenopprett - nl - Zet terug - pl - Przywróć - pt - Restaurar - pt-PT - Restaurar - pt_PT - Restaurar - ro - Restaurează - ru - Восстановить - sk - ObnoviÅ¥ - sv - Återskapa - th - กู้คืน - tr - Geri Yükle - uk - Відновити - zh-Hans - 恢复 - zh-Hant - 回復 - zh_CN - 恢复 - zh_TW - 回復 - - default-prompt - - ar - يحاول __APPNAME__ استعادة خطوط النظام الافتراضية. - ca - __APPNAME__ està intentant restaurar els tipus de lletra del sistema per omissió. - cs - __APPNAME__ se pokouší obnovit výchozí systémová písma. - da - __APPNAME__ prøver at gendanne standard systemskrifter. - de - __APPNAME__ versucht die Standard-Systemschriften wiederherzustellen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να επαναφέρει τις προεπιλεγμένες γραμματοσειρές συστήματος. - en - __APPNAME__ is trying to restore the default system fonts. - es - __APPNAME__ está intentando restaurar los tipos de letra por omisión del sistema. - fi - __APPNAME__ yrittää palauttaa järjestelmän oletusfontteja. - fr - __APPNAME__ essaie de restaurer les polices système par défaut. - he - ×´ __APPNAME__×´ מבקש לשחזר את גופני המערכת המקוריים. - hr - __APPNAME__ pokuÅ¡ava obnoviti standardne fontove sustava. - hu - A(z) __APPNAME__ megpróbálja visszaállítani az alapértelmezett rendszer-betűtípust. - it - __APPNAME__ sta tentando di ripristinare i font di default del sistema. - ja - __APPNAME__ は、デフォルトのシステムフォントを復元しようとしてします。 - ko - __APPNAME__에서 기본 시스템 서체를 복원하려고 합니다. - nb - __APPNAME__ prøver Ã¥ gjenopprette standard systemfonter. - nl - __APPNAME__ probeert de standaardsysteemlettertypen terug te zetten. - pl - __APPNAME__ próbuje przywrócić domyślne czcionki systemowe. - pt - __APPNAME__ está tentando restaurar as fontes padrão do sistema. - pt-PT - __APPNAME__ está a tentar restaurar os tipos de letra predefinidos do sistema. - pt_PT - __APPNAME__ está a tentar restaurar os tipos de letra predefinidos do sistema. - ro - __APPNAME__ încearcă să restaureze fonturile de sistem implicite. - ru - Программа «__APPNAME__» пытается восстановить стандартные системные шрифты. - sk - __APPNAME__ sa pokúša obnoviÅ¥ pôvodné systémové písma. - sv - __APPNAME__ försöker Ã¥terskapa de förvalda systemtypsnitten. - th - __APPNAME__ กำลังพยายามกู้คืนแบบอักษรเริ่มต้นของระบบ - tr - __APPNAME__, saptanmış sistem fontlarını geri yüklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається відновити початкові системні шрифти. - zh-Hans - “__APPNAME__”正试图恢复默认的系统字体。 - zh-Hant - “__APPNAME__”正在嘗試回復預設的系統字體。 - zh_CN - “__APPNAME__”正试图恢复默认的系统字体。 - zh_TW - “__APPNAME__”正在嘗試回復預設的系統字體。 - - rule - root-or-entitled-admin-or-authenticate-admin - - com.apple.ZFSManager. - - class - rule - comment - Used by zfsmanager to allow access to destructive zfs functions - k-of-n - 1 - rule - - is-root - is-admin - default - - shared - - - com.apple.activitymonitor.kill - - class - rule - comment - Used by Activity Monitor to authorize killing processes not owned by the user. - default-button - - ar - إنهاء العملية - ca - Sortir del procés - cs - Ukončit proces - da - Slut proces - de - Vorgang beenden - el - Τερματισμός διεργασίας - en - Quit Process - es - Salir del proceso - fi - Lopeta prosessi - fr - Quitter l’opération - he - סיים/י את התהליך - hr - Zaustavi proces - hu - Folyamat bezárása - it - Esci dal processo - ja - プロセスを終了 - ko - 프로세스 종료 - nb - Avslutt prosess - nl - Stop proces - pl - Zakończ proces - pt - Encerrar Processo - pt-PT - Sair do processo - ro - Termină procesul - ru - Завершить процесс - sk - UkončiÅ¥ proces - sv - Avsluta process - th - หยุดการดำเนินการ - tr - İşlemden Çık - uk - Завершити процес - zh-Hans - 退出进程 - zh-Hant - 結束程序 - - default-prompt - - ar - يحاول __APPNAME__ إنهاء العملية المحددة. - ca - __APPNAME__ està intentant sortir del procés seleccionat. - cs - __APPNAME__ se pokouší ukončit vybraný proces. - da - __APPNAME__ forsøger at afslutte den valgte proces. - de - __APPNAME__ versucht, den ausgewählten Vorgang zu beenden. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τερματίσει την επιλεγμένη διεργασία. - en - __APPNAME__ is trying to quit the selected process. - es - __APPNAME__ está intentando salir del proceso seleccionado. - fi - __APPNAME__ yrittää lopettaa valittua prosessia. - fr - __APPNAME__ essaye de quitter le processus sélectionné. - he - ×´ __APPNAME__×´ מבקש לסיים התהליך הנבחר. - hr - __APPNAME__ pokuÅ¡ava zaustaviti označeni proces. - hu - A(z) __APPNAME__ megpróbál kilépni a kijelölt folyamatból. - it - __APPNAME__ sta cercando di uscire dal processo selezionato. - ja - __APPNAME__ は、選択中のプロセスを終了しようとしています。 - ko - __APPNAME__이(가) 선택한 프로세스를 종료하려고 합니다. - nb - __APPNAME__ prøver Ã¥ avslutte den markerte prosessen. - nl - __APPNAME__ probeert het geselecteerde proces te stoppen. - pl - __APPNAME__ próbuje zakończyć zaznaczony proces. - pt - __APPNAME__ está tentando encerrar o processo selecionado. - pt-PT - O __APPNAME__ está a tentar sair do processo seleccionado. - ro - __APPNAME__ încearcă să termine procesul selectat. - ru - Программа «__APPNAME__» пытается завершить выбранный процесс. - sk - __APPNAME__ sa pokúša ukončiÅ¥ vybraný proces. - sv - __APPNAME__ försöker avsluta den markerade processen. - th - __APPNAME__ กำลังพยายามออกจากการดำเนินการที่เลือก - tr - __APPNAME__, seçilen işlemden çıkmaya çalışıyor. - uk - Програма «__APPNAME__» намагається завершити вибраний процес. - zh-Hans - “__APPNAME__”正试图退出所选进程。 - zh-Hant - “__APPNAME__”正在嘗試結束所選程序。 - - rule - entitled-admin-or-authenticate-admin - shared - - timeout - 0 - - com.apple.appserver.privilege.admin - - class - rule - comment - For administrative access to the Application Server management tool. - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י שינויים - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าติดตั้ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل إعدادات خادم التطبيق. - ca - __APPNAME__ està intentant modificar la configuració del servidor d’aplicacions. - cs - __APPNAME__ se pokouší změnit nastavení serveru aplikací. - da - __APPNAME__ forsøger at ændre indstillingerne til programserveren. - de - __APPNAME__ versucht, die Einstellungen für den Anwendungsserver zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις ρυθμίσεις διακομιστή εφαρμογών. - en - __APPNAME__ is trying to modify the Application Server settings. - es - __APPNAME__ está intentando modificar los ajustes del servidor de aplicaciones. - fi - __APPNAME__ yrittää muokata ohjelmistopalvelimen asetuksia. - fr - __APPNAME__ essaye de modifier les réglages de serveur d’applications. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בהגדרות של שרת היישומים. - hr - __APPNAME__ pokuÅ¡ava preinačiti postavke aplikacijskog poslužitelja. - hu - A(z) __APPNAME__ megpróbálja módosítani az Alkalmazáskiszolgáló beállításait. - it - __APPNAME__ sta cercando di modificare le impostazioni di applicazioni per il server. - ja - __APPNAME__ は、アプリケーションサーバの設定を変更しようとしています。 - ko - __APPNAME__이(가) 응용 프로그램 서버 설정을 수정하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre programtjenerinnstillingene. - nl - __APPNAME__ probeert de instellingen van de programmaserver te wijzigen. - pl - __APPNAME__ zmienić ustawienia serwera programów. - pt - __APPNAME__ está tentando modificar os ajustes do Servidor de Aplicativos. - pt-PT - O __APPNAME__ está a tentar modificar as definições do servidor de aplicações. - ro - __APPNAME__ încearcă să schimbe configurările serverului de aplicații. - ru - Программа «__APPNAME__» пытается модифицировать настройки сервера программ. - sk - __APPNAME__ sa pokúša upraviÅ¥ nastavenia servera aplikácie. - sv - __APPNAME__ försöker ändra inställningarna för programservern. - th - __APPNAME__ กำลังพยายามแก้ไขค่าติดตั้งเซิร์ฟเวอร์แอปพลิเคชัน - tr - __APPNAME__, Uygulama Sunucusu ayarlarını değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри Програмного сервера. - zh-Hans - “__APPNAME__”正试图修改“应用程序服务器”设置。 - zh-Hant - “__APPNAME__”正在嘗試修改“應用程式伺服器”設定。 - - rule - appserver-admin - - com.apple.appserver.privilege.user - - class - rule - comment - For user access to the Application Server management tool. - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י שינויים - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าติดตั้ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل إعدادات خادم التطبيق الخاصة بك. - ca - __APPNAME__ està intentant modificar la configuració del servidor d’aplicacions. - cs - __APPNAME__ se pokouší změnit nastavení vaÅ¡eho serveru aplikací. - da - __APPNAME__ forsøger at ændre dine indstillinger til programserveren. - de - __APPNAME__ versucht, die Einstellungen für Ihren Anwendungsserver zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις ρυθμίσεις του διακομιστή εφαρμογών. - en - __APPNAME__ is trying to modify your Application Server settings. - es - __APPNAME__ está intentado modificar los ajustes del servidor de aplicaciones. - fi - __APPNAME__ yrittää muokata ohjelmistopalvelimen asetuksia. - fr - __APPNAME__ essaye de modifier les réglages de votre serveur d’applications. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בהגדרות שרת היישומים שלך. - hr - __APPNAME__ pokuÅ¡ava preinačiti vaÅ¡e postavke aplikacijskog poslužitelja. - hu - A(z) __APPNAME__ megpróbálja módosítani az Alkalmazáskiszolgáló beállításait. - it - __APPNAME__ sta cercando di modificare le impostazioni di applicazioni per il server. - ja - __APPNAME__ は、アプリケーションサーバの設定を変更しようとしています。 - ko - __APPNAME__이(가) 사용자의 응용 프로그램 서버 설정을 수정하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre programtjenerinnstillingene. - nl - __APPNAME__ probeert uw instellingen voor de programmaserver te wijzigen. - pl - __APPNAME__ zmienić ustawienia serwera programów. - pt - __APPNAME__ está tentando modificar os ajustes do seu Servidor de Aplicativos. - pt-PT - O __APPNAME__ está a tentar modificar as definições do seu servidor de aplicações. - ro - __APPNAME__ încearcă să schimbe configurările serverului dvs. de aplicații. - ru - Программа «__APPNAME__» пытается модифицировать Ваши настройки сервера программ. - sk - __APPNAME__ sa pokúša upraviÅ¥ nastavenia servera aplikácie. - sv - __APPNAME__ försöker ändra inställningarna för din programserver. - th - __APPNAME__ กำลังพยายามแก้ไขค่าติดตั้งเซิร์ฟเวอร์แอปพลิเคชัน - tr - __APPNAME__, Uygulama Sunucusu ayarlarınızı değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри вашого Програмного сервера. - zh-Hans - “__APPNAME__”正试图修改您的“应用程序服务器”设置。 - zh-Hant - “__APPNAME__”正在嘗試修改您的“應用程式伺服器”設定。 - - k-of-n - 1 - rule - - appserver-admin - appserver-user - - - com.apple.builtin.confirm-access - - class - evaluate-mechanisms - mechanisms - - builtin:confirm-access - - tries - 1 - - com.apple.builtin.confirm-access-password - - class - evaluate-mechanisms - mechanisms - - builtin:confirm-access-password - - - com.apple.builtin.generic-new-passphrase - - class - evaluate-mechanisms - mechanisms - - builtin:generic-new-passphrase - - - com.apple.builtin.generic-unlock - - class - evaluate-mechanisms - mechanisms - - builtin:generic-unlock - - - com.apple.container-repair - - class - user - default-button - - ar - تصليح - ca - Reparar - cs - Opravit - da - Reparer - de - Reparieren - el - Επισκευή - en - Repair - es - Reparar - fi - Korjaa - fr - Réparer - he - תקן - hr - Popravi - hu - Javítás - it - Ripara - ja - 修復 - ko - 복구 - nb - Reparer - nl - Herstel - pl - Napraw - pt - Reparar - pt-PT - Reparar - ro - Repară - ru - Исправить - sk - OpraviÅ¥ - sv - Reparera - th - ซ่อมแซม - tr - Onar - uk - Полагодити - zh-Hans - 修复 - zh-Hant - 修復 - - default-prompt - - ar - يحتاج __APPNAME__ إلى إصلاح مكتبتك لتشغيل التطبيات. - ca - __APPNAME__ necessita reparar la vostra biblioteca per poder executar aplicacions. - cs - __APPNAME__ potřebuje opravit vaÅ¡i knihovnu, aby bylo možné spouÅ¡tět aplikace. - da - __APPNAME__ skal reparere dit bibliotek for at kunne afvikle programmer. - de - __APPNAME__ muss Ihre Library reparieren, um Programme auszuführen. - el - Η εφαρμογή «__APPNAME__» πρέπει να επισκευάσει τη Βιβλιοθήκη σας ώστε να εκτελεί εφαρμογές. - en - __APPNAME__ needs to repair your Library to run applications. - es - __APPNAME__ necesita reparar su biblioteca para poder ejecutar aplicaciones. - fi - Kohteen__APPNAME__ pitää korjata kirjastosi, jotta se voi suorittaa ohjelmia. - fr - __APPNAME__ doit réparer votre Bibliothèque pour exécuter les applications. - he - על-מנת שניתן יהיה להפעיל יישומים, על __APPNAME__ לתקן את הספריה שלך. - hr - __APPNAME__ treba popraviti vaÅ¡u medijateku kako bi se mogle pokrenuti aplikacije. - hu - A(z) __APPNAME__ alkalmazásnak ki kell javítania az Ön Könyvtárát az alkalmazások futtatásához. - it - Per poter eseguire applicazioni, __APPNAME__ deve riparare la libreria. - ja - __APPNAME__ は、アプリケーションを実行するためにライブラリを修復する必要があります。 - ko - 응용 프로그램을 실행하려면 __APPNAME__이(가) 사용자의 라이브러리를 복구해야 합니다. - nb - __APPNAME__ mÃ¥ reparere biblioteket ditt for Ã¥ kunne bruke programmer. - nl - __APPNAME__ moet uw Bibliotheek herstellen om programma's te kunnen uitvoeren. - pl - __APPNAME__ musi naprawić bibliotekę, aby móc uruchamiać programy. - pt - __APPNAME__ necessita reparar sua biblioteca para poder executar aplicativos. - pt-PT - __APPNAME__ tem de reparar a Biblioteca antes de poder executar aplicações. - ro - __APPNAME__ trebuie să repare biblioteca dvs. pentru a putea rula aplicații. - ru - Программе «__APPNAME__» необходимо исправить Вашу библиотеку для запуска программ. - sk - __APPNAME__ potrebuje kvôli spúšťaniu aplikácií opraviÅ¥ vaÅ¡u knižniciu. - sv - __APPNAME__ mÃ¥ste reparera ditt bibliotek för att kunna använda program. - th - __APPNAME__ จำเป็นต้องซ่อมแซมคลังของคุณเพื่อสั่งทำงานแอปพลิเคชั่น - tr - Uygulamaları çalıştırmak için Kitaplık klasörünüzün __APPNAME__ tarafından onarılması gerekiyor. - uk - Програмі __APPNAME__ потрібно полагодити вашу папку «Бібліотека», щоб мати змогу запускати програми. - zh-Hans - “__APPNAME__”需要修复您的资源库才能运行应用程序。 - zh-Hant - “__APPNAME__”需要修復您的資料庫來執行應用程式。 - - group - admin - shared - - timeout - 30 - - com.apple.dashboard.advisory.allow - - class - user - group - admin - shared - - timeout - 300 - - com.apple.desktopservices - - class - user - comment - For privileged file operations from within the Finder. - group - admin - shared - - timeout - 0 - - com.apple.desktopservices.scripted - - class - user - comment - For scripting-initiated privileged file operations from within the Finder. - group - admin - shared - - timeout - 0 - - com.apple.docset.install - - class - user - comment - Used by Xcode to restrict access to a daemon it uses to install and update documentation sets. - default-button - - ar - تحديث الوثائق - ca - Actualitzar la documentació - cs - Aktualizovat dokumentaci - da - Opdater dokumentation - de - Dokumentation aktualisieren - el - Ενημέρωση πληροφοριακού υλικού - en - Update Documentation - es - Actualizar documentación - fi - Päivitä dokumentaatio - fr - Mettre à jour la documentation - he - עדכן/י - hr - Ažuriraj dokumentaciju - hu - Dokumentáció frissítése - it - Aggiona documentazione - ja - ドキュメントをアップデート - ko - 설명서 업데이트 - nb - Oppdater dokumentasjon - nl - Werk documentatie bij - pl - Uaktualnij dokumentację - pt - Atualizar Documentação - pt-PT - Actualizar documentação - ro - Actualizează documentația - ru - Обновить документацию - sk - AktualizovaÅ¥ dokumentáciu - sv - Uppdatera dokumentation - th - ปรับปรุงเอกสาร - tr - Belgeleri Güncelle - uk - Оновити документацію - zh-Hans - 更新文稿 - zh-Hant - 更新說明文件 - - default-prompt - - ar - يحاول __APPNAME__ تحديث مطور الوثائق. - ca - __APPNAME__ està intentant actualizar la documentació dels desenvolupadors. - cs - __APPNAME__ se pokouší aktualizovat vývojářskou dokumentaci. - da - __APPNAME__ forsøger at opdatere dokumentationen til udvikling. - de - __APPNAME__ versucht, die Entwicklerdokumentation zu aktualisieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ενημερώσει το πληροφοριακό υλικό για προγραμματιστές. - en - __APPNAME__ is trying to update the developer documentation. - es - __APPNAME__ está intentando actualizar la documentación para desarrolladores. - fi - __APPNAME__ yrittää päivittää kehittäjän dokumentaatiota. - fr - __APPNAME__ essaye de mettre à jour la documentation de développement. - he - ×´ __APPNAME__×´ מבקש לעדכן את המדריכים למפתחים. - hr - __APPNAME__ pokuÅ¡ava ažurirati dokumentaciju razvojnika. - hu - A(z) __APPNAME__ megpróbálja frissíteni a fejlesztői dokumentációt. - it - __APPNAME__ sta cercando di aggiornare la documentazione sviluppatori. - ja - __APPNAME__ はデベロッパドキュメントをアップデートしようとしています。 - ko - __APPNAME__이(가) 개발자 설명서를 업데이트하려고 합니다. - nb - __APPNAME__ prøver Ã¥ oppdatere utviklerdokumentasjonen. - nl - __APPNAME__ probeert de documentatie voor ontwikkelaars bij te werken. - pl - __APPNAME__ próbuje uaktualnić dokumentację dla programistów. - pt - __APPNAME__ está tentando atualizar a documentação do desenvolvedor. - pt-PT - O __APPNAME__ está a tentar actualizar a documentação de programação. - ro - __APPNAME__ încearcă să actualizeze documentația dezvoltatorilor. - ru - Программа «__APPNAME__» пытается обновить документацию для разработчиков. - sk - __APPNAME__ sa pokúša aktualizovaÅ¥ vývojársku dokumentáciu. - sv - __APPNAME__ försöker uppdatera dokumentationen för utvecklare. - th - __APPNAME__ กำลังพยายามปรับปรุงเอกสารของผู้พัฒนา - tr - __APPNAME__, geliştirici belgelerini güncellemeye çalışıyor. - uk - Програма «__APPNAME__» намагається оновити розробницьку документацію. - zh-Hans - “__APPNAME__”正试图更新开发者文稿。 - zh-Hant - “__APPNAME__”正在嘗試更新開發人員說明文件。 - - group - admin - shared - - - com.apple.library-repair - - class - user - default-button - - ar - تصليح - ca - Reparar - cs - Opravit - da - Reparer - de - Reparieren - el - Επισκευή - en - Repair - es - Reparar - fi - Korjaa - fr - Réparer - he - תקן - hr - Popravi - hu - Javítás - it - Ripara - ja - 修復 - ko - 복구 - nb - Reparer - nl - Herstel - pl - Napraw - pt - Reparar - pt-PT - Reparar - ro - Repară - ru - Исправить - sk - OpraviÅ¥ - sv - Reparera - th - ซ่อมแซม - tr - Onar - uk - Полагодити - zh-Hans - 修复 - zh-Hant - 修復 - - default-prompt - - ar - يحاول __APPNAME__ تصليح مكتبة الصور الخاصة بك. - ca - __APPNAME__ està provant de reparar la vostra fototeca. - cs - __APPNAME__ se pokouší opravit vaÅ¡i knihovnu fotografií. - da - __APPNAME__ prøver at reparere dit fotobibliotek. - de - __APPNAME__ versucht, Ihre Fotomediathek zu reparieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να επισκευάσει τη βιβλιοθήκη φωτογραφιών σας. - en - __APPNAME__ is trying to repair your photo library. - es - __APPNAME__ está intentando reparar su fototeca. - fi - __APPNAME__ yrittää korjata kuvakirjastoasi. - fr - __APPNAME__ essaie de réparer votre bibliothèque de photos. - he - __APPNAME__ מנסה לתקן את ספריית התמונות שלך. - hr - __APPNAME__ pokuÅ¡ava popraviti vaÅ¡u medijateku fotografija. - hu - A(z) __APPNAME__ megpróbálja kijavítani a fotókönyvtárat. - it - __APPNAME__ tenta di riparare la libreria foto. - ja - __APPNAME__ は、フォトライブラリを修復しようとしています。 - ko - __APPNAME__이(가) 사용자의 사진 보관함을 복구하려고 합니다. - nb - _APPNAME_ forsøker Ã¥ reparere bildebiblioteket. - nl - __APPNAME__ probeert uw fotobibliotheek te herstellen. - pl - __APPNAME__ próbuje naprawić Twoją bibliotekę zdjęć. - pt - __APPNAME__ está tentando reparar a sua fototeca. - pt-PT - __APPNAME__ está a tentar reparar a sua fototeca. - ro - __APPNAME__ încearcă să repare biblioteca dvs. foto. - ru - Программа «__APPNAME__» пытается исправить Вашу медиатеку. - sk - Aplikácia __APPNAME__ sa pokúša opraviÅ¥ vaÅ¡u knižnicu fotografií. - sv - __APPNAME__ försöker reparera ditt bildbibliotek. - th - __APPNAME__ กำลังพยายามซ่อมแซมคลังรูปภาพของคุณ - tr - __APPNAME__ fotoğraf arşivinizi onarmaya çalışıyor. - uk - __APPNAME__ намагається полагодити вашу фототеку. - zh-Hans - __APPNAME__ 正在尝试修复您的照片图库。 - zh-Hant - __APPNAME__ 正在嘗試修復您的照片圖庫。 - - group - admin - - com.apple.lldb.LaunchUsingXPC - - class - user - default-prompt - - ar - يحاول __APPNAME__ التحكم بعملية الجذر. - ca - __APPNAME__ està provant de controlar un procés arrel. - cs - __APPNAME__ se pokouší o převzetí řízení procesu typu „root“. - da - __APPNAME__ forsøger at overtage kontrollen med root-processen. - de - __APPNAME__ versucht, die Steuerung eines Root-Prozesses zu übernehmen. - el - Η εφαρμογή «__APPNAME__» προσπαθεί να αποκτήσει τον έλεγχο μιας ριζικής διεργασίας. - en - __APPNAME__ is trying to take control of a root process. - es - __APPNAME__ está intentando controlar un proceso raíz. - fi - __APPNAME__ yrittää saada pääprosessin hallintaansa. - fr - __APPNAME__ essaye de prendre le contrôle d’un processus racine. - he - __APPNAME__ מנסה לקבל שליטה על תהליך בסיס. - hr - __APPNAME__ želi preuzeti kontrolu nad korijenskim procesom. - hu - A(z) __APPNAME__ megpróbálja átvenni egy gyökérfolyamat vezérlését. - it - __APPNAME__ tenta di avere il controllo  di un processo root. - ja - __APPNAME__ は、ルートプロセスを制御しようとしてます。 - ko - __APPNAME__이(가) root 프로세스를 제어하려고 합니다. - nb - __APPNAME__ prøver Ã¥ ta kontroll over en prosess pÃ¥ rotnivÃ¥. - nl - __APPNAME__ probeert de besturing van een rootproces over te nemen. - pl - __APPNAME__ próbuje przejąć kontrolę nad procesem użytkownika root. - pt - __APPNAME__ está tentando assumir o controle de um processo raiz. - pt-PT - O __APPNAME__ está a tentar controlar um processo em root. - ro - __APPNAME__ încearcă să preia controlul unui proces root. - ru - Программа «__APPNAME__» пытается взять под контроль корневой процесс. - sk - Aplikácia __APPNAME__ sa pokúša prevziaÅ¥ kontrolu nad koreňovým procesom. - sv - __APPNAME__ försöker ta kontroll över en rotprocess. - th - __APPNAME__ กำลังพยายามเข้าควบคุมกระบวนการรูท - tr - __APPNAME__ kök işlemin denetimini ele geçirmeye çalışıyor. - uk - __APPNAME__ намагається перебрати на себе керування кореневим процесом. - zh-Hans - “__APPNAME__”正在尝试控制 root 进程。 - zh-Hant - “__APPNAME__”正在嘗試控制 root 程序。 - - group - admin - - com.apple.opendirectoryd.linkidentity - - class - rule - default-prompt - - ar - يحاول __APPNAME__ تعديل حساب المُستخدم الخاص بك. - ca - __APPNAME__ està intentant modificar el vostre compte d’usuari. - cs - __APPNAME__ se pokouší změnit váš uživatelský účet. - da - __APPNAME__ prøver at ændre din brugerkonto. - de - __APPNAME__ versucht, Ihren Benutzeraccount zu verändern. - el - Η εφαρμογή «__APPNAME__» προσπαθεί να τροποποιήσει τον λογαριασμό χρήστη σας. - en - __APPNAME__ is trying to modify your user account. - es - __APPNAME__ está intentando modificar su cuenta de usuario. - fi - __APPNAME__ yrittää muokata käyttäjätunnustasi. - fr - __APPNAME__ essaye de modifier votre compte utilisateur. - he - __APPNAME__ מנסה לשנות את חשבון המשתמש/ת שלך. - hr - __APPNAME__ pokuÅ¡ava promijeniti vaÅ¡ korisnički račun. - hu - A(z) __APPNAME__ módosítani próbálja az Ön felhasználói fiókját. - it - __APPNAME__ sta provando a modificare il tuo account utente. - ja - “__APPNAME__”で、ユーザアカウントが変更されようとしています。 - ko - __APPNAME__이(가) 사용자 계정을 수정하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre brukerkontoen din. - nl - __APPNAME__ probeert uw gebruikersaccount te wijzigen. - pl - __APPNAME__ próbuje zmodyfikować Twoje konto użytkownika. - pt - __APPNAME__ está tentando modificar a sua conta de usuário. - pt-PT - O __APPNAME__ está a tentar modificar a sua conta de utilizador. - ro - __APPNAME__ încearcă să vă modifice contul de utilizator. - ru - Программа «__APPNAME__» пытается модифицировать Вашу учетную запись пользователя. - sk - Aplikácia __APPNAME__ sa pokúša upraviÅ¥ váš užívateľský účet. - sv - __APPNAME__ försöker ändra ditt användarkonto. - th - __APPNAME__กำลังพยายามแก้ไขบัญชีผู้ใช้ของคุณ - tr - __APPNAME__, kullanıcı hesabınızı değiştirmeye çalışıyor. - uk - __APPNAME__ намагається змінити ваш обліковий запис користувача. - zh-Hans - “__APPNAME__”正试图修改您的用户帐户。 - zh-Hant - __APPNAME__ 正在嘗試修改您的使用者帳號。 - - rule - entitled-session-owner-or-authenticate-session-owner - - com.apple.security.assessment.update - - class - rule - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י הגדרות - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าติดตั้ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ السماح لعنصر بأن يكون قيد التشغيل دائمًا. - ca - __APPNAME__ està provant d’autoritzar un ítem perquè s’executi sempre. - cs - __APPNAME__ se pokouší nějaké položce povolit, aby byla vždy spuÅ¡těna. - da - __APPNAME__ prøver at give et emne lov til at være aktivt hele tiden. - de - __APPNAME__ versucht, einem Objekt die Ausführung immer zu erlauben. - el - Η εφαρμογή «__APPNAME__» προσπαθεί να επιτρέψει σε ένα στοιχείο να εκτελείται πάντα. - en - __APPNAME__ is trying to allow an item to always run. - es - __APPNAME__ está intentando permitir que un ítem se ejecute siempre. - fi - __APPNAME__ yrittää sallia, että kohde on aina käytössä. - fr - __APPNAME__ essaye d’autoriser un élément à s’exécuter en continu. - he - __APPNAME__ מנסה לאפשר לפריט לפעול באופן קבוע. - hr - __APPNAME__ pokuÅ¡ava dozvoliti stavci da uvijek bude pokrenuta. - hu - A(z) __APPNAME__ megpróbál beállítani egy elemet, hogy az mindig fusson. - it - __APPNAME__ tenta di consentire che un elemento venga sempre eseguito. - ja - __APPNAME__ は、項目が常時動作することを許可しようとしています。 - ko - __APPNAME__이(가) 항목이 항상 실행되는 것을 허용하려고 합니다. - nb - __APPNAME__ prøver Ã¥ tillate at et program alltid kjører. - nl - __APPNAME__ probeert een onderdeel toe te staan dat het altijd wordt uitgevoerd. - pl - __APPNAME__ próbuje zezwolić, aby rzecz była zawsze uruchamiana. - pt - O __APPNAME__ está tentando autorizar um item a ser executado permanentemente. - pt-PT - O __APPNAME__ está a tentar dar autorização a um elemento para permanecer constantemente aberto. - ro - __APPNAME__ încearcă să-i permită unui articol să ruleze întotdeauna. - ru - Программа «__APPNAME__» пытается разрешить объекту постоянно выполнять работу. - sk - Aplikácia __APPNAME__ sa pokúša povoliÅ¥ spúšťanie položky. - sv - __APPNAME__ försöker tillÃ¥ta ett objekt att alltid köras. - th - __APPNAME__กำลังพยายามอนุญาตรายการให้ทำงานเสมอ - tr - __APPNAME__, bir öğenin her zaman çalışmasına izin vermeye çalışıyor. - uk - __APPNAME__ намагається дозволити елементу завжди запускатися. - zh-Hans - “__APPNAME__”正在尝试允许一个项目始终运行。 - zh-Hant - “__APPNAME__”正在嘗試允許某個項目持續執行。 - - rule - root-or-entitled-admin-or-authenticate-admin - - com.apple.server.admin.streaming - - allow-root - - class - rule - comment - For making administrative requests to the QuickTime Streaming Server. - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י הגדרות - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าติดตั้ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل إعدادات خادم تدفق QuickTime. - ca - __APPNAME__ està intentant modificar la configuració del servidor QuickTime en temps real. - cs - __APPNAME__ se pokouší změnit nastavení serveru QuickTime Streaming. - da - __APPNAME__ forsøger at ændre indstillingerne til QuickTime Streaming. - de - __APPNAME__ versucht, die QuickTime-Streaming-Servereinstellungen zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις ρυθμίσεις του διακομιστή ροής QuickTime. - en - __APPNAME__ is trying to modify the QuickTime Streaming Server settings. - es - __APPNAME__ está intentando modificar los ajustes de QuickTime Streaming Server. - fi - __APPNAME__ yrittää muokata QuickTime Streaming Server -asetuksia. - fr - __APPNAME__ essaye de modifier le réglages de QuickTime Streaming Server. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים את ההגדרות של ×´QuickTime Streaming Server×´. - hr - __APPNAME__ pokuÅ¡ava preinačiti postavke QuickTime poslužitelja za streaming. - hu - A(z) __APPNAME__ megpróbálja módosítani a QuickTime Streaming kiszolgáló beállításait. - it - __APPNAME__ sta cercando di modificare le impostazioni QuickTime Streaming Server. - ja - __APPNAME__ は、QuickTime Streaming Server の設定を変更しようとしています。 - ko - __APPNAME__이(가) QuickTime Streaming Server 설정을 수정하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre QuickTime Streaming Server-innstillingene. - nl - __APPNAME__ probeert de instellingen van de QuickTime-streamingserver te wijzigen. - pl - __APPNAME__ próbuje zmienić ustawienia serwera strumieniowania QuickTime. - pt - __APPNAME__ está tentando modificar os ajustes do QuickTime Streaming Server. - pt-PT - O __APPNAME__ está a tentar modificar as definições do servidor de streaming do QuickTime. - ro - __APPNAME__ încearcă să schimbe configurările QuickTime Streaming Server. - ru - Программа «__APPNAME__» пытается модифицировать настройки сервера QuickTime Streaming. - sk - __APPNAME__ sa pokúša upraviÅ¥ nastavenia QuickTime Streaming servera. - sv - __APPNAME__ försöker ändra inställningarna för QuickTime Streaming Server. - th - __APPNAME__ กำลังพยายามแก้ไขค่าติดตั้งเซิร์ฟเวอร์ QuickTime Streaming - tr - __APPNAME__, QuickTime Streaming Server ayarlarını değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри QuickTime Streaming Server. - zh-Hans - “__APPNAME__”正试图修改 QuickTime 流服务器的设置。 - zh-Hant - “__APPNAME__”正在嘗試修改 QuickTime Streaming Server 設定。 - - k-of-n - 1 - rule - - is-admin - authenticate-admin - - shared - - timeout - 0 - - com.apple.trust-settings.admin - - allow-root - - class - user - comment - For modifying Trust Settings in the Local Admin domain. - default-button - - ar - تحديث الإعدادات - ca - Actualitzar la configuració - cs - Aktualizovat nastavení - da - Opdater indstillinger - de - Einstellungen aktualisieren - el - Ενημέρωση ρυθμίσεων - en - Update Settings - es - Actualizar ajustes - fi - Päivitä asetukset - fr - Mettre à jour les réglages - he - עדכן הגדרות - hr - Ažuriraj postavke - hu - Beállítások frissítése - it - Aggiorna impostazioni - ja - 設定をアップデート - ko - 설정 업데이트 - nb - Oppdater innstillinger - nl - Werk instellingen bij - pl - Uaktualnij ustawienia - pt - Atualizar Ajustes - pt-PT - Actualizar definições - ro - Actualizează configurările - ru - Обновить настройки - sk - AktualizovaÅ¥ nastavenia - sv - Uppdatera inställningar - th - ปรับปรุงค่าติดตั้ง - tr - Ayarları Güncelle - uk - Внести зміни - zh-Hans - 更新设置 - zh-Hant - 更新設定 - - default-prompt - - ar - أنت تقوم بإجراء تغييرات على إعدادات الثقة في شهادة النظام. - ca - Esteu efectuant canvis en la configuració dels certificats de confiança del sistema. - cs - Provádíte změny v systémových nastaveních důvěryhodnosti certifikátů. - da - Du foretager ændringer i systemcertifikatets godkendelsesindstillinger. - de - Sie nehmen Änderungen an Ihren Systemeinstellungen für Zertifizierungen vor. - el - Κάνετε αλλαγές στις ρυθμίσεις αξιοπιστίας πιστοποιητικού συστήματος. - en - You are making changes to the System Certificate Trust Settings. - es - Está modificando los ajustes de confianza en certificados del sistema. - fi - Olet muuttamassa järjestelmävarmenteiden luottoasetuksia. - fr - Vous effectuez des modifications des réglages de confiance du certificat du système. - he - הינך עורך/ת שינויים בהגדרות האמון של אישורי המערכת. - hr - Unosite promjene u postavke pouzdanih certifikata sustava. - hu - Módosítja a Rendszertanúsítványok megbízhatósági beállításait. - it - Stai apportando modifiche alle impostazioni System Certificate Trust. - ja - “システム証明書の信頼性”環境設定を変更しようとしています。 - ko - 시스템 인증서 신뢰 설정을 변경하고 있습니다. - nb - Du endrer tillitsinnstillingene for systemsertifikater. - nl - U wijzigt de systeeminstellingen voor het vertrouwen van certificaten. - pl - Wprowadzasz zmiany w ustawieniach zaufania certyfikatu systemowego. - pt - Você está fazendo alterações nos Ajustes de Confiança dos Certificados do Sistema. - pt-PT - Está a alterar as definições de segurança do certificado do sistema. - ro - Efectuați modificări ale configurărilor de încredere pentru certificatul de sistem. - ru - Вы вносите изменения в настройки доверия системы. - sk - Vykonávate zmeny v nastaveniach dôveryhodnosti systémových certifikátov. - sv - Du gör ändringar i systemets tillförlitlighetsinställningar för certifikat. - th - คุณกำลังเปลี่ยนแปลงค่าติดตั้งใบรับรองที่เชื่อถือของระบบ - tr - Sistem Sertifikası Güven Ayarları’nda değişiklikler yapıyorsunuz. - uk - Ви вносите зміни до системних параметрів довіри сертифікатам. - zh-Hans - 您正在更改“系统证书信任设置”。 - zh-Hant - 您正在更改“系統憑證信任設定”。 - - group - admin - - com.apple.trust-settings.user - - comment - For modifying per-user Trust Settings. - default-button - - ar - تحديث الإعدادات - ca - Actualitzar la configuració - cs - Aktualizovat nastavení - da - Opdater indstillinger - de - Einstellungen aktualisieren - el - Ενημέρωση ρυθμίσεων - en - Update Settings - es - Actualizar ajustes - fi - Päivitä asetukset - fr - Mettre à jour les réglages - he - עדכן הגדרות - hr - Ažuriraj postavke - hu - Beállítások frissítése - it - Aggiorna impostazioni - ja - 設定をアップデート - ko - 설정 업데이트 - nb - Oppdater innstillinger - nl - Werk instellingen bij - pl - Uaktualnij ustawienia - pt - Atualizar Ajustes - pt-PT - Actualizar definições - ro - Actualizează configurările - ru - Обновить настройки - sk - AktualizovaÅ¥ nastavenia - sv - Uppdatera inställningar - th - ปรับปรุงค่าติดตั้ง - tr - Ayarları Güncelle - uk - Внести зміни - zh-Hans - 更新设置 - zh-Hant - 更新設定 - - default-prompt - - ar - أنت تقوم بإجراء تغييرات على إعدادات الثقة في شهادة النظام. - ca - Esteu efectuant canvis en la configuració dels certificats de confiança. - cs - Provádíte změny v nastaveních důvěryhodnosti certifikátů. - da - Du foretager ændringer i systemcertifikatets godkendelsesindstillinger. - de - Sie nehmen Änderungen an Ihren Systemeinstellungen für Zertifizierungen vor. - el - Κάνετε αλλαγές στις ρυθμίσεις αξιοπιστίας πιστοποιητικού. - en - You are making changes to your Certificate Trust Settings. - es - Está modificando los ajustes de confianza en certificados. - fi - Olet muuttamassa varmenteiden luottoasetuksia. - fr - Vous effectuez des modifications de vos réglages de confiance du certificat. - he - הינך עורך/ת שינויים בהגדרות האמון של אישורי המערכת. - hr - Unosite promjene u postavke pouzdanih certifikata. - hu - Módosítja a saját tanúsítványainak megbízhatósági beállításait. - it - Stai apportando modifiche alle impostazioni Certificate Trust. - ja - “システム証明書の信頼性”環境設定を変更しようとしています。 - ko - 사용자의 인증서 신뢰 설정을 변경하고 있습니다. - nb - Du endrer tillitsinnstillingene for sertifikater. - nl - U wijzigt uw instellingen voor het vertrouwen van certificaten. - pl - Wprowadzasz zmiany w ustawieniach zaufania swojego certyfikatu. - pt - Você está fazendo alterações nos seus Ajustes de Confiança dos Certificados. - pt-PT - Está a alterar as suas definições de segurança do certificado do sistema. - ro - Efectuați modificări ale configurărilor de încredere pentru certificatul dvs. - ru - Вы вносите изменения в свои настройки доверия. - sk - Vykonávate zmeny v nastaveniach dôveryhodnosti vaÅ¡ich certifikátov. - sv - Du gör ändringar i dina tillförlitlighetsinställningar för certifikat. - th - คุณกำลังเปลี่ยนแปลงค่าติดตั้งใบรับรองที่ชื่อถือของคุณ - tr - Sertifika Güven Ayarları’nızda değişiklikler yapıyorsunuz. - uk - Ви вносите зміни до своїх параметрів довіри сертифікатам. - zh-Hans - 您正在更改您的“证书信任设置”。 - zh-Hant - 您正在更改您的“憑證信任設定”。 - - rule - entitled-session-owner-or-authenticate-session-owner - - com.apple.uninstalld.uninstall - - class - rule - default-button - - ar - حذف - ca - Eliminar - cs - Smazat - da - Slet - de - Löschen - el - Διαγραφή - en - Delete - es - Eliminar - fi - Poista - fr - Supprimer - he - מחק - hr - ObriÅ¡i - hu - Törlés - it - Elimina - ja - 削除 - ko - 삭제 - nb - Slett - nl - Verwijder - pl - Usuń - pt - Apagar - pt-PT - Apagar - ro - Șterge - ru - Удалить - sk - VymazaÅ¥ - sv - Radera - th - ลบ - tr - Sil - uk - Видалити - zh-Hans - 删除 - zh-Hant - 刪除 - - default-prompt - - ar - يحاول __APPNAME__ حذف التطبيق. - ca - __APPNAME__ està intentant eliminar una aplicació. - cs - __APPNAME__ se pokouší smazat aplikaci. - da - __APPNAME__ prøver at slette et program. - de - __APPNAME__ versucht, ein Programm zu löschen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να διαγράψει μια εφαρμογή. - en - __APPNAME__ is trying to delete an application. - es - __APPNAME__ está intentando eliminar una aplicación. - fi - __APPNAME__ yrittää poistaa ohjelmaa. - fr - __APPNAME__ essaie de supprimer une application. - he - ×´ __APPNAME__×´ מבקש למחוק יישום. - hr - __APPNAME__ pokuÅ¡ava obrisati aplikaciju. - hu - A(z) __APPNAME__ megpróbál egy alkalmazást törölni. - it - __APPNAME__ sta tentando di eliminare un'applicazione. - ja - __APPNAME__ がアプリケーションを削除しようとしています。 - ko - __APPNAME__에서 응용 프로그램을 삭제하려고 시도 중입니다. - nb - __APPNAME__ prøver Ã¥ slette et program. - nl - __APPNAME__ probeert een programma te verwijderen. - pl - __APPNAME__ próbuje usunąć program. - pt - __APPNAME__ está tentando apagar um aplicativo. - pt-PT - __APPNAME__ está a tentar apagar uma aplicação. - ro - __APPNAME__ încearcă să șteargă o aplicație. - ru - __APPNAME__ пытается удалить программу. - sk - __APPNAME__ sa pokúša vymazaÅ¥ aplikáciu. - sv - __APPNAME__ försöker radera ett program. - th - __APPNAME__ กำลังพยายามลบแอปพลิเคชัน - tr - __APPNAME__, bir uygulamayı silmeye çalışıyor. - uk - Програма «__APPNAME__» намагається видалити програму. - zh-Hans - “__APPNAME__”正试图删除应用程序。 - zh-Hant - “__APPNAME__”正在嘗試刪除應用程式。 - - rule - entitled-admin-or-authenticate-admin - - config.add. - - class - allow - comment - Wildcard right for adding rights. Anyone is allowed to add any (non-wildcard) rights. - - config.config. - - class - deny - comment - Wildcard right for any change to meta-rights for db modification. Not allowed programmatically (just edit this file). - - config.modify. - - class - rule - comment - Wildcard right for modifying rights. Admins are allowed to modify any (non-wildcard) rights. Root does not require authentication. - k-of-n - 1 - rule - - is-root - authenticate-admin - - - config.remove. - - class - rule - comment - Wildcard right for deleting rights. Admins are allowed to delete any (non-wildcard) rights. Root does not require authentication. - k-of-n - 1 - rule - - is-root - authenticate-admin - - - config.remove.system. - - class - deny - comment - Wildcard right for deleting system rights. - - sys.openfile. - - class - user - comment - See authopen(1) for information on the use of this right. - default-button - - ar - فتح - ca - Obrir - cs - Otevřít - da - Åben - de - Öffnen - el - Άνοιγμα - en - Open - es - Abrir - fi - Avaa - fr - Ouvrir - he - פתח - hr - Otvori - hu - Megnyitás - it - Apri - ja - 開く - ko - 열기 - nb - Åpne - nl - Open - pl - Otwórz - pt - Abrir - pt-PT - Abrir - ro - Deschide - ru - Открыть - sk - OtvoriÅ¥ - sv - Öppna - th - เปิด - tr - Aç - uk - Відкрити - zh-Hans - 打开 - zh-Hant - 打開 - - default-prompt - - ar - يحاول __APPNAME__ فتح الملف الذي تم اختياره. - ca - __APPNAME__ està intentant obrir l’arxiu seleccionat. - cs - __APPNAME__ se pokouší otevřít vybraný soubor. - da - __APPNAME__ forsøger at Ã¥bne det valgte arkiv. - de - __APPNAME__ versucht, die gewählte Datei zu öffnen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ανοίξει το επιλεγμένο αρχείο. - en - __APPNAME__ is trying to open the chosen file. - es - __APPNAME__ está intentando abrir el archivo seleccionado. - fi - __APPNAME__ yrittää avata valittua tiedostoa. - fr - __APPNAME__ essaye d'ouvrir le fichier sélectionné. - he - ×´ __APPNAME__×´ מבקש לפתוח את הקובץ הנבחר. - hr - __APPNAME__ pokuÅ¡ava otvoriti odabranu datoteku. - hu - A(z) __APPNAME__ megpróbálja megnyitni a kiválasztott fájlt. - it - __APPNAME__ sta cercando di aprire il documento prescelto. - ja - __APPNAME__ は、選択中のファイルを開こうとしています。 - ko - __APPNAME__이(가) 선택된 파일을 열려고 합니다. - nb - __APPNAME__ prøver Ã¥ Ã¥pne den valgte filen. - nl - __APPNAME__ probeert het gekozen bestand te openen. - pl - __APPNAME__ próbuje otworzyć wybrany plik. - pt - __APPNAME__ está tentando abrir o arquivo escolhido. - pt-PT - O __APPNAME__ está a tentar abrir o ficheiro escolhido. - ro - __APPNAME__ încearcă să deschidă fișierul ales. - ru - Программа «__APPNAME__» пытается открыть новый файл. - sk - __APPNAME__ sa pokúša otvoriÅ¥ vybraný súbor. - sv - __APPNAME__ försöker öppna den valda filen. - th - __APPNAME__ กำลังพยายามเปิดไฟล์ที่เลือก - tr - __APPNAME__, seçilen dosyayı açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відкрити вибраний файл. - zh-Hans - “__APPNAME__”正试图打开所选文件。 - zh-Hant - “__APPNAME__”正在嘗試打開所選檔案。 - - group - admin - shared - - timeout - 300 - - system. - - rule - default - - system.burn - - class - allow - comment - For burning media. - default-button - - ar - نسخ قرص - ca - Gravar - cs - Vypálit - da - Brænd - de - Brennen - el - Εγγραφή - en - Burn - es - Grabar - fi - Polta - fr - Graver - he - צרוב - hr - Snimi - hu - Írás - it - Masterizza - ja - ディスクを作成 - ko - 굽기 - nb - Brenn - nl - Brand - pl - Nagraj - pt - Gravar - pt-PT - Gravar - ro - Inscripționează - ru - Записать - sk - VypáliÅ¥ - sv - Bränn - th - เขียน - tr - Diske Bas - uk - Записати - zh-Hans - 刻录 - zh-Hant - 燒錄 - - default-prompt - - ar - يحاول __APPNAME__ إنشاء قرص. - ca - __APPNAME__ està intentant gravar un disc. - cs - __APPNAME__ se pokouší vypálit disk. - da - __APPNAME__ forsøger at brænde en disk. - de - __APPNAME__ versucht, eine CD/DVD zu brennen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να εγγράψει ένα δίσκο. - en - __APPNAME__ is trying to burn a disc. - es - __APPNAME__ está intentando grabar un disco. - fi - __APPNAME__ yrittää polttaa levyn. - fr - __APPNAME__ essaye de graver un disque. - he - ×´ __APPNAME__×´ מבקש לצרוב תקליטור. - hr - __APPNAME__ pokuÅ¡ava snimiti disk. - hu - A(z) __APPNAME__ megpróbál egy lemezt írni. - it - __APPNAME__ sta cercando di masterizzare un disco. - ja - __APPNAME__ はディスクを作成しようとしています。 - ko - __APPNAME__이(가) 디스크를 구우려고 합니다. - nb - __APPNAME__ prøver Ã¥ brenne en plate. - nl - __APPNAME__ probeert een schijf te branden. - pl - __APPNAME__ próbuje nagrać na płycie. - pt - __APPNAME__ está tentando gravar um disco. - pt-PT - O __APPNAME__ está a tentar gravar um disco. - ro - __APPNAME__ încearcă să inscripționeaze un disc. - ru - Программа «__APPNAME__» пытается записать диск. - sk - __APPNAME__ sa pokúša vypáliÅ¥ disk. - sv - __APPNAME__ försöker bränna en skiva. - th - __APPNAME__ กำลังพยายามเขียนลงดิสก์ - tr - __APPNAME__, diske basmaya çalışıyor. - uk - Програма «__APPNAME__» намагається записати оптичний диск. - zh-Hans - “__APPNAME__”正试图刻录光盘。 - zh-Hant - “__APPNAME__”正在嘗試燒錄光碟。 - - - system.csfde.requestpassword - - class - user - comment - Used by CoreStorage Full Disk Encryption to request the user's password. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロックを解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - ‏يلزم __APPNAME__ فك قفل القرص الخاص بك. - ca - __APPNAME__ necessita desbloquejar el disc. - cs - __APPNAME__ potřebuje odemknout předvolby disku. - da - __APPNAME__ skal lÃ¥se disken op. - de - __APPNAME__ muss Ihr Volume entsperren. - el - Η εφαρμογή __APPNAME__ πρέπει να ξεκλειδώσει το δίσκο σας. - en - __APPNAME__ needs to unlock your disk. - es - __APPNAME__ debe desbloquear el disco. - fi - Ohjelman __APPNAME__ pitää avata levy. - fr - __APPNAME__ à besoin de déverrouiller votre disque. - he - ×´ __APPNAME__×´ צריך לבטל את הנעילה של הכונן. - hr - __APPNAME__ treba otključati vaÅ¡ disk. - hu - A(z) __APPNAME__ alkalmazásnak fel kell oldania a lemezt. - it - __APPNAME__ deve sbloccare il disco. - ja - __APPNAME__はディスクのロックを解除する必要があります。 - ko - __APPNAME__이(가) 사용자 디스크를 잠금 해제해야 합니다. - nb - __APPNAME__ mÃ¥ lÃ¥se opp disken. - nl - __APPNAME__ moet de beveiliging van uw schijf opheffen. - pl - __APPNAME__ musi odblokować dysk. - pt - __APPNAME__ precisa desbloquear seu disco. - pt-PT - O __APPNAME__ precisa de desproteger o disco. - ro - __APPNAME__ trebuie să deblocheze discul dvs. - ru - Программе «__APPNAME__» необходимо снять защиту с Вашего диска. - sk - __APPNAME__ potrebuje odomknúť váš disk. - sv - __APPNAME__ mÃ¥ste lÃ¥sa upp skivan. - th - __APPNAME__ จำเป็นต้องปลดล็อกดิสก์ของคุณ - tr - __APPNAME__ uygulamasının diskinizin kilidini açması gerekiyor. - uk - Програмі «__APPNAME__» потрібно відімкнути ваш диск. - zh-Hans - “__APPNAME__”需要解锁您的磁盘。 - zh-Hant - “__APPNAME__”需要解鎖您的磁碟。 - - extract-password - - group - staff - shared - - timeout - 0 - - system.device.dvd.setregion.initial - - class - user - comment - Used by the DVD player to set the region code the first time. Note that changing the region code after it has been set requires a different right (system.device.dvd.setregion.change). - default-button - - ar - تعيين - ca - Definir - cs - Nastavit - da - Indstil - de - Festlegen - el - Ορισμός - en - Set - es - Definir - fi - Aseta - fr - Définir - he - הגדר - hr - Podesi - hu - Beállítás - it - Imposta - ja - 設定 - ko - 설정 - nb - Angi - nl - Stel in - pl - Ustal - pt - Definir - pt-PT - Definir - ro - Configurează - ru - Установить - sk - NastaviÅ¥ - sv - Ställ in - th - ตั้งค่า - tr - Ayarla - uk - Задати - zh-Hans - Set - zh-Hant - 設定 - - default-prompt - - ar - يحاول __APPNAME__ تعيين رمز منطقة الـ DVD لأول مرة. - ca - __APPNAME__ està intentant definir el codi de la regió del DVD per primer cop. - cs - __APPNAME__ se pokouší poprvé nastavit kód DVD regionu. - da - __APPNAME__ forsøger at indstille dvd-omrÃ¥dekoden for første gang. - de - __APPNAME__ versucht, den Ländercode zum ersten Mal einzustellen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ορίσει τον κωδικό περιοχής DVD για πρώτη φορά. - en - __APPNAME__ is trying to set the DVD region code for the first time. - es - __APPNAME__ está intentando definir el código de región del DVD por primera vez. - fi - __APPNAME__ yrittää asettaa DVD-aluekoodia ensimmäistä kertaa. - fr - __APPNAME__ essaye de régler le code de région du lecteur pour la première fois. - he - ×´ __APPNAME__×´ מבקש להגדיר את האזור של כונן ה-DVD בפעם הראשונה. - hr - __APPNAME__ pokuÅ¡ava po prvi put podesiti DVD regionalni kôd. - hu - A(z) __APPNAME__ megpróbálja először beállítani a DVD régiókódját. - it - __APPNAME__ sta cercando di impostare il codice regionale del DVD per la prima volta. - ja - __APPNAME__ は、DVD のリージョンコードをはじめて設定しようとしています。 - ko - __APPNAME__이(가) 처음으로 DVD 지역 코드를 설정하려고 합니다. - nb - __APPNAME__ prøver Ã¥ angi DVD-regionkoden for første gang. - nl - __APPNAME__ probeert de dvd-regiocode voor het eerst in te stellen. - pl - __APPNAME__ próbuje ustawić kod regionu DVD po raz pierwszy. - pt - __APPNAME__ está tentando definir o código de região do DVD pela primeira vez. - pt-PT - O __APPNAME__ está a tentar definir o código regional de DVD pela primeira vez. - ro - __APPNAME__ încearcă să configureze codul regiunii DVD pentru prima dată. - ru - Программа «__APPNAME__» пытается впервые установить код региона DVD. - sk - __APPNAME__ sa pokúša nastaviÅ¥ kód regiónu pre DVD (iniciálne nastavenie). - sv - __APPNAME__ försöker ställa in DVD-spelarens regionkod för första gÃ¥ngen. - th - __APPNAME__ กำลังพยายามตั้งค่ารหัสพื้นที่ดีวีดีของคุณเป็นครั้งแรก - tr - __APPNAME__, DVD bölge kodunu ilk kez ayarlamaya çalışıyor. - uk - Програма «__APPNAME__» намагається вперше задати код регіону DVD. - zh-Hans - “__APPNAME__”首次试图设置 DVD 注册号。 - zh-Hant - “__APPNAME__”正在嘗試初次設定 DVD 的區域碼。 - - group - admin - shared - - - system.disk.unlock - - class - evaluate-mechanisms - comment - Do not modify. - mechanisms - - DiskUnlock:prompt - DiskUnlock:unlock,privileged - - - system.global-login-items. - - class - rule - default-button - - ar - إضافة - ca - Afegir - cs - Přidat - da - Tilføj - de - Hinzufügen - el - Προσθήκη - en - Add - es - Añadir - fi - Lisää - fr - Ajouter - he - הוסף - hr - Dodaj - hu - Hozzáadás - it - Aggiungi - ja - 追加 - ko - 추가 - nb - Legg til - nl - Voeg toe - pl - Dodaj - pt - Adicionar - pt-PT - Adicionar - ro - Adaugă - ru - Добавить - sk - PridaÅ¥ - sv - Lägg till - th - เพิ่ม - tr - Ekle - uk - Додати - zh-Hans - 添加 - zh-Hant - 加入 - - default-prompt - - ar - يحاول __APPNAME__ إضافة عنصر الدخول. - ca - __APPNAME__ està intentant afegir un ítem de connexió. - cs - __APPNAME__ se pokouší přidat přihlaÅ¡ovací položku. - da - __APPNAME__ forsøger at tilføje et log ind-emne. - de - __APPNAME__ versucht, ein neues Startobjekt hinzufügen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να προσθέσει ένα στοιχείο εισόδου. - en - __APPNAME__ is trying to add a login item. - es - __APPNAME__ está intentando añadir un ítem de arranque. - fi - __APPNAME__ yrittää lisätä sisäänkirjautumiskohteen. - fr - __APPNAME__ essaye d’ajouter un élément d’ouverture de session. - he - ×´ __APPNAME__×´ מבקש להוסיף פריט להתחברות. - hr - __APPNAME__ pokuÅ¡ava dodati stavku za prijavu. - hu - A(z) __APPNAME__ megpróbál hozzáadni egy bejelentkezési elemet. - it - __APPNAME__ sta cercando di aggiungere un elemento di login. - ja -  __APPNAME__ はログイン項目を追加しようとしています。 - ko - __APPNAME__이(가) 로그인 항목을 추가하려고 합니다. - nb - __APPNAME__ prøver Ã¥ legge til et pÃ¥loggingsobjekt. - nl - __APPNAME__ probeert een inlogonderdeel toe te voegen. - pl - __APPNAME__ próbuje dodać rzecz otwieraną podczas logowania. - pt - __APPNAME__ está tentando adicionar um item de início de sessão. - pt-PT - O __APPNAME__ está a tentar adicionar um elemento de início de sessão. - ro - __APPNAME__ încearcă să adauge un articol de lansat la login. - ru - Программа «__APPNAME__» пытается добавить объект входа. - sk - __APPNAME__ sa pokúša pridaÅ¥ položku spúšťanú pri prihlásení. - sv - __APPNAME__ försöker lägga till ett startobjekt. - th - __APPNAME__ กำลังพยายามเพิ่มรายการเข้าสู่ระบบ - tr - __APPNAME__, bir oturum açma öğesi eklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається додати елемент автозапуску. - zh-Hans - “__APPNAME__”正试图添加登录项。 - zh-Hant - “__APPNAME__”正在嘗試加入登入項目。 - - k-of-n - 1 - rule - - is-admin - default - - - system.hdd.smart - - class - allow - comment - For modifying SMART settings. - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י הגדרות - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าติดตั้ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل إعدادات التشخيص لمحرك الأقراص الثابتة. - ca - __APPNAME__ està intentant modificar la configuració del diagnòstic del vostre disc dur. - cs - __APPNAME__ se pokouší změnit nastavení diagnostiky pevného disku. - da - __APPNAME__ forsøger at ændre diagnosticeringsindstillingerne til harddisken. - de - __APPNAME__ versucht, die Diagnoseeinstellungen für Ihre Festplatte zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις διαγνωστικές ρυθμίσεις για το σκληρό δίσκο σας. - en - __APPNAME__ is trying to modify the diagnostic settings for your hard drive. - es - __APPNAME__ está intentando modificar los ajustes del diagnóstico del disco duro. - fi - __APPNAME__ yrittää muokata kovalevyn diagnostiikka-asetuksia. - fr - __APPNAME__ essaye de modifier les réglages de diagnostic de votre disque dur. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים את הגדרות האבחון עבור הכונן שלך. - hr - __APPNAME__ pokuÅ¡ava preinačiti dijagnostičke postavke za vaÅ¡ tvrdi disk. - hu - A(z) __APPNAME__ megpróbálja módosítani a merevlemez diagnosztikai beállításait. - it - __APPNAME__ sta cercando di modificare le impostazioni di diagnostica del disco rigido. - ja - __APPNAME__ は、ハード・ドライブの診断設定を変更しようとしています。 - ko - __APPNAME__이(가) 사용자의 하드 드라이브에 대한 진단 설정을 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre diagnostikkinnstillingene for harddisken. - nl - __APPNAME__ probeert de diagnostische instellingen voor uw harde schijf te wijzigen. - pl - __APPNAME__ próbuje zmienić ustawienia diagnostyki dysku twardego. - pt - __APPNAME__ está tentando modificar os ajustes de diagnóstico para seu disco rígido. - pt-PT - O __APPNAME__ está a tentar modificar as definições de diagnóstico do disco rígido. - ro - __APPNAME__ încearcă să schimbe configurările de diagnoză pentru hard discul dvs. - ru - Программа «__APPNAME__» пытается модифицировать настройки диагностики для Вашего жесткого диска. - sk - __APPNAME__ sa pokúša upraviÅ¥ nastavenia diagnostiky vášho pevného disku. - sv - __APPNAME__ försöker ändra de diagnostiska inställningarna för din hÃ¥rddisk. - th - __APPNAME__ กำลังพยายามแก้ไขค่าติดตั้งการวินิจฉัยสำหรับฮาร์ดไดร์ฟของคุณ - tr - __APPNAME__, sabit sürücünüzün tanı ayarlarını değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри діагностики вашого жорсткого диска. - zh-Hans - “__APPNAME__”正试图修改硬盘的诊断设置。 - zh-Hant - “__APPNAME__”正在嘗試修改硬碟的診斷設定。 - - - system.identity.write. - - class - rule - comment - For creating, changing or deleting local user accounts and groups. - default-button - - ar - تحديث المستخدمين - ca - Actualitzar els usuaris - cs - Aktualizovat uživatele - da - Opdater brugere - de - Benutzer aktualisieren - el - Ενημέρωση χρηστών - en - Update Users - es - Actualizar usuarios - fi - Päivitä käyttäjät - fr - Mettre à jour les utilisateurs - he - עדכן/י משתמשים - hr - Ažuriraj korisnike - hu - Felhasználók frissítése - it - Aggiorna gli utenti - ja - ユーザをアップデート - ko - 사용자 업데이트 - nb - Oppdater brukere - nl - Werk gebruikers bij - pl - Uaktualnij użytkowników - pt - Atualizar Usuários - pt-PT - Actualizar utilizadores - ro - Actualizează utilizatorii - ru - Обновить пользователей - sk - AktualizovaÅ¥ užívateľov - sv - Uppdatera användare - th - ปรับปรุงผู้ใช้ - tr - Kullanıcıları Güncelle - uk - Оновити користувачів - zh-Hans - 更新用户 - zh-Hant - 更新使用者 - - default-prompt - - ar - يحاول__APPNAME__ تحديث مجموعة المستخدمين المحليين. - ca - __APPNAME__ està intentant actualitzar el conjunt d’usuaris locals. - cs - __APPNAME__ se pokouší aktualizovat sadu místních uživatelů. - da - __APPNAME__ forsøger at opdatere gruppen af lokale brugere. - de - __APPNAME__ versucht, die Gruppe der lokalen Benutzer zu aktualisieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ενημερώσει το σύνολο των τοπικών χρηστών. - en - __APPNAME__ is trying to update the set of local users. - es - __APPNAME__ está intentando actualizar el conjunto de usuarios locales. - fi - __APPNAME__ yrittää päivittää paikallisia käyttäjiä. - fr - __APPNAME__ essaye de mettre à jour le groupe d’utilisateurs locaux. - he - ×´ __APPNAME__×´ מבקש לעדכן את קבוצת המשתמשים המקוריים. - hr - __APPNAME__ pokuÅ¡ava ažurirati set lokalnih korisnika. - hu - A(z) __APPNAME__ megpróbálja frissíteni a helyi felhasználók csoportját. - it - __APPNAME__ sta cercando di aggiornare una serie di utenti locali. - ja - __APPNAME__ は、ローカルユーザのセットをアップデートしようとしています。 - ko - __APPNAME__이(가) 로컬 사용자 모음을 업데이트하려고 합니다. - nb - __APPNAME__ prøver Ã¥ oppdatere settet med lokale brukere. - nl - __APPNAME__ probeert de set met lokale gebruikers bij te werken. - pl - __APPNAME__ próbuje uaktualnić zastaw użytkowników lokalnych. - pt - __APPNAME__ está tentando atualizar o grupo de usuários locais. - pt-PT - O __APPNAME__ está a tentar actualizar o conjunto de utilizadores locais. - ro - __APPNAME__ încearcă să actualizeze setul de utilizatori locali. - ru - Программа «__APPNAME__» пытается обновить набор локальных пользователей. - sk - __APPNAME__ sa pokúša aktualizovaÅ¥ lokálnych užívateľov. - sv - __APPNAME__ försöker uppdatera uppsättningen lokala användare. - th - __APPNAME__ กำลังพยายามปรับปรุงกลุ่มผู้ใช้ภายใน - tr - __APPNAME__, yerel kullanıcılar kümesini güncellemeye çalışıyor. - uk - Програма «__APPNAME__» намагається оновити набір локальних користувачів. - zh-Hans - “__APPNAME__”正试图更新本地用户组。 - zh-Hant - “__APPNAME__”正在嘗試更新本機使用者群組。 - - k-of-n - 1 - rule - - is-admin - authenticate-admin - - - system.identity.write.credential - - class - rule - comment - Checked when changing authentication credentials (password or certificate) for a local user account. - default-button - - ar - تحديث الاعتمادات - ca - Actualitzar les credencials - cs - Aktualizovat pověření - da - Opdater beviser - de - Accountdaten aktualisieren - el - Ενημέρωση διαπιστευτηρίων - en - Update Credentials - es - Actualizar credenciales - fi - Päivitä valtakirjat - fr - Mettre à jour les références - he - עדכן/י אישורים - hr - Ažuriraj vjerodajnice - hu - Hitelesítés frissítése - it - Aggiorna credenziali - ja - 資格情報をアップデート - ko - 자격 증명 업데이트 - nb - Oppdater akkreditiver - nl - Werk toegangsgegevens bij - pl - Uaktualnij dane uwierzytelniania - pt - Atualizar Credenciais - pt-PT - Actualizar credenciais - ro - Actualizează acreditările - ru - Обновить учетные данные - sk - AktualizovaÅ¥ prihlasovacie údaje - sv - Uppdatera ID-handlingar - th - ปรับปรุงการรับรอง - tr - Kimlik Bilgilerini Güncelle - uk - Оновити інформацію - zh-Hans - 更新凭证 - zh-Hant - 更新憑證 - - default-prompt - - ar - يحاول __APPNAME__ تحديث بيانات المصادقة. - ca - __APPNAME__ està intentant actualitzar les credencials d’autenticació. - cs - __APPNAME__ se pokouší aktualizovat pověření pro ověření totožnosti. - da - __APPNAME__ forsøger at opdatere godkendelsesoplysningerne. - de - __APPNAME__ versucht, die Accountdaten zur Authentifizierung zu aktualisieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ενημερώσει τα διαπιστευτήρια ελέγχου ταυτότητας. - en - __APPNAME__ is trying to update the authentication credentials. - es - __APPNAME__ está intentando actualizar las credenciales de autenticación. - fi - __APPNAME__ yrittää päivittää todentamisen valtakirjoja. - fr - __APPNAME__ essaye de mettre à jour les informations d’authentification. - he - ×´ __APPNAME__×´ מבקש לעדכן את אישורי האימות. - hr - __APPNAME__ pokuÅ¡ava ažurirati vjerodajnice za autorizaciju. - hu - A(z) __APPNAME__ megpróbálja frissíteni a hitelesítési adatokat. - it - __APPNAME__ sta cercando di aggiornare le credenziali di autenticazione. - ja - __APPNAME__ は認証資格情報をアップデートしようとしています。 - ko - __APPNAME__이(가) 인증 증명서를 업데이트하려고 합니다. - nb - __APPNAME__ prøver Ã¥ oppdatere godkjenningsakkreditivene. - nl - __APPNAME__ probeert de gegevens voor identiteitscontrole bij te werken. - pl - __APPNAME__ próbuje uaktualnić dane uwierzytelniania. - pt - __APPNAME__ está tentando atualizar as credenciais de autenticação. - pt-PT - O __APPNAME__ está a tentar actualizar as credenciais de autenticação. - ro - __APPNAME__ încearcă să actualizeze acreditările de autentificare. - ru - Программа «__APPNAME__» пытается обновить учетные данные для аутентификации. - sk - __APPNAME__ sa pokúša aktualizovaÅ¥ autentifikačné údaje. - sv - __APPNAME__ försöker uppdatera autentiseringsuppgifterna. - th - __APPNAME__ กำลังพยายามปรับปรุงการรับรองการอนุญาตของคุณ - tr - __APPNAME__, kimlik doğrulama bilgilerini güncellemeye çalışıyor. - uk - Програма «__APPNAME__» намагається оновити інформацію авторизації. - zh-Hans - “__APPNAME__”正试图更新鉴定凭证。 - zh-Hant - “__APPNAME__”正在嘗試更新認證憑證。 - - rule - default - - system.identity.write.self - - authenticate-user - - class - user - comment - Checked when changing authentication credentials (password or certificate) for the current user's account. - default-button - - ar - تحديث الاعتمادات - ca - Actualitzar les credencials - cs - Aktualizovat pověření - da - Opdater beviser - de - Accountdaten aktualisieren - el - Ενημέρωση διαπιστευτηρίων - en - Update Credentials - es - Actualizar credenciales - fi - Päivitä valtakirjat - fr - Mettre à jour les références - he - עדכן אישורים - hr - Ažuriraj vjerodajnice - hu - Hitelesítés frissítése - it - Aggiorna credenziali - ja - 資格情報をアップデート - ko - 자격 증명 업데이트 - nb - Oppdater akkreditiver - nl - Werk toegangsgegevens bij - pl - Uaktualnij dane uwierzytelniania - pt - Atualizar Credenciais - pt-PT - Actualizar credenciais - ro - Actualizează acreditările - ru - Обновить учетные данные - sk - AktualizovaÅ¥ prihlasovacie údaje - sv - Uppdatera ID-handlingar - th - ปรับปรุงการรับรอง - tr - Kimlik Bilgilerini Güncelle - uk - Оновити інформацію - zh-Hans - 更新凭证 - zh-Hant - 更新憑證 - - default-prompt - - ar - يحاول __APPNAME__ تحديث بيانات المصادقة الخاصة بك. - ca - __APPNAME__ està intentant actualitzar les credencials d’autenticació. - cs - __APPNAME__ se pokouší aktualizovat vaÅ¡e pověření pro ověření totožnosti. - da - __APPNAME__ forsøger at opdatere dine godkendelsesoplysninger. - de - __APPNAME__ versucht, Ihre Accountdaten zur Authentifizierung zu aktualisieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ενημερώσει τα διαπιστευτήρια ελέγχου ταυτότητάς σας. - en - __APPNAME__ is trying to update your authentication credentials. - es - __APPNAME__ está intentando actualizar sus credenciales de autenticación. - fi - __APPNAME__ yrittää päivittää todentamisen valtakirjoja. - fr - __APPNAME__ essaye de mettre à jour vos informations d’authentification. - he - ×´ __APPNAME__×´ מבקש לעדכן את אישורי האימות שלך. - hr - __APPNAME__ pokuÅ¡ava ažurirati vaÅ¡e vjerodajnice za autorizaciju. - hu - A(z) __APPNAME__ megpróbálja frissíteni az Ön hitelesítési adatait. - it - __APPNAME__ sta cercando di aggiornare le tue credenziali di autenticazione. - ja - __APPNAME__ は、認証資格情報をアップデートしようとしています。 - ko - __APPNAME__이(가) 사용자의 인증 증명서를 업데이트하려고 합니다. - nb - __APPNAME__ prøver Ã¥ oppdatere godkjenningsakkreditivene. - nl - __APPNAME__ probeert uw gegevens voor identiteitscontrole bij te werken. - pl - __APPNAME__ próbuje uaktualnić dane uwierzytelniania. - pt - __APPNAME__ está tentando atualizar suas credenciais de autenticação. - pt-PT - O __APPNAME__ está a tentar actualizar as suas credenciais de autenticação. - ro - __APPNAME__ încearcă să actualizeze acreditările dvs. de autentificare. - ru - Программа «__APPNAME__» пытается обновить Ваши учетные данные для аутентификации. - sk - __APPNAME__ sa pokúša aktualizovaÅ¥ autentifikačné údaje. - sv - __APPNAME__ försöker uppdatera dina autentiseringsuppgifter. - th - __APPNAME__ กำลังพยายามปรับปรุงการรับรองการอนุญาตของคุณ - tr - __APPNAME__, kimlik doğrulama bilgilerinizi güncellemeye çalışıyor. - uk - Програма «__APPNAME__» намагається оновити вашу інформацію авторизації. - zh-Hans - “__APPNAME__”正试图更新您的鉴定凭证。 - zh-Hant - “__APPNAME__”正在嘗試更新您的認證憑證。 - - session-owner - - - system.install.app-store-software - - class - rule - comment - Checked when user is installing software from the App Store. - default-button - - ar - تثبيت البرنامج - ca - Instal·lar programari - cs - Nainstalovat software - da - Installer software - de - Software installieren - el - Εγκατάσταση λογισμικού - en - Install Software - es - Instalar software - fi - Asenna ohjelmisto - fr - Installer le logiciel - he - התקן/י - hr - Instaliraj softver - hu - Szoftver telepítése - it - Installa software - ja - ソフトウェアをインストール - ko - 소프트웨어 설치 - nb - Installer programvare - nl - Installeer software - pl - Zainstaluj oprogramowanie - pt - Instalar Software - pt-PT - Instalar software - ro - Instalează software-ul - ru - Установить ПО - sk - InÅ¡talovaÅ¥ softvér - sv - Installera programvara - th - ติดตั้งซอฟต์แวร์ - tr - Yazılımı Yükle - uk - Інсталювати ПЗ - zh-Hans - 安装软件 - zh-Hant - 安裝軟體 - - default-prompt - - ar - يحاول __APPNAME__ تثبيت البرنامج. - ca - __APPNAME__ està intentant instal·lar programari. - cs - __APPNAME__ se pokouší nainstalovat software. - da - __APPNAME__ prøver at installere software. - de - __APPNAME__ versucht, Software zu installieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να εγκαταστήσει λογισμικό. - en - __APPNAME__ is trying to install software. - es - __APPNAME__ está intentando instalar software. - fi - __APPNAME__ yrittää asentaa ohjelmistoa. - fr - __APPNAME__ essaie d’installer un logiciel. - he - ‏__APPNAME__ מנסה להתקין תוכנה. - hr - __APPNAME__ pokuÅ¡ava instalirati softver. - hu - A(z) __APPNAME__ megpróbál szoftvert telepíteni. - it - __APPNAME__ sta tentando di installare il software. - ja - __APPNAME__ は、ソフトウェアをインストールしようとしています。 - ko - __APPNAME__이(가) 소프트웨어를 설치하려고 합니다. - nb - __APPNAME__ prøver Ã¥ installere programvare. - nl - __APPNAME__ probeert software te installeren. - pl - __APPNAME__ próbuje zainstalować oprogramowanie. - pt - __APPNAME__está tentando instalar um software. - pt-PT - __APPNAME__ está a tentar instalar software. - ro - __APPNAME__ încearcă să instaleze software. - ru - __APPNAME__ пытается установить ПО. - sk - __APPNAME__ sa pokúša inÅ¡talovaÅ¥ softvér. - sv - __APPNAME__ försöker installera programvara. - th - __APPNAME__ กำลังพยายามติดตั้งซอฟต์แวร์ - tr - __APPNAME__, yazılım yüklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається інсталювати програмне забезпечення. - zh-Hans - __APPNAME__ 正在尝试安装软件。 - zh-Hant - __APPNAME__ 正在嘗試安裝軟體。 - - rule - entitled-appstore-or-entitled-authenticate-appstore - - system.install.apple-config-data - - allow-root - - class - rule - rule - entitled - - system.install.apple-software - - class - rule - comment - Checked when user is installing Apple-provided software. - default-button - - ar - تثبيت البرنامج - ca - Instal·lar programari - cs - Nainstalovat software - da - Installer software - de - Software installieren - el - Εγκατάσταση λογισμικού - en - Install Software - es - Instalar software - fi - Asenna ohjelmisto - fr - Installer le logiciel - he - התקן/י - hr - Instaliraj softver - hu - Szoftver telepítése - it - Installa software - ja - ソフトウェアをインストール - ko - 소프트웨어 설치 - nb - Installer programvare - nl - Installeer software - pl - Zainstaluj oprogramowanie - pt - Instalar Software - pt-PT - Instalar software - ro - Instalează software - ru - Установить ПО - sk - InÅ¡talovaÅ¥ softvér - sv - Installera programvara - th - ติดตั้งซอฟต์แวร์ - tr - Yazılımı Yükle - uk - Інсталювати ПЗ - zh-Hans - 安装软件 - zh-Hant - 安裝軟體 - - default-prompt - - ar - يحاول __APPNAME__ تثبيت البرنامج الموّفَر من Apple. - ca - __APPNAME__ està intentant instal·lar programari subministrat per Apple. - cs - __APPNAME__ se pokouší nainstalovat software poskytovaný společností Apple. - da - __APPNAME__ prøver at installere software leveret af Apple. - de - __APPNAME__ versucht, von Apple bereitgestellte Software zu installieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να εγκαταστήσει λογισμικό που παρέχεται από την Apple. - en - __APPNAME__ is trying to install Apple-provided software. - es - __APPNAME__ está intentando instalar software proporcionado por Apple. - fi - __APPNAME__ yrittää asentaa Applen ohjelmistoa. - fr - __APPNAME__ essaie d’installer un logiciel fourni par Apple. - he - ×´ __APPNAME__×´ מבקש להתקין תוכנות מבית Apple. - hr - __APPNAME__ pokuÅ¡ava instalirati Apple softver. - hu - A(z) __APPNAME__ megpróbál egy Apple által szolgáltatott szoftvert telepíteni. - it - __APPNAME__ sta tentando di installare il software fornito da Apple. - ja - __APPNAME__ は、アップル提供のソフトウェアをインストールしようとしています。 - ko - __APPNAME__이(가) Apple에서 제공한 소프트웨어를 설치하려고 합니다. - nb - __APPNAME__ prøver Ã¥ installere programvare som er levert av Apple. - nl - __APPNAME__ probeert van Apple afkomstige software te installeren. - pl - __APPNAME__ próbuje zainstalować oprogramowanie udostępnione przez Apple. - pt - __APPNAME__ está tentando instalar um software fornecido pela Apple. - pt-PT - __APPNAME__ está a tentar instalar software da Apple. - ro - __APPNAME__ încearcă să instaleze software furnizat de Apple. - ru - __APPNAME__ пытается установить ПО, предоставленное компанией Apple. - sk - __APPNAME__ sa pokúša inÅ¡talovaÅ¥ softvér spoločnosti Apple. - sv - __APPNAME__ försöker installera programvara frÃ¥n Apple. - th - __APPNAME__ กำลังพยายามติดตั้งซอฟต์แวร์ที่ให้มาโดย Apple - tr - __APPNAME__, Apple tarafından sağlanan yazılımı yüklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається інсталювати програмне забезпечення Apple. - zh-Hans - __APPNAME__ 正在尝试安装 Apple 提供的软件。 - zh-Hant - __APPNAME__ 正在嘗試安裝 Apple 提供的軟體。 - - rule - root-or-entitled-admin-or-authenticate-admin - - system.install.software - - allow-root - - class - user - comment - Checked when user is installing new software. - default-button - - ar - تثبيت البرنامج - ca - Instal·lar programari - cs - Nainstalovat software - da - Installer software - de - Software installieren - el - Εγκατάσταση λογισμικού - en - Install Software - es - Instalar software - fi - Asenna ohjelmisto - fr - Installer le logiciel - he - התקן/י - hr - Instaliraj softver - hu - Szoftver telepítése - it - Installa software - ja - ソフトウェアをインストール - ko - 소프트웨어 설치 - nb - Installer programvare - nl - Installeer software - pl - Zainstaluj oprogramowanie - pt - Instalar Software - pt-PT - Instalar software - ro - Instalează software - ru - Установить ПО - sk - InÅ¡talovaÅ¥ softvér - sv - Installera programvara - th - ติดตั้งซอฟต์แวร์ - tr - Yazılımı Yükle - uk - Інсталювати ПЗ - zh-Hans - 安装软件 - zh-Hant - 安裝軟體 - - default-prompt - - ar - يحاول __APPNAME__ تثبيت برنامج جديد. - ca - __APPNAME__ està intentant instal·lar programari nou. - cs - __APPNAME__ se pokouší nainstalovat nový software. - da - __APPNAME__ forsøger at installere ny software. - de - __APPNAME__ versucht, neue Software zu installieren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να εγκαταστήσει νέο λογισμικό. - en - __APPNAME__ is trying to install new software. - es - __APPNAME__ está intentando instalar software nuevo. - fi - __APPNAME__ yrittää asentaa uutta ohjelmistoa. - fr - __APPNAME__ essaye d’installer un nouveau logiciel. - he - ×´__APPNAME__×´ מבקש להתקין תוכנות חדשות. - hr - __APPNAME__ pokuÅ¡ava instalirati novi softver. - hu - A(z) __APPNAME__ megpróbál egy új szoftvert telepíteni. - it - __APPNAME__ sta cercando di installare nuovo software. - ja - __APPNAME__ は、新しいソフトウェアをインストールしようとしています。 - ko - __APPNAME__이(가) 새로운 소프트웨어를 설치하려고 합니다. - nb - __APPNAME__ prøver Ã¥ installere ny programvare. - nl - __APPNAME__ probeert nieuwe software te installeren. - pl - __APPNAME__ próbuje zainstalować nowe oprogramowanie. - pt - __APPNAME__ está tentando instalar um novo software. - pt-PT - O __APPNAME__ está a tentar instalar software novo. - ro - __APPNAME__ încearcă să instaleze software nou. - ru - Программа «__APPNAME__» пытается установить новое ПО. - sk - __APPNAME__ sa pokúša inÅ¡talovaÅ¥ nový softvér. - sv - __APPNAME__ försöker installera ny programvara. - th - __APPNAME__ กำลังพยายามติดตั้งซอฟต์แวร์ใหม่ - tr - __APPNAME__, yeni yazılım yüklemeye çalışıyor. - uk - Програма «__APPNAME__» намагається інсталювати нове програмне забезпечення. - zh-Hans - “__APPNAME__”正试图安装新软件。 - zh-Hant - “__APPNAME__”正在嘗試安裝新的軟體。 - - group - admin - shared - - timeout - 300 - - system.keychain.create.loginkc - - allow-root - - class - evaluate-mechanisms - comment - Used by the Security framework when you add an item to an unconfigured default keychain. - mechanisms - - loginKC:queryCreate - loginKC:showPasswordUI - authinternal - - session-owner - - shared - - - system.keychain.modify - - class - user - comment - Used by Keychain Access when editing a system keychain. - default-button - - ar - تعديل Keychain - ca - Modificar el clauer - cs - Změnit svazek klíčů - da - Juster nøglering - de - Schlüsselbund ändern - el - Τροποποίηση κλειδοθήκης - en - Modify Keychain - es - Modificar llavero - fi - Muokkaa avainnippua - fr - Modifer le trousseau - he - ערוך/י את צרור המפתחות - hr - Preinači keychain - hu - Kulcskarika módosítása - it - Modifica portachiavi - ja - キーチェーンを変更 - ko - 키체인 수정 - nb - Endre nøkkelring - nl - Wijzig sleutelhanger - pl - Zmień pęk kluczy - pt - Modificar Chaves - pt-PT - Modificar porta‑chaves - ro - Modifică portcheiul - ru - Модифицировать связку ключей - sk - UpraviÅ¥ kľúčenku - sv - Ändra nyckelringen - th - แก้ไขคีย์เชน - tr - Anahtar Zincirini Değiştir - uk - Змінити в’язку - zh-Hans - 修改钥匙串 - zh-Hant - 修改鑰匙圈 - - default-prompt - - ar - يحاول __APPNAME__ تعديل سلسلة مفاتيح النظام. - ca - __APPNAME__ està intentant modificar el clauer del sistema. - cs - __APPNAME__ se pokouší změnit systémový svazek klíčů. - da - __APPNAME__ forsøger at ændre systemnøgleringen. - de - __APPNAME__ versucht, den System-Schlüsselbund zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει την κλειδοθήκη συστήματος. - en - __APPNAME__ is trying to modify the system keychain. - es - __APPNAME__ está intentando modificar el llavero del sistema. - fi - __APPNAME__ yrittää muokata järjestelmän avainnippua. - fr - __APPNAME__ essaye de modifier le trousseau du système. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בצרור המפתחות של המערכת. - hr - __APPNAME__ pokuÅ¡ava preinačiti keychain bazu sustava. - hu - A(z) __APPNAME__ megpróbálja módosítani a rendszer-kulcskarikát. - it - __APPNAME__ sta cercando di modificare il portachiavi di sistema. - ja - __APPNAME__ は、システムキーチェーンを変更しようとしています。 - ko - __APPNAME__이(가) 시스템 키체인을 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre systemnøkkelringen. - nl - __APPNAME__ probeert de systeemsleutelhanger te wijzigen. - pl - __APPNAME__ próbuje zmodyfikować systemowy pęk kluczy. - pt - __APPNAME__ está tentando modificar as chaves do sistema. - pt-PT - O __APPNAME__ está a tentar modificar o porta‑chaves do sistema. - ro - __APPNAME__ încearcă să modifice portcheiul de sistem. - ru - Программа «__APPNAME__» пытается модифицировать связку ключей системы. - sk - __APPNAME__ sa pokúša upraviÅ¥ systémovú kľúčenku. - sv - __APPNAME__ försöker ändra systemets nyckelring. - th - __APPNAME__ กำลังพยายามแก้ไขคีย์เชนของระบบ - tr - __APPNAME__, sistem anahtar zincirini değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити системну в’язку ключів. - zh-Hans - “__APPNAME__”正试图修改系统钥匙串。 - zh-Hant - “__APPNAME__”正在嘗試修改系統鑰匙圈。 - - group - admin - shared - - timeout - 30 - - system.login.console - - class - evaluate-mechanisms - comment - Login mechanism based rule. Not for general use, yet. - mechanisms - - builtin:policy-banner - loginwindow:login - builtin:login-begin - builtin:reset-password,privileged - builtin:forward-login,privileged - builtin:auto-login,privileged - builtin:authenticate,privileged - PKINITMechanism:auth,privileged - builtin:login-success - loginwindow:success - HomeDirMechanism:login,privileged - HomeDirMechanism:status - MCXMechanism:login - loginwindow:done - - - system.login.done - - class - evaluate-mechanisms - mechanisms - - - system.login.screensaver - - class - rule - comment - The owner or any administrator can unlock the screensaver. - rule - authenticate-session-owner-or-admin - - system.login.tty - - class - evaluate-mechanisms - mechanisms - - push_hints_to_context - authinternal - - tries - 1 - - system.preferences - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to certain System Preferences. - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י הגדרות - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าติดตั้ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل إعدادات النظام الخاص بك. - ca - __APPNAME__ està intentant modificar la configuració del sistema. - cs - __APPNAME__ se pokouší změnit systémová nastavení. - da - __APPNAME__ forsøger at ændre systemindstillingerne. - de - __APPNAME__ versucht, Ihre Systemeinstellungen zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις ρυθμίσεις του συστήματός σας. - en - __APPNAME__ is trying to modify your system settings. - es - __APPNAME__ está intentando modificar los ajustes del sistema. - fi - __APPNAME__ yrittää muokata järjestelmän asetuksia. - fr - __APPNAME__ essaye de modifier vos réglages de système. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים את ההגדרות במחשב. - hr - __APPNAME__ pokuÅ¡ava preinačiti vaÅ¡e postavke sustava. - hu - A(z) __APPNAME__ megpróbálja módosítani a rendszerbeállításokat. - it - __APPNAME__ sta cercando di modificare le impostazioni del sistema. - ja - __APPNAME__ は、システムの設定を変更しようとしています。 - ko - __APPNAME__이(가) 사용자의 시스템 설정을 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre systeminnstillingene. - nl - __APPNAME__ probeert uw systeeminstellingen te wijzigen. - pl - __APPNAME__ próbuje zmienić ustawienia systemowe. - pt - __APPNAME__ está tentando modificar seus ajustes do sistema. - pt-PT - O __APPNAME__ está a tentar modificar as definições do sistema. - ro - __APPNAME__ încearcă să schimbe configurările dvs. de sistem. - ru - Программа «__APPNAME__» пытается модифицировать Ваши системные настройки. - sk - __APPNAME__ sa pokúša upraviÅ¥ vaÅ¡e systémové nastavenia. - sv - __APPNAME__ försöker ändra systemets inställningar. - th - __APPNAME__ กำลังพยายามแก้ไขค่าติดตั้งระบบของคุณ - tr - __APPNAME__, sistem ayarlarınızı değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити ваші системні параметри. - zh-Hans - “__APPNAME__”正试图修改您的系统设置。 - zh-Hant - “__APPNAME__”正在嘗試修改您的系統設定。 - - group - admin - shared - - - system.preferences.accessibility - - allow-root - - class - user - comment - Checked by the Admin framework when enabling or disabling the Accessibility APIs. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロックを解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ إلغاء قفل تفضيلات إمكانية الوصول. - ca - __APPNAME__ està provant de desbloquejar les preferències d’Accessibilitat. - cs - __APPNAME__ se pokouší odemknout předvolby Zpřístupnění. - da - __APPNAME__ prøver at lÃ¥se indstillingerne i Tilgængelighed op. - de - __APPNAME__ versucht, den Schutz der Systemeinstellung „Bedienungshilfen“ aufzuheben. - el - Η εφαρμογή «__APPNAME__» προσπαθεί να ξεκλειδώσει τις προτιμήσεις για την Προσβασιμότητα. - en - __APPNAME__ is trying to unlock Accessibility preferences. - es - __APPNAME__ está intentando desbloquear las preferencias del panel Accesibilidad. - fi - __APPNAME__ yrittää avata Käyttöapu-asetukset. - fr - __APPNAME__ essaye de déverrouiller les préférences Accessibilité. - he - __APPNAME__ מנסה לבטל את הנעילה של העדפות ״נגישות״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke pristupačnosti. - hu - A(z) __APPNAME__ megpróbálja feloldani a Kisegítő lehetőségek beállításainak zárolását. - it - __APPNAME__ tenta di sbloccare le preferenze Accessibilità. - ja - __APPNAME__ は、“アクセシビリティ”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 손쉬운 사용 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Tilgjengelighet-valg. - nl - __APPNAME__ probeert de Toegankelijkheid-voorkeuren te ontgrendelen. - pl - __APPNAME__ próbuje odblokować panel preferencji Dostępność. - pt - __APPNAME__ está tentando desbloquear as preferências Acessibilidade. - pt-PT - O __APPNAME__ está a tentar desproteger as preferências da Acessibilidade. - ro - __APPNAME__ încearcă să deblocheze preferințele Accesibilitate. - ru - Программа «__APPNAME__» пытается снять защиту с настроек Универсального доступа. - sk - Aplikácia __APPNAME__ sa pokúša odomknúť nastavenia Prístupnosti. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Hjälpmedel. - th - __APPNAME__ กำลังพยายามปลดล็อกการตั้งค่าผู้พิการ - tr - __APPNAME__, Erişilebilirlik tercihlerinin kilidini açmaya çalışıyor. - uk - __APPNAME__ намагається відімкнути параметри Спеціальних можливостей. - zh-Hans - “__APPNAME__”正在尝试解锁“辅助功能”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“輔助使用”偏好設定。 - - group - admin - shared - - timeout - 0 - - system.preferences.accounts - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Users & Groups preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロックを解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فك قفل تفضيلات المستخدمين والمجموعات. - ca - __APPNAME__ està intentant debloquejar el tauler de preferències Usuaris i Grups. - cs - __APPNAME__ se pokouší odemknout předvolby Uživatelé a skupiny. - da - __APPNAME__ forsøger at lÃ¥se Brugere & grupper op. - de - __APPNAME__ versucht, die Systemeinstellung „Benutzer & Gruppen“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις χρηστών και ομάδων. - en - __APPNAME__ is trying to unlock Users & Groups preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Usuarios y Grupos. - fi - __APPNAME__ yrittää avata Käyttäjät ja ryhmät -asetuksia. - fr - __APPNAME__ essaye de déverrouiller les préférences Utilisateurs et groupes. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״משתמשים וקבוצות״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Korisnici i grupe. - hu - A(z) __APPNAME__ megpróbálja feloldani a Csoportok és felhasználók beállításait. - it - __APPNAME__ sta cercando di sbloccare le preferenze di gruppi e utenti. - ja - __APPNAME__ は、“ユーザとグループ”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 사용자 및 그룹 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Brukere og grupper-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Gebruikers en groepen' te ontgrendelen. - pl - __APPNAME__ odblokować preferencje Użytkownicy i grupy. - pt - __APPNAME__ está tentando desbloquear as preferências Usuários e Grupos. - pt-PT - O __APPNAME__ está a tentar desproteger as preferências de Utilizadores e Grupos. - ro - __APPNAME__ încearcă să deblocheze preferințele Utilizatori și grupuri. - ru - Программа «__APPNAME__» пытается снять защиту с настроек «Пользователи и группы». - sk - __APPNAME__ sa pokúša odomknúť nastavenia Užívatelia a skupina. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Användare och grupper. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งผู้ใช้และกลุ่ม - tr - __APPNAME__, Kullanıcılar ve Gruplar tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Користувачів і груп. - zh-Hans - “__APPNAME__”正试图解锁“用户与群组”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“使用者與群組”偏好設定。 - - group - admin - shared - - - system.preferences.datetime - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Date & Time preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - حاول __APPNAME__ فتح قفل تفضيلات التاريخ والوقت. - ca - __APPNAME__ està intentant debloquejar el tauler de preferències Data i Hora. - cs - __APPNAME__ se pokouší odemknout předvolby Datum a čas. - da - __APPNAME__ prøver at lÃ¥se vinduet Dato & tid op. - de - __APPNAME__ versucht, die Systemeinstellung „Datum & Uhrzeit“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις ημερομηνίας και ώρας. - en - __APPNAME__ is trying to unlock the Date & Time preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Fecha y Hora. - fi - __APPNAME__ yrittää avata Päivämäärä ja aika -asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Date et heure - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״שעה ותאריך״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Datum i vrijeme. - hu - A(z) __APPNAME__ megpróbálja feloldani a Dátum és idő beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze di Data e ora. - ja - __APPNAME__ が“日付と時刻”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 날짜와 시간 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Dato og tid-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Datum en tijd' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje daty i czasu. - pt - __APPNAME__ está tentando desbloquear as preferências Data e Hora. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Data e Hora. - ro - __APPNAME__ încearcă să deblocheze preferințele Dată și oră. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели «Дата и время». - sk - __APPNAME__ sa pokúša odomknúť nastavenia dátumu a času. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Datum och tid. - th - __APPNAME__ กำลังพยายามปลอดล็อกค่าปรับแต่งวันที่และเวลา - tr - __APPNAME__, Tarih ve Saat tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Дати і часу. - zh-Hans - “__APPNAME__”正试图解锁“日期与事件”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“日期與時間”偏好設定。 - - group - admin - shared - - - system.preferences.energysaver - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Energy Saver preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - _يحاول __APPNAME__ فتح قفل تفضيلات موفر الطاقة. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Economitzador. - cs - __APPNAME__ se pokouší odemknout předvolby Úspora energie. - da - __APPNAME__ prøver at lÃ¥se vinduet Energibesparelse op. - de - __APPNAME__ versucht, die Systemeinstellung „Energie sparen“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις εξοικονόμησης ενέργειας. - en - __APPNAME__ is trying to unlock the Energy Saver preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Economizador. - fi - __APPNAME__ yrittää avata Energiansäästäjä-asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Économiseur d’énergie. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״חסכון באנרגיה״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Å tednja energije. - hu - A(z) __APPNAME__ megpróbálja feloldani az Energiatakarékos mód beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze di Risparmio di energia. - ja - __APPNAME__ が“省エネルギー”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 에너지 절약 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Strømsparing-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Energiestand' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje oszczędzania energii. - pt - __APPNAME__ está tentando desbloquear as preferências Economizador de Energia. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Poupança de Energia. - ro - __APPNAME__ încearcă să deblocheze preferințele Economizor. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели «Экономия энергии». - sk - __APPNAME__ sa pokúša odomknúť nastavenia Å¡etriča energie. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Strömsparare. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งตัวช่วยประหยัดพลังงาน - tr - __APPNAME__, Enerji Tasarrufu tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Збереження енергії. - zh-Hans - “__APPNAME__”正试图解锁“节能器”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“能源節約器”偏好設定。 - - group - admin - shared - - - system.preferences.location - - class - rule - comment - For changing the network location from the Apple menu. - k-of-n - 1 - rule - - on-console - is-admin - is-root - - - system.preferences.network - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Network preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロックを解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فك قفل تفضيلات الشبكة. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Xarxa. - cs - __APPNAME__ se pokouší odemknout předvolby Síť. - da - __APPNAME__ forsøger at lÃ¥se Netværk op. - de - __APPNAME__ versucht, die Systemeinstellung „Netzwerk“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις δικτύου. - en - __APPNAME__ is trying to unlock the Network preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Red. - fi - __APPNAME__ yrittää avata Verkko-asetuksia. - fr - __APPNAME__ essaye de déverrouiller les préférences Réseau. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״רשת״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Mreža. - hu - A(z) __APPNAME__ megpróbálja feloldani a Hálózat beállításait. - it - __APPNAME__ sta cercando di sbloccare le preferenze Network. - ja - __APPNAME__ は、“ネットワーク”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 네트워크 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Nettverk-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Netwerk' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje Sieć. - pt - __APPNAME__ está tentando desbloquear as preferências Rede. - pt-PT - O __APPNAME__ está a tentar desproteger as preferências de Rede. - ro - __APPNAME__ încearcă să deblocheze preferințele Rețea. - ru - Программа «__APPNAME__» пытается установить новый инструмент справки - sk - __APPNAME__ sa pokúša odomknúť nastavenia siete. - sv - __APPNAME__ försöker lÃ¥sa upp nätverksinställningarna. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งเครือข่าย - tr - __APPNAME__, Ağ tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Мережі. - zh-Hans - “__APPNAME__”正试图解锁“网络”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“網路”偏好設定。 - - group - admin - shared - - - system.preferences.nvram - - class - rule - k-of-n - 1 - rule - - entitled - admin - - - system.preferences.parental-controls - - class - user - comment - Checked when making changes to the Parental Controls preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロックを解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فتح قفل تفضيلات الإشراف العائلي. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Controls Parentals. - cs - __APPNAME__ se pokouší odemknout předvolby Rodičovský dohled. - da - __APPNAME__ forsøger at lÃ¥se Børnesikring op. - de - __APPNAME__ versucht, die Systemeinstellung „Kindersicherung“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις γονικού ελέγχου. - en - __APPNAME__ is trying to unlock Parental Controls preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Controles Parentales. - fi - __APPNAME__ yrittää avata Käyttörajoitukset-asetuksia. - fr - __APPNAME__ essaye de déverrouiller les préférences Contrôle parental. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״כלי בקרה להורים״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Roditeljske kontrole. - hu - A(z) __APPNAME__ megpróbálja feloldani a Szülői felügyelet beállításait. - it - __APPNAME__ sta cercando di sbloccare le preferenze dei controlli censura. - ja - __APPNAME__ は、“ペアレンタルコントロール”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 유해 콘텐츠 차단 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Foreldrekontroll-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Ouderlijk toezicht' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje Nadzór rodzicielski. - pt - __APPNAME__ está tentando desbloquear as preferências de Controles Parentais. - pt-PT - O __APPNAME__ está a tentar desproteger as preferências do Controlo Parental. - ro - __APPNAME__ încearcă să deblocheze preferințele Control parental. - ru - Программа «__APPNAME__» пытается снять защиту с настроек Родительского контроля. - sk - __APPNAME__ sa pokúša odomknúť nastavenia rodičovskej ochrany. - sv - __APPNAME__ försöker lÃ¥sa upp Föräldrakontrollsinställningarna. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งการควบคุมโดยผู้ปกครอง - tr - __APPNAME__, Ebeveyn Denetimleri tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Бітьківського контролю. - zh-Hans - “__APPNAME__”正试图解锁“家长控制”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“分級保護控制”偏好設定。 - - group - admin - shared - - - system.preferences.printing - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Printing preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فتح قفل تفضيلات الطباعة والمسح الضوئي. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Impressió i Escaneig. - cs - __APPNAME__ se pokouší odemknout předvolby Tisk a fax. - da - __APPNAME__ prøver at lÃ¥se vinduet Udskriv & scan op. - de - __APPNAME__ versucht, die Systemeinstellung „Drucken & Scannen“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις εκτύπωσης και σάρωσης. - en - __APPNAME__ is trying to unlock the Print & Scan preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Impresión y Escaneado. - fi - __APPNAME__ yrittää avata Tulostus ja skannaus -asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Imprimantes et scanners. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״הדפסה וסריקה״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Ispis i skeniranje. - hu - A(z) __APPNAME__ megpróbálja feloldani a Nyomtatás és szkennelés beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze di Stampa e scansione. - ja - __APPNAME__ が“プリントとファクス”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 프린트 및 스캔 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Utskrift- og skanning-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Afdrukken en scannen' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje drukarki i skanera. - pt - __APPNAME__ está tentando desbloquear as preferências Impressão e Escaneamento. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Impressão e Digitalização. - ro - __APPNAME__ încearcă să deblocheze preferințele Tipărire și scanare. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели «Печать и факс». - sk - __APPNAME__ sa pokúša odomknúť nastavenia tlačiarní a skenerov. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Skrivare och skanner. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งการพิมพ์และสแกน - tr - __APPNAME__, Kağıda Dökme ve Tarama tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Принтерів і сканерів. - zh-Hans - “__APPNAME__”正试图解锁“打印与扫描”偏好设置。 - zh-Hant - “__APPNAME__”在嘗試解鎖“列印與掃描”偏好設定。 - - group - admin - shared - - - system.preferences.security - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Security preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロックを解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ إلغاء تأمين تفضيلات الأمن والخصوصية. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Seguretat i Privadesa. - cs - __APPNAME__ se pokouší odemknout předvolby Zabezpečení a soukromí. - da - __APPNAME__ forsøger at lÃ¥se Sikkerhed & anonymitet op. - de - __APPNAME__ versucht, die Systemeinstellung „Sicherheit & Privatsphäre“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις ασφάλειας και απορρήτου. - en - __APPNAME__ is trying to unlock Security & Privacy preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Seguridad y Privacidad. - fi - __APPNAME__ yrittää avata Suojaus ja yksityisyys -asetuksia. - fr - __APPNAME__ essaye de déverrouiller les préférences Sécurité et confidentialité. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״אבטחה ופרטיות״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Sigurnost i privatnost. - hu - A(z) __APPNAME__ megpróbálja feloldani a Biztonság ás adatvédelem beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze Sicurezza e Privacy. - ja - “__APPNAME__”により“セキュリティとプライバシー”環境設定のロックが解除されます。 - ko - __APPNAME__ 이(가) 보안 및 개인 정보 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Sikkerhet og personvern-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Beveiliging en privacy' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje Ochrona i prywatność. - pt - __APPNAME__ está tentando desbloquear as preferências Segurança e Privacidade. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Segurança e Privacidade. - ro - __APPNAME__ încearcă să deblocheze preferințele Securitate și confidențialitate. - ru - Программа «__APPNAME__» пытается снять защиту с панели «Защита и безопасность». - sk - __APPNAME__ sa pokúša odomknúť nastavenia súkromia a bezpečnosti. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Säkerhet och integritet. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งความปลอดภัยและความเป็นส่วนตัว - tr - __APPNAME__, Güvenlik ve Gizlilik tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Захисту і безпеки. - zh-Hans - “__APPNAME__”正试图解锁“安全性与隐私”偏好设置。 - zh-Hant - __APPNAME__ 正在嘗試解鎖“安全性與隱私”偏好設定。 - - group - admin - shared - - - system.preferences.security.remotepair - - class - rule - comment - Used by Bezel Services to gate IR remote pairing. - default-button - - ar - اقتران - ca - Enllaçar - cs - Párovat - da - Dan par - de - Koppeln - el - Ζευγοποίηση - en - Pair - es - Enlazar - fi - Muodosta pari - fr - Jumeler - he - קשר/י - hr - Upari - hu - Párosítás - it - Abbina - ja - 登録 - ko - 연결 - nb - Sammenkoble - nl - Koppel - pl - Łącz w parę - pt - Emparelhar - pt-PT - Emparelhar - ro - Asociază - ru - Создать пару - sk - SpárovaÅ¥ - sv - Parkoppla - th - เข้าคู่ - tr - Eşle - uk - Створити пару - zh-Hans - 配对 - zh-Hant - 配對 - - default-prompt - - ar - يحاول __APPNAME__ الاقتران بوحدة التحكم عن بعد. - ca - __APPNAME__ està intentant un enllaç remot. - cs - __APPNAME__ se pokouší párovat ovladač. - da - __APPNAME__ forsøger at danne par med fjernbetjeningen. - de - __APPNAME__ versucht, die Fernbedienung zu koppeln. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ζευγοποιήσει το τηλεχειριστήριο. - en - __APPNAME__ is trying to pair the remote. - es - __APPNAME__ está intentando enlazar un mando a distancia. - fi - __APPNAME__ yrittää muodostaa paria kaukosäätimen kanssa. - fr - __APPNAME__ essaye de jumeler la télécommande. - he - ×´ __APPNAME__×´ מבקש לקשר את השלט. - hr - __APPNAME__ pokuÅ¡ava upariti daljinski upravljač. - hu - A(z) __APPNAME__ megpróbálja párosítani a távvezérlőt. - it - __APPNAME__ sta cercando di abbinare il telecomando. - ja - __APPNAME__ は Remote を登録しようとしています。 - ko - __APPNAME__이(가) 리모컨을 연결하려고 합니다. - nb - __APPNAME__ prøver Ã¥ sammenkoble fjernkontrollen. - nl - __APPNAME__ probeert de afstandsbediening te koppelen. - pl - __APPNAME__ próbuje połączyć pilota w parę. - pt - __APPNAME__ está tentando emparelhar o controle remoto. - pt-PT - O __APPNAME__ está a tentar emparelhar o comando. - ro - __APPNAME__ încearcă să asocieze telecomanda. - ru - Программа «__APPNAME__» пытается создать пару с пультом ДУ. - sk - __APPNAME__ sa pokúša spárovaÅ¥ diaľkový ovládač. - sv - __APPNAME__ försöker parkoppla fjärrkontrollen. - th - __APPNAME__ กำลังพยายามเข้าคู่ระยะไกล - tr - __APPNAME__, uzaktan kumandayı eşlemeye çalışıyor. - uk - Програма «__APPNAME__» намагається створити пару з пультом дистанційного керування. - zh-Hans - “__APPNAME__”正试图与遥控器配对。 - zh-Hant - “__APPNAME__”正在嘗試配對遙控器。 - - rule - entitled-admin-or-authenticate-admin - - system.preferences.sharing - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Sharing preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فتح قفل تفضيلات المشاركة. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Compartir. - cs - __APPNAME__ se pokouší odemknout předvolby Sdílení. - da - __APPNAME__ prøver at lÃ¥se vinduet Deling op. - de - __APPNAME__ versucht, die Systemeinstellung „Freigaben“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις κοινής χρήσης. - en - __APPNAME__ is trying to unlock the Sharing preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Compartir. - fi - __APPNAME__ yrittää avata Jako-asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Partage. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״שיתוף״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Dijeljenje. - hu - A(z) __APPNAME__ megpróbálja feloldani a Megosztás beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze di Condivisione. - ja - __APPNAME__ が“共有”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 공유 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Deling-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Delen' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje udostępniania. - pt - __APPNAME__ está tentando desbloquear as preferências Compartilhamento. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Partilha. - ro - __APPNAME__ încearcă să deblocheze preferințele Partajare. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели «Общий доступ». - sk - __APPNAME__ sa pokúša odomknúť nastavenia zdieľania. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Delning. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งการแบ่งปัน - tr - __APPNAME__, Paylaşma tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Спільного доступу. - zh-Hans - “__APPNAME__”正试图解锁“共享”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“共享”偏好設定。 - - group - admin - shared - - - system.preferences.softwareupdate - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Software Update preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فتح قفل تفضيلات محدث البرامج. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Actualització de Programari. - cs - __APPNAME__ se pokouší odemknout předvolby Aktualizace softwaru. - da - __APPNAME__ prøver at lÃ¥se vinduet Softwareopdatering op. - de - __APPNAME__ versucht, die Systemeinstellung „Softwareaktualisierung“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις ενημέρωσης λογισμικού. - en - __APPNAME__ is trying to unlock the Software Update preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Actualización de Software. - fi - __APPNAME__ yrittää avata Ohjelmiston päivitys -asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Mise à jour de logiciels. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״עדכוני תוכנה״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Ažuriranje softvera. - hu - A(z) __APPNAME__ megpróbálja feloldani a szoftverfrissítés beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze di Aggiornamento Software. - ja - __APPNAME__ が“ソフトウェア・アップデート”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 소프트웨어 업데이트 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Programvareoppdatering-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Software-update' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje uaktualnień programów. - pt - __APPNAME__ está tentando desbloquear as preferências Atualização de Software. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Actualização de Software. - ro - __APPNAME__ încearcă să deblocheze preferințele Actualizare software. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели «Обновление программ». - sk - __APPNAME__ sa pokúša odomknúť nastavenia aktualizácie softvéru. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Programuppdatering. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งการอัปเดตซอฟต์แวร์ - tr - __APPNAME__, Yazılım Güncelleme tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Оновлення системи. - zh-Hans - “__APPNAME__”正试图解锁“软件更新”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“軟體更新”偏好設定。 - - group - admin - shared - - - system.preferences.startupdisk - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Startup Disk preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فتح قفل تفضيلات قرص بدء التشغيل. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Disc d’Arrencada. - cs - __APPNAME__ se pokouší odemknout předvolby Startovací disk. - da - __APPNAME__ prøver at lÃ¥se vinduet Startdisk op. - de - __APPNAME__ versucht, die Systemeinstellung „Startvolume“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις δίσκου εκκίνησης. - en - __APPNAME__ is trying to unlock the Startup Disk preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Disco de Arranque. - fi - __APPNAME__ yrittää avata Käynnistyslevy-asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Démarrage. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של העדפות ״כונן ההפעלה״. - hr - __APPNAME__ pokuÅ¡ava otključati postavke Pokretački disk. - hu - A(z) __APPNAME__ megpróbálja feloldani a Rendszerindító lemez beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze del Disco di avvio. - ja - __APPNAME__ が“起動ディスク”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) 시동 디스크 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Startdisk-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Opstartschijf' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje dysku startowego. - pt - __APPNAME__ está tentando desbloquear as preferências Disco de Inicialização. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Disco de Arranque. - ro - __APPNAME__ încearcă să deblocheze preferințele Disc de inițializare. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели «Загрузочный том». - sk - __APPNAME__ sa pokúša odomknúť nastavenia Å¡tartovacieho disku. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Startskiva. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่งดิสก์เริ่มต้น - tr - __APPNAME__, Başlangıç Diski tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Стартового диска. - zh-Hans - “__APPNAME__”正试图解锁“启动磁盘”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖“啟動磁碟”偏好設定。 - - group - admin - shared - - - system.preferences.timemachine - - allow-root - - class - user - comment - Checked by the Admin framework when making changes to the Time Machine preference pane. - default-button - - ar - فتح القفل - ca - Desbloquejar - cs - Odemknout - da - LÃ¥s op - de - Entsperren - el - Ξεκλείδωμα - en - Unlock - es - Desbloquear - fi - Avaa - fr - Déverrouiller - he - בטל/י את הנעילה - hr - Otključaj - hu - Feloldás - it - Sblocca - ja - ロック解除 - ko - 잠금 해제 - nb - LÃ¥s opp - nl - Ontgrendel - pl - Odblokuj - pt - Desbloquear - pt-PT - Desproteger - ro - Deblochează - ru - Снять защиту - sk - Odomknúť - sv - LÃ¥s upp - th - ปลดล็อก - tr - Kilidi Aç - uk - Відімкнути - zh-Hans - 解锁 - zh-Hant - 解鎖 - - default-prompt - - ar - يحاول __APPNAME__ فتح قفل تفضيلات Time Machine. - ca - __APPNAME__ està intentant desbloquejar el tauler de preferències Time Machine. - cs - __APPNAME__ se pokouší odemknout předvolby Time Machine. - da - __APPNAME__ prøver at lÃ¥se vinduet Time Machine op. - de - __APPNAME__ versucht, die Systemeinstellung „Time Machine“ zu entsperren. - el - Η εφαρμογή __APPNAME__ προσπαθεί να ξεκλειδώσει τις προτιμήσεις του Time Machine. - en - __APPNAME__ is trying to unlock the Time Machine preferences. - es - __APPNAME__ está intentando desbloquear el panel de preferencias Time Machine. - fi - __APPNAME__ yrittää avata Time Machine -asetuksia. - fr - __APPNAME__ essaie de déverrouiller les préférences Time Machine. - he - ×´ __APPNAME__×´ מבקש לבטל את הנעילה של ההעדפות של Time Machine. - hr - __APPNAME__ pokuÅ¡ava otključati Time Machine postavke. - hu - A(z) __APPNAME__ megpróbálja feloldani a Time Machine beállításait. - it - __APPNAME__ sta tentando di sbloccare le preferenze di Time Machine. - ja - __APPNAME__ が“Time Machine”環境設定のロックを解除しようとしています。 - ko - __APPNAME__이(가) Time Machine 환경설정을 잠금 해제하려고 합니다. - nb - __APPNAME__ prøver Ã¥ lÃ¥se opp Time Machine-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Time Machine' te ontgrendelen. - pl - __APPNAME__ próbuje odblokować preferencje Time Machine. - pt - __APPNAME__ está tentando desbloquear as preferências Time Machine. - pt-PT - __APPNAME__ está a tentar desproteger as preferências de Time Machine. - ro - __APPNAME__ încearcă să deblocheze preferințele Time Machine. - ru - Программа «__APPNAME__» пытается снять защиту с настроек панели Time Machine. - sk - __APPNAME__ sa pokúša odomknúť nastavenia Time Machine. - sv - __APPNAME__ försöker lÃ¥sa upp inställningarna för Time Machine. - th - __APPNAME__ กำลังพยายามปลดล็อกค่าปรับแต่ง Time Machine - tr - __APPNAME__, Time Machine tercihlerinin kilidini açmaya çalışıyor. - uk - Програма «__APPNAME__» намагається відімкнути параметри Time Machine. - zh-Hans - “__APPNAME__”正试图解锁 Time Machine 偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試解鎖 Time Machine 偏好設定。 - - group - admin - shared - - - system.preferences.version-cue - - class - rule - comment - For gating modifications to Adobe Version Cue preferences. - default-button - - ar - تعديل التفضيلات - ca - Modificar les preferències - cs - Změnit předvolby - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση προτιμήσεων - en - Modify Preferences - es - Modificar preferencias - fi - Muokkaa asetuksia - fr - Modifier les préférences - he - ערוך/י את ההעדפות - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica preferenze - ja - 環境設定を変更 - ko - 환경설정 수정 - nb - Endre valg - nl - Wijzig voorkeuren - pl - Zmień preferencje - pt - Modificar Preferências - pt-PT - Modificar as preferências - ro - Modifică preferințele - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าปรับแต่ง - tr - Tercihleri Değiştir - uk - Modify Preferences - zh-Hans - 修改偏好设置 - zh-Hant - 修改偏好設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل تفضيلات رمز الإصدار. - ca - __APPNAME__ està intentant modificar el tauler de preferències Version Cue. - cs - __APPNAME__ se pokouší změnit předvolby Version Cue. - da - __APPNAME__ forsøger at ændre indstillingerne til versionindikatoren. - de - __APPNAME__ versucht, die Systemeinstellung „Version Cue“ zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις προτιμήσεις του Version Cue. - en - __APPNAME__ is trying to modify the Version Cue preferences. - es - __APPNAME__ está intentando modificar las preferencias de la indicación de versión. - fi - __APPNAME__ yrittää muokata Version Cue -asetuksia. - fr - __APPNAME__ essaye de modifier les préférences de Version Cue. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בהעדפות של Version Cue. - hr - __APPNAME__ pokuÅ¡ava preinačiti postavke za red verzije. - hu - A(z) __APPNAME__ megpróbálja feloldani a Version Cue beállításait. - it - __APPNAME__ sta cercando di modificare le preferenze Version Cue. - ja - __APPNAME__ は、“Version Cue”環境設定を変更しようとしています。 - ko - __APPNAME__이(가) Version Cue 환경설정을 수정하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre Version Cue-valgpanelet. - nl - __APPNAME__ probeert de Version Cue-voorkeuren te wijzigen. - pl - __APPNAME__ próbuje zmienić preferencje Version Cue. - pt - __APPNAME__ está tentando modificar os ajustes do aplicativo Version Cue. - pt-PT - O __APPNAME__ está a tentar modificar as preferências de Version Cue. - ro - __APPNAME__ încearcă să modifice preferințele Version Cue. - ru - Программа «__APPNAME__» пытается модифицировать настройки Version Cue. - sk - __APPNAME__ sa pokúša odomknúť nastavenia Version Cue. - sv - __APPNAME__ försöker ändra inställningarna för Version Cue. - th - __APPNAME__ กำลังพยายามแก้ไขค่าปรับแต่ง Version Cue - tr - __APPNAME__, Version Cue tercihlerini değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри Version Cue. - zh-Hans - “__APPNAME__”正试图修改 Version Cue 的偏好设置 - zh-Hant - “__APPNAME__”正在嘗試修改 Version Cue 偏好設定。 - - rule - authenticate-admin - - system.print.admin - - class - rule - default-button - - ar - تعديل الإعدادات - ca - Modificar la configuració - cs - Změnit nastavení - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση ρυθμίσεων - en - Modify Settings - es - Modificar ajustes - fi - Muokkaa asetuksia - fr - Modifer les réglages - he - ערוך/י את ההגדרות - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica impostazioni - ja - 設定を変更 - ko - 설정 수정 - nb - Endre innstillinger - nl - Wijzig instellingen - pl - Zmień ustawienia - pt - Modificar Ajustes - pt-PT - Modificar definições - ro - Schimbă configurările - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าปรับแต่ง - tr - Ayarları Değiştir - uk - Змінити параметри - zh-Hans - 修改设置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل إعدادات الطابعة. - ca - __APPNAME__ està intentant modificar la configuració de la impressora. - cs - __APPNAME__ se pokouší změnit nastavení tiskárny. - da - __APPNAME__ forsøger at ændre printerindstillingerne. - de - __APPNAME__ versucht, die Druckereinstellungen zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις ρυθμίσεις εκτυπωτή. - en - __APPNAME__ is trying to modify the printer settings. - es - __APPNAME__ está intentando modificar los ajustes de la impresora. - fi - __APPNAME__ yrittää muokata tulostimen asetuksia. - fr - __APPNAME__ essaye de modifier les réglages d’imprimante. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בהגדרות המדפסת. - hr - __APPNAME__ pokuÅ¡ava preinačiti postavke pisača. - hu - A(z) __APPNAME__ megpróbálja módosítani a nyomtató beállításait. - it - __APPNAME__ sta cercando di modificare le impostazioni della stampante. - ja - __APPNAME__ はプリンタの設定を変更しようとしています。 - ko - __APPNAME__이(가) 프린터 설정을 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre skriverinnstillingene. - nl - __APPNAME__ probeert de printerinstellingen te wijzigen. - pl - __APPNAME__ próbuje zmienić ustawienia drukarki. - pt - __APPNAME__ está tentando modificar os ajustes da impressora. - pt-PT - O __APPNAME__ está a tentar modificar as definições de impressão. - ro - __APPNAME__ încearcă să schimbe configurările imprimantei. - ru - Программа «__APPNAME__» пытается модифицировать настройки принтера. - sk - __APPNAME__ sa pokúša upraviÅ¥ nastavenia tlačiarne. - sv - __APPNAME__ försöker ändra skrivarinställningarna. - th - __APPNAME__ กำลังพยายามแก้ไขค่าปรับแต่งเครื่องพิมพ์ - tr - __APPNAME__, yazıcı ayarlarını değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри принтера. - zh-Hans - “__APPNAME__”正试图修改打印机设置。 - zh-Hant - “__APPNAME__”正在嘗試修改印表機設定。 - - rule - root-or-lpadmin - - system.print.operator - - allow-root - - class - user - default-button - - ar - السماح بالطباعة - ca - Permetre la impressió - cs - Povolit tisk - da - Tillad udskrivning - de - Drucken erlauben - el - Να επιτρέπεται η εκτύπωση - en - Allow Printing - es - Permitir impresión - fi - Salli tulostus - fr - Autoriser l’impression - he - אפשר הדפסה - hr - Dozvoli ispis - hu - Nyomtatás engedélyezése - it - Consenti stampa - ja - プリントを許可 - ko - 프린트 허용 - nb - Tillat utskrift - nl - Sta afdrukken toe - pl - Pozwól na drukowanie - pt - Permitir Impressão - pt-PT - Permitir imprimir - ro - Permite tipărirea - ru - Разрешить печать - sk - PovoliÅ¥ tlač - sv - TillÃ¥t utskrifter - th - อนุญาตการพิมพ์ - tr - Kağıda Dökmeye Ä°zin Ver - uk - Дозволити друк - zh-Hans - 允许打印 - zh-Hant - 允許列印 - - default-prompt - - ar - يحاول __APPNAME__ استخدام الطابعة. - ca - __APPNAME__ està intentant utilitzar la impressora. - cs - __APPNAME__ se pokouší použít tiskárnu. - da - __APPNAME__ forsøger at bruge printeren. - de - __APPNAME__ versucht, den Drucker zu benutzen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να χρησιμοποιήσει τον εκτυπωτή. - en - __APPNAME__ is trying to use the printer. - es - __APPNAME__ está intentando usar la impresora. - fi - __APPNAME__ yrittää käyttää tulostinta. - fr - __APPNAME__ essaye d’utiliser l’imprimante. - he - ×´ __APPNAME__×´ מבקש להשתמש במדפסת. - hr - __APPNAME__ pokuÅ¡ava koristiti pisač. - hu - A(z) __APPNAME__ megpróbálja használni a nyomtatót. - it - __APPNAME__ sta cercando di usare la stampante. - ja - __APPNAME__ はプリンタを使用しようとしています。 - ko - __APPNAME__이(가) 프린터를 사용하려고 합니다. - nb - __APPNAME__ prøver Ã¥ bruke skriveren. - nl - __APPNAME__ probeert de printer te gebruiken. - pl - __APPNAME__ próbuje użyć drukarki. - pt - __APPNAME__ está tentando usar a impressora. - pt-PT - O __APPNAME__ está a tentar usar a impressora. - ro - __APPNAME__ încearcă să utilizeze imprimanta. - ru - Программа «__APPNAME__» пытается использовать принтер. - sk - __APPNAME__ sa pokúša použiÅ¥ tlačiareň. - sv - __APPNAME__ försöker använda skrivaren. - th - __APPNAME__ กำลังพยายามใช้งานเครื่องพิมพ์ - tr - __APPNAME__, yazıcıyı kullanmaya çalışıyor. - uk - Програма «__APPNAME__» намагається використати принтер. - zh-Hans - “__APPNAME__”正试图使用打印机。 - zh-Hant - “__APPNAME__”正在嘗試使用印表機。 - - group - _lpoperator - shared - - - system.printingmanager - - class - rule - comment - For printing to locked printers. - default-button - - ar - طباعة - ca - Print - cs - Tisknout - da - Udskriv - de - Drucken - el - Εκτύπωση - en - Print - es - Imprimir - fi - Tulosta - fr - Imprimer - he - הדפס - hr - Ispis - hu - Nyomtatás - it - Stampa - ja - プリント - ko - 프린트 - nb - Skriv ut - nl - Druk af - pl - Drukuj - pt - Imprimir - pt-PT - Imprimir - ro - Tipărește - ru - Напечатать - sk - TlačiÅ¥ - sv - Skriv ut - th - พิมพ์ - tr - Kağıda Dök - uk - Друкувати - zh-Hans - 打印 - zh-Hant - 列印 - - default-prompt - - ar - يحاول __APPNAME__ الطباعة على طابعة مقفلة. - ca - __APPNAME__ està intentant imprimir amb una impressora bloquejada. - cs - __APPNAME__ se pokouší tisknout na uzamčené tiskárně. - da - __APPNAME__ forsøger at udskrive til en lÃ¥st printer. - de - __APPNAME__ versucht, auf einem gesperrten Drucker zu drucken. - el - Η εφαρμογή __APPNAME__ προσπαθεί να εκτυπώσει σε κλειδωμένο εκτυπωτή. - en - __APPNAME__ is trying to print to a locked printer. - es - __APPNAME__ está intentando imprimir en una impresora bloqueada. - fi - __APPNAME__ yrittää tulostaa lukitulle tulostimelle. - fr - __APPNAME__ essaye d’imprimer vers une imprimante verrouillée. - he - ×´ __APPNAME__×´ מבקש להדפיס דרך מדפסת נעולה. - hr - __APPNAME__ pokuÅ¡ava ispisivati na zaključanom pisaču. - hu - A(z) __APPNAME__ megpróbál nyomtatni egy zárolt nyomtatóra - it - __APPNAME__ sta cercando di stampare su una stampante bloccata. - ja - __APPNAME__ は、ロック中のプリンタを使ってプリントしようとしています。 - ko - __APPNAME__이(가) 잠겨있는 프린터에서 프린트하려고 합니다. - nb - __APPNAME__ prøver Ã¥ skrive ut pÃ¥ en lÃ¥st skriver. - nl - __APPNAME__ probeert een vergrendelde printer te gebruiken. - pl - __APPNAME__ próbuje drukować na zablokowanej drukarce. - pt - __APPNAME__ está tentando imprimir em uma impressora bloqueada. - pt-PT - O __APPNAME__ está a tentar imprimir através de uma impressora que se encontra bloqueada. - ro - __APPNAME__ încearcă să tipărească pe o imprimantă blocată. - ru - Программа «__APPNAME__» пытается выполнить печать на защищенном принтере. - sk - __APPNAME__ sa pokúša tlačiÅ¥ na zamknutej tlačiarni. - sv - __APPNAME__ försöker skriva ut pÃ¥ en lÃ¥st skrivare. - th - __APPNAME__ กำลังพยายามพิมพ์สู่เครื่องพิมพ์ที่ล็อกไว้ - tr - __APPNAME__, kilitli bir yazıcıda kağıda dökmeye çalışıyor. - uk - Програма «__APPNAME__» намагається друкувати на замкненому принтері. - zh-Hans - “__APPNAME__”正试图打印到已锁定的打印机。 - zh-Hant - “__APPNAME__”正在嘗試列印至鎖定的印表機。 - - k-of-n - 1 - rule - - is-admin - authenticate-admin - - - system.privilege.admin - - allow-root - - class - user - comment - Used by AuthorizationExecuteWithPrivileges(...). - AuthorizationExecuteWithPrivileges() is used by programs requesting - to run a tool as root (e.g., some installers). - group - admin - shared - - timeout - 300 - - system.privilege.taskport - - allow-root - - class - user - comment - Used by task_for_pid(...). - Task_for_pid is called by programs requesting full control over another program - for things like debugging or performance analysis. This authorization only applies - if the requesting and target programs are run by the same user; it will never - authorize access to the program of another user. WARNING: administrators are advised not to modify this right. - default-button - - ar - التحكم - ca - Prendre el control - cs - Převzít kontrolu - da - Overtag kontrol - de - Steuerung übernehmen - el - Ανάληψη ελέγχου - en - Take Control - es - Controlar - fi - Ota hallintaan - fr - Prendre le contrôle - he - השתלט - hr - Preuzmi kontrolu - hu - Vezérlés átvétele - it - Prendi il controllo - ja - 制御 - ko - 제어하기 - nb - Ta kontroll - nl - Beheer - pl - Przejmij kontrolę - pt - Recuperar Controle - pt-PT - Recuperar controlo - ro - Preia controlul - ru - Управлять - sk - PrevziaÅ¥ kontrolu - sv - Ta kontroll - th - ควบคุม - tr - Yönetimi Ele Geçir - uk - Отримати контроль - zh-Hans - 控制 - zh-Hant - 控制 - - default-prompt - - ar - يحاول __APPNAME__ أن يسيطر على عملية أخرى. - ca - __APPNAME__ està intentant prendre el control d’un altre procés. - cs - __APPNAME__ se pokouší převzít kontrolu nad jiným procesem. - da - __APPNAME__ forsøger at overtage kontrollen af en anden proces. - de - __APPNAME__ versucht, die Steuerung eines anderen Vorgangs zu übernehmen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να λάβει τον έλεγχο άλλης διεργασίας. - en - __APPNAME__ is trying to take control of another process. - es - __APPNAME__ está intentando controlar otro proceso. - fi - __APPNAME__ yrittää ottaa hallintaan toista prosessia. - fr - __APPNAME__ essaye de prendre le contrôle d’un autre processus. - he - ×´ __APPNAME__×´ מבקש להשתלט על תהליך אחר. - hr - __APPNAME__ pokuÅ¡ava preuzeti kontrolu nad drugim procesom. - hu - A(z) __APPNAME__ megpróbálja átvenni egy másik folyamat vezérlését. - it - __APPNAME__ sta cercando di prendere il controllo di un altro processo. - ja - __APPNAME__ は、ほかのプロセスを制御しようとしています。 - ko - __APPNAME__이(가) 다른 프로세스를 제어하려고 합니다. - nb - __APPNAME__ prøver Ã¥ styre en annen prosess. - nl - __APPNAME__ probeert het beheer van een ander proces over te nemen. - pl - __APPNAME__ próbuje przejąć kontrolę nad innym procesem. - pt - __APPNAME__ está tentando assumir o controle de outro processo. - pt-PT - O __APPNAME__ está a tentar controlar outro processo. - ro - __APPNAME__ încearcă să preia controlul unui alt proces. - ru - Программа «__APPNAME__» пытается взять под контроль другой процесс. - sk - __APPNAME__ sa pokúša prevziaÅ¥ kontrolu nad iným procesom. - sv - __APPNAME__ försöker ta kontroll över en annan process. - th - __APPNAME__ กำลังพยายามเข้าควบคุมการดำเนินการอื่น - tr - __APPNAME__, başka bir işlemin yönetimini ele geçirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається отримати контроль над іншим процесом. - zh-Hans - “__APPNAME__”正试图控制另一进程。 - zh-Hant - “__APPNAME__”正在嘗試控制另一個程序。 - - group - _developer - shared - - timeout - 36000 - - system.privilege.taskport.debug - - allow-root - - class - user - comment - For use by Apple. WARNING: administrators are advised - not to modify this right. - default-button - - ar - متابعة - ca - Continuar - cs - Pokračovat - da - Fortsæt - de - Fortfahren - el - Συνέχεια - en - Continue - es - Continuar - fi - Jatka - fr - Continuer - he - המשך - hr - Nastavi - hu - Folytatás - it - Continua - ja - 続ける - ko - 계속 - nb - Fortsett - nl - Ga door - pl - Dalej - pt - Continuar - pt-PT - Continuar - ro - Continuă - ru - Продолжить - sk - PokračovaÅ¥ - sv - Fortsätt - th - ดำเนินการต่อ - tr - Sürdür - uk - Продовжити - zh-Hans - 继续 - zh-Hant - 繼續 - - default-prompt - - ar - يحاول __APPNAME__ أن يسيطر على عملية أخرى لتصحيح الأخطاء للاستمرار. - ca - __APPNAME__ necessita prendre el control d’un altre procés per continuar amb la depuració. - cs - __APPNAME__ potřebuje pro pokračování ladění převzít kontrolu nad jiným procesem. - da - __APPNAME__ bliver nødt til at overtage kontrollen af en anden process, for at fejlfinding kan fortsætte. - de - __APPNAME__ muss zum Fortsetzen der Fehlerbehebung die Steuerung eines anderen Vorgangs übernehmen. - el - Η εφαρμογή __APPNAME__ πρέπει να λάβει τον έλεγχο άλλης διεργασίας για να συνεχιστεί η εκσφαλμάτωση. - en - __APPNAME__ needs to take control of another process for debugging to continue. - es - Para continuar con la depuración, __APPNAME__ debe controlar otro proceso. - fi - Ohjelman __APPNAME__ pitää ottaa toinen prosessi hallintaan, jotta virheidenmääritys voi jatkua. - fr - __APPNAME__ à besoin de prendre le contrôle d’un autre processus pour continuer le débogage. - he - ×´ __APPNAME__×´ צריך להשתלט על תהליך אחר על-מנת להמשיך בניפוי השגיאות. - hr - __APPNAME__ treba preuzeti kontrolu nad drugim procesom kako bi se moglo nastaviti uklanjanje greÅ¡aka. - hu - A(z) __APPNAME__ alkalmazásnak át kell vennie egy másik folyamat vezérlését a hibakeresés folytatásához. - it - __APPNAME__ deve prendere il controllo di un altro processo affinché possa continuare il debugging. - ja - __APPNAME__ は、デバッグを続けるためにほかのプロセスを制御する必要があります。 - ko - __APPNAME__이(가) 다른 프로세스를 제어해야 디버깅을 계속할 수 있습니다. - nb - __APPNAME__ mÃ¥ styre en annen prosess for at feilsøkingen skal fortsette. - nl - __APPNAME__ moet het beheer van een ander proces overnemen voordat de foutopsporing kan worden voortgezet. - pl - __APPNAME__ musi przejąć kontrolę nad innym procesem na potrzeby usuwania błędów, aby kontynuować. - pt - __APPNAME__ precisa assumir o controle de outro processo para que a depuração possa continuar. - pt-PT - Para poder continuar a depuração, o __APPNAME__ necessita de controlar outro processo. - ro - __APPNAME__ trebuie să preia controlul unui alt proces pentru a continua depanarea. - ru - Программе «__APPNAME__» необходимо взять под контроль другой процесс, чтобы отладка могла быть продолжена. - sk - __APPNAME__ potrebuje kvôli rieÅ¡eniu problémov prevziaÅ¥ kontrolu nad iným procesom. - sv - __APPNAME__ mÃ¥ste ta kontroll över en annan process för att kunna fortsätta felsöka. - th - __APPNAME__ จำเป็นต้องเข้าควบคุมการดำเนินการอื่นเพื่อดำเนินการแก้ไขข้อผิดพลาดต่อ - tr - __APPNAME__, başka bir işlemin yönetimini ele geçirmeden hata ayıklama sürdürülemez. - uk - Програмі «__APPNAME__» для продовження відладки потрібно отримати контроль над іншим процесом. - zh-Hans - “__APPNAME__”需控制另一进程，才能继续调试。 - zh-Hant - “__APPNAME__”需要控制另一個程序才能繼續除錯。 - - group - _developer - shared - - timeout - 36000 - - system.privilege.taskport.safe - - class - allow - comment - For use by Apple. - default-button - - ar - التحكم - ca - Prendre el control - cs - Převzít kontrolu - da - Overtag kontrol - de - Steuerung übernehmen - el - Ανάληψη ελέγχου - en - Take Control - es - Controlar - fi - Ota hallintaan - fr - Prendre le contrôle - he - השתלט - hr - Preuzmi kontrolu - hu - Vezérlés átvétele - it - Prendi il controllo - ja - 制御 - ko - 제어하기 - nb - Ta kontroll - nl - Beheer - pl - Przejmij kontrolę - pt - Recuperar Controle - pt-PT - Recuperar controlo - ro - Preia controlul - ru - Управлять - sk - PrevziaÅ¥ kontrolu - sv - Ta kontroll - th - ควบคุม - tr - Yönetimi Ele Geçir - uk - Отримати контроль - zh-Hans - 控制 - zh-Hant - 控制 - - default-prompt - - ar - يحاول __APPNAME__ أن يسيطر على عملية أخرى. - ca - __APPNAME__ està intentant prendre el control d’un altre procés. - cs - __APPNAME__ se pokouší převzít kontrolu nad jiným procesem. - da - __APPNAME__ forsøger at overtage kontrollen af en anden proces. - de - __APPNAME__ versucht, die Steuerung eines anderen Vorgangs zu übernehmen. - el - Η εφαρμογή __APPNAME__ προσπαθεί να λάβει τον έλεγχο άλλης διεργασίας. - en - __APPNAME__ is trying to take control of another process. - es - __APPNAME__ está intentando controlar otro proceso. - fi - __APPNAME__ yrittää ottaa hallintaan toista prosessia. - fr - __APPNAME__ essaye de prendre le contrôle d’un autre processus. - he - ×´ __APPNAME__×´ מבקש להשתלט על תהליך אחר. - hr - __APPNAME__ pokuÅ¡ava preuzeti kontrolu nad drugim procesom. - hu - A(z) __APPNAME__ megpróbálja átvenni egy másik folyamat vezérlését. - it - __APPNAME__ sta cercando di prendere il controllo di un altro processo. - ja - __APPNAME__ は、ほかのプロセスを制御しようとしています。 - ko - __APPNAME__이(가) 다른 프로세스를 제어하려고 합니다. - nb - __APPNAME__ prøver Ã¥ styre en annen prosess. - nl - __APPNAME__ probeert het beheer van een ander proces over te nemen. - pl - __APPNAME__ próbuje przejąć kontrolę nad innym procesem. - pt - __APPNAME__ está tentando assumir o controle de outro processo. - pt-PT - O __APPNAME__ está a tentar controlar outro processo. - ro - __APPNAME__ încearcă să preia controlul unui alt proces. - ru - Программа «__APPNAME__» пытается взять под контроль другой процесс. - sk - __APPNAME__ sa pokúša prevziaÅ¥ kontrolu nad iným procesom. - sv - __APPNAME__ försöker ta kontroll över en annan process. - th - __APPNAME__ กำลังพยายามเข้าควบคุมการดำเนินการอื่น - tr - __APPNAME__, başka bir işlemin yönetimini ele geçirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається отримати контроль над іншим процесом. - zh-Hans - “__APPNAME__”正试图控制另一进程。 - zh-Hant - “__APPNAME__”正在嘗試控制另一個程序。 - - - system.restart - - class - evaluate-mechanisms - comment - Checked if the foreground console user tries to restart the system while other users are logged in via fast-user switching. - mechanisms - - RestartAuthorization:restart - builtin:authenticate,privileged - RestartAuthorization:success - - - system.services.directory.configure - - allow-root - - class - user - comment - For making Directory Services changes. - default-button - - ar - تعديل التكوين - ca - Modificar la configuració - cs - Změnit konfiguraci - da - Juster konfiguration - de - Konfiguration ändern - el - Τροποποίηση ρύθμισης παραμέτρων - en - Modify Configuration - es - Modificar configuración - fi - Muokkaa määrittelyä - fr - Modifier la configuration - he - ערוך/י את התצורה - hr - Preinači konfiguraciju - hu - Konfiguráció módosítása - it - Modifica configurazione - ja - 構成を変更 - ko - 구성 수정 - nb - Endre konfigurasjon - nl - Wijzig configuratie - pl - Zmień konfigurację - pt - Modificar Configuração - pt-PT - Modificar configuração - ro - Schimbă configurația - ru - Модифицировать конфигурацию - sk - UpraviÅ¥ konfiguráciu - sv - Ändra konfiguration - th - แก้ไขการกำหนดค่า - tr - Konfigürasyonu Değiştir - uk - Змінити конфігурацію - zh-Hans - 修改配置 - zh-Hant - 修改設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل تكوين خدمات الدليل. - ca - __APPNAME__ està intentant modificar la configuració de Serveis de Directori. - cs - __APPNAME__ se pokouší změnit konfiguraci Adresářových služeb. - da - __APPNAME__ forsøger at ændre konfigurationen Bibliotekstjenester. - de - __APPNAME__ versucht, die Konfiguration der Verzeichnisdienste zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τη ρύθμιση παραμέτρων των Υπηρεσιών καταλόγου. - en - __APPNAME__ is trying to modify the Directory Services configuration. - es - __APPNAME__ está intentando modificar la configuración de los servicios de directorio. - fi - __APPNAME__ yrittää muokata hakemistopalvelujen määrittelyä. - fr - __APPNAME__ essaye de modifier la configuration des services d’annuaire. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בתצורה של Directory Services. - hr - __APPNAME__ pokuÅ¡ava preinačiti konfiguraciju usluga direktorija. - hu - A(z) __APPNAME__ megpróbálja módosítani a Könyvtárszolgáltatások konfigurációját. - it - __APPNAME__ sta cercando di modificare la configurazione dei Servizi di directory. - ja - __APPNAME__ は、ディレクトリサービスの構成を変更しようとしています。 - ko - __APPNAME__이(가) 디렉토리 서비스 구성을 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre Katalogtjenester-konfigurasjonen. - nl - __APPNAME__ probeert de configuratie van Adreslijstvoorzieningen te wijzigen. - pl - __APPNAME__ próbuje zmienić konfigurację programu Usługi katalogowe. - pt - __APPNAME__ está tentando modificar a configuração dos Serviços de Diretório. - pt-PT - O __APPNAME__ está a tentar modificar a configuração dos serviços de directório. - ro - __APPNAME__ încearcă să schimbe configurația serviciilor de director. - ru - Программа «__APPNAME__» пытается модифицировать настройку Службы каталогов. - sk - __APPNAME__ sa pokúša upraviÅ¥ konfiguráciu adresárových služieb. - sv - __APPNAME__ försöker ändra konfigurationen för Katalogtjänster. - th - __APPNAME__ กำลังพยายามแก้ไขการกำหนดค่าบริการไดเร็กเทอรี่ - tr - __APPNAME__, Dizin Servisleri konfigürasyonunu değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити конфігурацію Служб каталогів. - zh-Hans - “__APPNAME__”正试图修改“目录服务”的配置。 - zh-Hant - “__APPNAME__”正在嘗試修改“目錄服務”設定。 - - group - admin - shared - - - system.services.systemconfiguration.network - - class - rule - comment - For making change to network configuration via System Configuration. - default-button - - ar - تعديل التكوين - ca - Modificar la configuració - cs - Změna konfigurace - da - Rediger konfiguration - de - Konfiguration ändern - el - Τροποποίηση ρύθμισης παραμέτρων - en - Modify Configuration - es - Modificar configuración - fi - Muokkaa määritystä - fr - Modifier la configuration - he - שינוי תצורה - hr - Promijeni konfiguraciju - hu - Konfiguráció módosítása - it - Modifica configurazione - ja - 構成を変更 - ko - 구성 수정 - nb - Endre konfigurasjon - nl - Configuratiewijziging - pl - Modifikuj konfigurację - pt - Modificação de Configuração - pt-PT - Modificação de configuração - ro - Modificare configurație - ru - Модифицировать конфигурацию - sk - UpraviÅ¥ nastavenie - sv - Ändra konfiguration - th - การกำหนดค่าการแก้ไข - tr - Konfigürasyonu Değiştir - uk - Змінити конфігурацію - zh-Hans - 修改配置 - zh-Hant - 修改設定 - - default-prompt - - ar - __APPNAME__ يحاول تعديل تكوين شبكة النظام‫.‬ - ca - __APPNAME__ està provant de modificar la configuració de xarxa del sistema. - cs - __APPNAME__ se pokouší změnit síťovou konfiguraci systému. - da - __APPNAME__ prøver at ændre systemets netværkskonfiguration. - de - __APPNAME__ versucht, die Netzwerkkonfiguration des Systems zu ändern. - el - Η εφαρμογή «__APPNAME__» προσπαθεί να τροποποιήσει τη ρύθμιση παραμέτρων του δικτύου συστήματος. - en - __APPNAME__ is trying to modify the system network configuration. - es - __APPNAME__ está intentando modificar la configuración de red del sistema. - fi - __APPNAME__yrittää muokata järjestelmän verkkomääritysta. - fr - __APPNAME__ souhaite modifier la configuration réseau de votre ordinateur. - he - __APPNAME__ מנסה לשנות את תצורת הרשת של המערכת. - hr - __APPNAME__ pokuÅ¡ava promijeniti mrežnu konfiguraciju sustava. - hu - A(z) __APPNAME__ módosítani próbálja a rendszer hálózati konfigurációját. - it - __APPNAME__ sta tentando di modificare la configurazione network del sistema. - ja - __APPNAME__ は、システムネットワークの構成を変更しようとしています。 - ko - __APPNAME__이(가) 시스템 네트워크 구성을 수정하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre systemets nettverkskonfigurasjon. - nl - __APPNAME__ probeert de netwerkconfiguratie van het systeem te wijzigen. - pl - __APPNAME__ próbuje zmodyfikować systemową konfigurację sieci. - pt - __APPNAME__ está tentando modificar a configuração de rede do sistema. - pt-PT - __APPNAME__ está a tentar modificar a configuração de rede do sistema. - ro - __APPNAME__ încearcă să modifice configurația de rețea a sistemului. - ru - Программа «__APPNAME__» пытается модифицировать сетевую конфигурацию системы. - sk - Aplikácia __APPNAME__ sa pokúša upraviÅ¥ systémové nastavenie siete. - sv - __APPNAME__ försöker ändra systemets nätverksinställning. - th - __APPNAME__ กำลังพยายามแก้ไขการกำหนดค่าเครือข่ายระบบ - tr - __APPNAME__, sistemin ağ konfigürasyonunu değiştirmeye çalışıyor. - uk - __APPNAME__ намагається змінити мережеву конфігурацію системи. - zh-Hans - “__APPNAME__”正试图修改系统的网络配置。 - zh-Hant - “__APPNAME__”正在嘗試修改系統網路設定。 - - rule - root-or-entitled-admin-or-app-specific-admin - - system.sharepoints. - - allow-root - - class - user - comment - Checked when making changes to the Sharepoints. - default-button - - ar - تعديل التفضيلات - ca - Modificar les preferències - cs - Změnit předvolby - da - Juster indstillinger - de - Einstellungen ändern - el - Τροποποίηση προτιμήσεων - en - Modify Preferences - es - Modificar preferencias - fi - Muokkaa asetuksia - fr - Modifier les préférences - he - ערוך/י שינויים - hr - Preinači postavke - hu - Beállítások módosítása - it - Modifica preferenze - ja - 環境設定を変更 - ko - 환경설정 수정 - nb - Endre valg - nl - Wijzig voorkeuren - pl - Zmień preferencje - pt - Modificar Preferências - pt-PT - Modificar as preferências - ro - Modifică preferințele - ru - Модифицировать настройки - sk - UpraviÅ¥ nastavenia - sv - Ändra inställningar - th - แก้ไขค่าปรับแต่ง - tr - Tercihleri Değiştir - uk - Змінити параметри - zh-Hans - 修改偏好设置 - zh-Hant - 修改偏好設定 - - default-prompt - - ar - يحاول __APPNAME__ تعديل تفضيلات المشاركة. - ca - __APPNAME__ està intentant modificar el tauler de preferències Compartir. - cs - __APPNAME__ se pokouší změnit předvolby Sdílení. - da - __APPNAME__ forsøger at ændre Deling. - de - __APPNAME__ versucht, die Systemeinstellung „Freigaben“ zu ändern. - el - Η εφαρμογή __APPNAME__ προσπαθεί να τροποποιήσει τις προτιμήσεις κοινής χρήσης. - en - __APPNAME__ is trying to modify Sharing preferences. - es - __APPNAME__ está intentando modificar las preferencias de Compartir. - fi - __APPNAME__ yrittää muokata Jako-asetuksia. - fr - __APPNAME__ essaye de modifier les préférences Partage. - he - ×´ __APPNAME__×´ מבקש לערוך שינויים בהעדפות ״שיתוף״. - hr - __APPNAME__ pokuÅ¡ava preinačiti postavke dijeljenja. - hu - A(z) __APPNAME__ megpróbálja módosítani a Megosztás beállításait. - it - __APPNAME__ sta cercando di modificare le preferenze di condivisione. - ja - __APPNAME__ は、“共有”環境設定を変更しようとしています。 - ko - __APPNAME__이(가) 공유 환경설정을 변경하려고 합니다. - nb - __APPNAME__ prøver Ã¥ endre Deling-valgpanelet. - nl - __APPNAME__ probeert het voorkeurenpaneel 'Delen' te wijzigen. - pl - __APPNAME__ próbuje zmienić preferencje Udostępnianie. - pt - __APPNAME__ está tentando modificar as preferências de Compartilhamento. - pt-PT - O __APPNAME__ está a tentar desproteger as preferências de Partilha. - ro - __APPNAME__ încearcă să modifice preferințele Partajare. - ru - Программа «__APPNAME__» пытается модифицировать настройки Общего доступа. - sk - __APPNAME__ sa pokúša upraviÅ¥ nastavenia zdieľania. - sv - __APPNAME__ försöker ändra Delningsinställningarna. - th - __APPNAME__ กำลังพยายามแก้ไขค่าปรับแต่งการแบ่งปัน - tr - __APPNAME__, Paylaşma tercihlerini değiştirmeye çalışıyor. - uk - Програма «__APPNAME__» намагається змінити параметри Спільного доступу. - zh-Hans - “__APPNAME__”正试图修改“共享”偏好设置。 - zh-Hant - “__APPNAME__”正在嘗試修改“共享”偏好設定。 - - group - admin - shared - - - system.shutdown - - class - evaluate-mechanisms - comment - Checked if the foreground console user tries to shut down the system while other users are logged in via fast-user switching. - mechanisms - - RestartAuthorization:shutdown - builtin:authenticate,privileged - RestartAuthorization:success - - - system.volume. - - class - rule - comment - system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount) - k-of-n - 1 - rule - - is-root - is-admin - authenticate-admin-30 - - - system.volume.external. - - class - rule - comment - system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount) - k-of-n - 1 - rule - - is-root - is-admin - on-console - authenticate-admin-30 - - - system.volume.external.adopt - - class - rule - comment - system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount) - k-of-n - 1 - rule - - is-root - is-admin - authenticate-admin-30 - - - system.volume.removable. - - class - rule - comment - system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount) - k-of-n - 1 - rule - - is-root - is-admin - on-console - authenticate-admin-30 - - - system.volume.removable.adopt - - class - rule - comment - system.volume.(external|internal|removable).(adopt|encode|mount|rename|unmount) - k-of-n - 1 - rule - - is-root - is-admin - authenticate-admin-30 - - - - rules - - admin - - class - user - group - admin - shared - - - allow - - class - allow - comment - Allow anyone. - - app-specific-admin - - class - user - group - admin - - appserver-admin - - class - user - group - appserveradm - - appserver-user - - class - user - group - appserverusr - - authenticate - - class - evaluate-mechanisms - mechanisms - - builtin:authenticate - builtin:reset-password,privileged - builtin:authenticate,privileged - PKINITMechanism:auth,privileged - - - authenticate-admin - - class - user - comment - Authenticate as an administrator. - group - admin - shared - - timeout - 0 - - authenticate-admin-30 - - class - user - comment - Like the default rule, but - credentials remain valid for only 30 seconds after they've - been obtained. An acquired credential is shared by all clients. - - group - admin - shared - - timeout - 30 - - authenticate-appstore-30 - - class - user - group - _appstore - shared - - timeout - 30 - - authenticate-developer - - class - user - comment - Authenticate as a developer. - group - _developer - shared - - timeout - 36000 - - authenticate-session-owner - - class - user - comment - Authenticate as the session owner. - session-owner - - - authenticate-session-owner-or-admin - - allow-root - - class - user - comment - Authenticate either as the owner or as an administrator. - group - admin - session-owner - - shared - - - authenticate-session-user - - class - user - comment - Same as authenticate-session-owner. - session-owner - - - default - - class - user - comment - Default rule. - Credentials remain valid for 5 minutes after they've been obtained. - An acquired credential is shared by all clients. - - group - admin - shared - - timeout - 300 - - entitled - - class - evaluate-mechanisms - mechanisms - - builtin:entitled,privileged - - tries - 1 - - entitled-admin - - class - rule - k-of-n - 2 - rule - - is-admin - entitled - - - entitled-admin-or-authenticate-admin - - class - rule - k-of-n - 1 - rule - - entitled-admin - authenticate-admin-30 - - - entitled-appstore - - class - rule - k-of-n - 2 - rule - - is-appstore - entitled - - - entitled-appstore-or-entitled-authenticate-appstore - - class - rule - k-of-n - 1 - rule - - entitled-appstore - entitled-authenticate-appstore - - - entitled-authenticate-admin - - class - rule - k-of-n - 2 - rule - - entitled - authenticate-admin-30 - - - entitled-authenticate-appstore - - class - rule - k-of-n - 2 - rule - - entitled - authenticate-appstore-30 - - - entitled-session-owner - - class - rule - k-of-n - 2 - rule - - is-session-owner - entitled - - - entitled-session-owner-or-authenticate-session-owner - - class - rule - k-of-n - 1 - rule - - entitled-session-owner - authenticate-session-owner - - - is-admin - - authenticate-user - - class - user - comment - Verify that the user asking for authorization is an administrator. - group - admin - shared - - - is-appstore - - authenticate-user - - class - user - group - _appstore - shared - - - is-developer - - authenticate-user - - class - user - comment - Verify that the user asking for authorization is a developer. - group - _developer - - is-lpadmin - - authenticate-user - - class - user - group - _lpadmin - - is-root - - allow-root - - authenticate-user - - class - user - comment - Verify that the process that created this AuthorizationRef is running as root. - - is-session-owner - - allow-root - - authenticate-user - - class - user - comment - Verify that the requesting process is running as the session owner. - session-owner - - - lpadmin - - class - user - group - _lpadmin - shared - - - on-console - - class - evaluate-mechanisms - mechanisms - - builtin:on-console - - tries - 1 - - root-or-entitled-admin-or-admin - - class - rule - k-of-n - 1 - rule - - is-root - entitled-admin - admin - - - root-or-entitled-admin-or-app-specific-admin - - class - rule - k-of-n - 1 - rule - - is-root - entitled-admin - app-specific-admin - - - root-or-entitled-admin-or-authenticate-admin - - class - rule - k-of-n - 1 - rule - - is-root - entitled-admin-or-authenticate-admin - - - root-or-lpadmin - - class - rule - k-of-n - 1 - rule - - is-root - is-lpadmin - lpadmin - - - - - diff --git a/etc/com.apple.securityd.plist b/etc/com.apple.securityd.plist index 3288ac8..1002f4e 100644 --- a/etc/com.apple.securityd.plist +++ b/etc/com.apple.securityd.plist @@ -25,5 +25,7 @@ EnableTransactions + POSIXSpawnType + Interactive diff --git a/etc/startup.mk b/etc/startup.mk index c2fd4bf..7147bf7 100644 --- a/etc/startup.mk +++ b/etc/startup.mk @@ -9,8 +9,8 @@ SYSTEM_LIBRARY_DIR=$(DSTROOT)/System/Library SYSTEM_CORE_SERVICES_DIR=/System/Library/CoreServices ETC_DIR=$(DSTROOT)/private/etc LAUNCH_DIR=$(DSTROOT)/System/Library/LaunchDaemons -AUTHORIZATION_LOCATION=$(ETC_DIR) -AUTHORIZATION_PLIST=$(AUTHORIZATION_LOCATION)/authorization +#AUTHORIZATION_LOCATION=$(ETC_DIR) +#AUTHORIZATION_PLIST=$(AUTHORIZATION_LOCATION)/authorization VARDB=$(DSTROOT)/private/var/db CANDIDATES=$(VARDB)/CodeEquivalenceCandidates @@ -35,11 +35,11 @@ profile: install: mkdir -p $(LAUNCH_DIR) cp $(SRC)/com.apple.securityd.plist $(LAUNCH_DIR) - mkdir -p $(AUTHORIZATION_LOCATION) - plutil -lint $(SRC)/authorization.plist - cp $(SRC)/authorization.plist $(AUTHORIZATION_PLIST) - chown root:wheel $(AUTHORIZATION_PLIST) - chmod 644 $(AUTHORIZATION_PLIST) + #mkdir -p $(AUTHORIZATION_LOCATION) + #plutil -lint $(SRC)/authorization.plist + #cp $(SRC)/authorization.plist $(AUTHORIZATION_PLIST) + #chown root:wheel $(AUTHORIZATION_PLIST) + #chmod 644 $(AUTHORIZATION_PLIST) mkdir -p $(VARDB) cp $(SRC)/CodeEquivalenceCandidates $(CANDIDATES) chown root:admin $(CANDIDATES) diff --git a/libsecurity_agent/lib/agentclient.h b/libsecurity_agent/lib/agentclient.h index 6459aa7..9e0cec7 100644 --- a/libsecurity_agent/lib/agentclient.h +++ b/libsecurity_agent/lib/agentclient.h @@ -65,6 +65,7 @@ enum Reason { noLongerNeeded, // the queried item is no longer needed keychainAddFailed, // the requested itemed couldn't be added to the keychain generalErrorCancel, // something went wrong so we have to give up now + resettingPassword, // The user has indicated that they wish to reset their password worldChanged = 101 }; diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/generate mig.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/generate mig.xcscheme deleted file mode 100644 index b85be49..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/generate mig.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/libsecurity_agent_client.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/libsecurity_agent_client.xcscheme deleted file mode 100644 index 93a4202..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/libsecurity_agent_client.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/libsecurity_agent_server.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/libsecurity_agent_server.xcscheme deleted file mode 100644 index 658ebde..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/libsecurity_agent_server.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/world.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/world.xcscheme deleted file mode 100644 index d0447cc..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/world.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/xcschememanagement.plist b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/xcschememanagement.plist deleted file mode 100644 index 846eca8..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/xcschememanagement.plist +++ /dev/null @@ -1,52 +0,0 @@ - - - - - SchemeUserState - - generate mig.xcscheme - - orderHint - 7 - - libsecurity_agent_client.xcscheme - - orderHint - 5 - - libsecurity_agent_server.xcscheme - - orderHint - 6 - - world.xcscheme - - orderHint - 4 - - - SuppressBuildableAutocreation - - 40635B69052E4CBD0009891B - - primary - - - 40E8FACC052E45D000A3D8D1 - - primary - - - 4CA1FEBD052A3C8100F22E42 - - primary - - - 4CA1FECF052A450F00F22E42 - - primary - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/generate mig.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/generate mig.xcscheme deleted file mode 100644 index 94aba39..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/generate mig.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/libsecurity_agent_client.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/libsecurity_agent_client.xcscheme deleted file mode 100644 index ed61bcd..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/libsecurity_agent_client.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/libsecurity_agent_server.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/libsecurity_agent_server.xcscheme deleted file mode 100644 index f99299d..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/libsecurity_agent_server.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/world.xcscheme b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/world.xcscheme deleted file mode 100644 index e279142..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/world.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/xcschememanagement.plist b/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/xcschememanagement.plist deleted file mode 100644 index 846eca8..0000000 --- a/libsecurity_agent/libsecurity_agent.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/xcschememanagement.plist +++ /dev/null @@ -1,52 +0,0 @@ - - - - - SchemeUserState - - generate mig.xcscheme - - orderHint - 7 - - libsecurity_agent_client.xcscheme - - orderHint - 5 - - libsecurity_agent_server.xcscheme - - orderHint - 6 - - world.xcscheme - - orderHint - 4 - - - SuppressBuildableAutocreation - - 40635B69052E4CBD0009891B - - primary - - - 40E8FACC052E45D000A3D8D1 - - primary - - - 4CA1FEBD052A3C8100F22E42 - - primary - - - 4CA1FECF052A450F00F22E42 - - primary - - - - - diff --git a/securityd.xcodeproj/project.pbxproj b/securityd.xcodeproj/project.pbxproj index 64bc3cb..887d99e 100644 --- a/securityd.xcodeproj/project.pbxproj +++ b/securityd.xcodeproj/project.pbxproj @@ -23,7 +23,6 @@ buildConfigurationList = AA6D4B860E6F3B8D0050206D /* Build configuration list for PBXAggregateTarget "startup" */; buildPhases = ( AA6D4B800E6F3B210050206D /* ShellScript */, - 18132F7B148D6DD900CC58B2 /* Run Script (install /etc/authorization.merge) */, ); dependencies = ( ); @@ -49,7 +48,6 @@ 1865FFCF1475169A00FD79DF /* libsecurityd_client.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 1865FFCE1475169A00FD79DF /* libsecurityd_client.a */; }; 1865FFDC14751B0600FD79DF /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 18B967B514731B78005A4D2E /* libobjc.dylib */; }; 1865FFE114751C9100FD79DF /* libauto.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 18B967B314731B69005A4D2E /* libauto.dylib */; }; - 1865FFEA1475208000FD79DF /* libsecurity_codesigning.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 1865FFD0147516CF00FD79DF /* libsecurity_codesigning.a */; }; 1865FFEB1475208B00FD79DF /* libsqlite3.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 18B967B114731B55005A4D2E /* libsqlite3.dylib */; }; 18B27134148C2C3D0087AE98 /* securityd_dtrace.h in Headers */ = {isa = PBXBuildFile; fileRef = 18B27133148C2C3D0087AE98 /* securityd_dtrace.h */; }; 18B965CD14731612005A4D2E /* libsecurity_agent_client.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 18B965BD147314BE005A4D2E /* libsecurity_agent_client.a */; }; @@ -61,6 +59,7 @@ 18B965DA147319C8005A4D2E /* libsecurity_cdsa_client.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 18B965D9147319C8005A4D2E /* libsecurity_cdsa_client.a */; }; 18B965DC147319E5005A4D2E /* libsecurityd_server.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 18B965DB147319E5005A4D2E /* libsecurityd_server.a */; }; 18B965DD147319F6005A4D2E /* PCSC.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = C276AAD60663E7A400B57276 /* PCSC.framework */; }; + 18CE013F17147A46008C042F /* libsecuritydservice_client.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 18CE013E17147A46008C042F /* libsecuritydservice_client.a */; }; 4E0BB2B40F79590300BBFEFA /* ccaudit_extensions.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E0BB2B20F79590300BBFEFA /* ccaudit_extensions.h */; }; 4E0BB2B50F79590300BBFEFA /* ccaudit_extensions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4E0BB2B30F79590300BBFEFA /* ccaudit_extensions.cpp */; }; AAC707230E6F4335003CC2B2 /* acl_keychain.h in Headers */ = {isa = PBXBuildFile; fileRef = 4C9264990534866F004B0E72 /* acl_keychain.h */; }; @@ -153,6 +152,13 @@ /* End PBXBuildFile section */ /* Begin PBXContainerItemProxy section */ + 1820DFC71714D3F800CA851F /* PBXContainerItemProxy */ = { + isa = PBXContainerItemProxy; + containerPortal = 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */; + proxyType = 1; + remoteGlobalIDString = 1843240D1714797D00196B52; + remoteInfo = securitydservice_client; + }; 18B965BC147314BE005A4D2E /* PBXContainerItemProxy */ = { isa = PBXContainerItemProxy; containerPortal = 18B965B0147314BE005A4D2E /* libsecurity_agent.xcodeproj */; @@ -174,6 +180,34 @@ remoteGlobalIDString = 40635B69052E4CBD0009891B; remoteInfo = world; }; + 18CE013D17147A46008C042F /* PBXContainerItemProxy */ = { + isa = PBXContainerItemProxy; + containerPortal = 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */; + proxyType = 2; + remoteGlobalIDString = 1843240E1714797D00196B52; + remoteInfo = securitydservice_client; + }; + 80C7A78C167FF586001533BE /* PBXContainerItemProxy */ = { + isa = PBXContainerItemProxy; + containerPortal = 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */; + proxyType = 2; + remoteGlobalIDString = 189D4635166AC95C001D8533; + remoteInfo = securityd_service; + }; + 80C7A78E167FF586001533BE /* PBXContainerItemProxy */ = { + isa = PBXContainerItemProxy; + containerPortal = 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */; + proxyType = 2; + remoteGlobalIDString = 189D465B166C15C1001D8533; + remoteInfo = securitydservicectrl; + }; + 80C7A790167FF9D3001533BE /* PBXContainerItemProxy */ = { + isa = PBXContainerItemProxy; + containerPortal = 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */; + proxyType = 1; + remoteGlobalIDString = 189D4634166AC95C001D8533; + remoteInfo = securityd_service; + }; AA1A9FF80E71EF08003D0309 /* PBXContainerItemProxy */ = { isa = PBXContainerItemProxy; containerPortal = 4CA1FEB0052A3C5800F22E42 /* Project object */; @@ -270,7 +304,6 @@ 4C9264C20534866F004B0E72 /* transition.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = transition.cpp; sourceTree = ""; }; 4CB5ACB906680AE000F359A9 /* child.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = child.cpp; sourceTree = ""; }; 4CB5ACBA06680AE000F359A9 /* child.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = child.h; sourceTree = ""; }; - 4CD8CCBC055884E0006B3584 /* authorization.plist */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.plist; path = authorization.plist; sourceTree = ""; }; 4CD8CCBD055884E0006B3584 /* CodeEquivalenceCandidates */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = CodeEquivalenceCandidates; sourceTree = ""; }; 4CD8CCC0055884E0006B3584 /* startup.mk */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = startup.mk; sourceTree = ""; }; 4CDD5018053765A900FEC36D /* CoreFoundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreFoundation.framework; path = /System/Library/Frameworks/CoreFoundation.framework; sourceTree = ""; }; @@ -280,6 +313,7 @@ 4CE1878706FFC5D60079D235 /* securityd.1 */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.man; path = securityd.1; sourceTree = ""; }; 4E0BB2B20F79590300BBFEFA /* ccaudit_extensions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ccaudit_extensions.h; sourceTree = ""; }; 4E0BB2B30F79590300BBFEFA /* ccaudit_extensions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ccaudit_extensions.cpp; sourceTree = ""; }; + 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */ = {isa = PBXFileReference; lastKnownFileType = "wrapper.pb-project"; name = securityd_service.xcodeproj; path = securityd_service/securityd_service.xcodeproj; sourceTree = ""; }; AA6D4B8A0E6F3BB80050206D /* securityd */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = securityd; sourceTree = BUILT_PRODUCTS_DIR; }; AAA020B10E367BB000A6F842 /* dtrace.mk */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = dtrace.mk; path = dtrace/dtrace.mk; sourceTree = ""; }; C207646305EAD713004FEEDA /* kckey.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = kckey.cpp; sourceTree = ""; }; @@ -339,8 +373,8 @@ isa = PBXFrameworksBuildPhase; buildActionMask = 2147483647; files = ( + 18CE013F17147A46008C042F /* libsecuritydservice_client.a in Frameworks */, 1865FFEB1475208B00FD79DF /* libsqlite3.dylib in Frameworks */, - 1865FFEA1475208000FD79DF /* libsecurity_codesigning.a in Frameworks */, 1865FFE114751C9100FD79DF /* libauto.dylib in Frameworks */, 1865FFDC14751B0600FD79DF /* libobjc.dylib in Frameworks */, 18B965CD14731612005A4D2E /* libsecurity_agent_client.a in Frameworks */, @@ -401,6 +435,7 @@ 4CA1FEAC052A3C5800F22E42 = { isa = PBXGroup; children = ( + 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */, 18B965B0147314BE005A4D2E /* libsecurity_agent.xcodeproj */, 1865FF9F1474FB1100FD79DF /* config */, 4C9264970534866F004B0E72 /* src */, @@ -427,7 +462,6 @@ isa = PBXGroup; children = ( C26FB2650BC2C3A300D8EFC8 /* com.apple.securityd.plist */, - 4CD8CCBC055884E0006B3584 /* authorization.plist */, 4CD8CCBD055884E0006B3584 /* CodeEquivalenceCandidates */, 4CD8CCC0055884E0006B3584 /* startup.mk */, ); @@ -467,6 +501,16 @@ path = doc; sourceTree = ""; }; + 80C7A788167FF586001533BE /* Products */ = { + isa = PBXGroup; + children = ( + 80C7A78D167FF586001533BE /* securityd_service */, + 80C7A78F167FF586001533BE /* securitydservicectrl */, + 18CE013E17147A46008C042F /* libsecuritydservice_client.a */, + ); + name = Products; + sourceTree = ""; + }; C209B39106ADBB19007B9E6D /* mig */ = { isa = PBXGroup; children = ( @@ -761,6 +805,8 @@ buildRules = ( ); dependencies = ( + 1820DFC81714D3F800CA851F /* PBXTargetDependency */, + 80C7A791167FF9D3001533BE /* PBXTargetDependency */, 18B967B914731BB1005A4D2E /* PBXTargetDependency */, AA1AA00F0E71F2ED003D0309 /* PBXTargetDependency */, AA1AA0110E71F2F7003D0309 /* PBXTargetDependency */, @@ -776,6 +822,8 @@ /* Begin PBXProject section */ 4CA1FEB0052A3C5800F22E42 /* Project object */ = { isa = PBXProject; + attributes = { + }; buildConfigurationList = C27AD4AD0987FCF4001272E0 /* Build configuration list for PBXProject "securityd" */; compatibilityVersion = "Xcode 3.1"; developmentRegion = English; @@ -794,6 +842,10 @@ ProductGroup = 18B965B1147314BE005A4D2E /* Products */; ProjectRef = 18B965B0147314BE005A4D2E /* libsecurity_agent.xcodeproj */; }, + { + ProductGroup = 80C7A788167FF586001533BE /* Products */; + ProjectRef = 80C7A77A167FF4FF001533BE /* securityd_service.xcodeproj */; + }, ); projectRoot = ""; targets = ( @@ -820,23 +872,30 @@ remoteRef = 18B965C0147314BE005A4D2E /* PBXContainerItemProxy */; sourceTree = BUILT_PRODUCTS_DIR; }; + 18CE013E17147A46008C042F /* libsecuritydservice_client.a */ = { + isa = PBXReferenceProxy; + fileType = archive.ar; + path = libsecuritydservice_client.a; + remoteRef = 18CE013D17147A46008C042F /* PBXContainerItemProxy */; + sourceTree = BUILT_PRODUCTS_DIR; + }; + 80C7A78D167FF586001533BE /* securityd_service */ = { + isa = PBXReferenceProxy; + fileType = "compiled.mach-o.executable"; + path = securityd_service; + remoteRef = 80C7A78C167FF586001533BE /* PBXContainerItemProxy */; + sourceTree = BUILT_PRODUCTS_DIR; + }; + 80C7A78F167FF586001533BE /* securitydservicectrl */ = { + isa = PBXReferenceProxy; + fileType = "compiled.mach-o.executable"; + path = securitydservicectrl; + remoteRef = 80C7A78E167FF586001533BE /* PBXContainerItemProxy */; + sourceTree = BUILT_PRODUCTS_DIR; + }; /* End PBXReferenceProxy section */ /* Begin PBXShellScriptBuildPhase section */ - 18132F7B148D6DD900CC58B2 /* Run Script (install /etc/authorization.merge) */ = { - isa = PBXShellScriptBuildPhase; - buildActionMask = 2147483647; - files = ( - ); - inputPaths = ( - ); - name = "Run Script (install /etc/authorization.merge)"; - outputPaths = ( - ); - runOnlyForDeploymentPostprocessing = 0; - shellPath = /bin/sh; - shellScript = "${SRCROOT}/etc/authmerge.sh"; - }; AA6D4B790E6F3A910050206D /* ShellScript */ = { isa = PBXShellScriptBuildPhase; buildActionMask = 2147483647; @@ -934,11 +993,21 @@ /* End PBXSourcesBuildPhase section */ /* Begin PBXTargetDependency section */ + 1820DFC81714D3F800CA851F /* PBXTargetDependency */ = { + isa = PBXTargetDependency; + name = securitydservice_client; + targetProxy = 1820DFC71714D3F800CA851F /* PBXContainerItemProxy */; + }; 18B967B914731BB1005A4D2E /* PBXTargetDependency */ = { isa = PBXTargetDependency; name = world; targetProxy = 18B967B814731BB1005A4D2E /* PBXContainerItemProxy */; }; + 80C7A791167FF9D3001533BE /* PBXTargetDependency */ = { + isa = PBXTargetDependency; + name = securityd_service; + targetProxy = 80C7A790167FF9D3001533BE /* PBXContainerItemProxy */; + }; AA1A9FF90E71EF08003D0309 /* PBXTargetDependency */ = { isa = PBXTargetDependency; target = C26CF02C0CD934260094DD9D /* DTrace */; diff --git a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/DTrace.xcscheme b/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/DTrace.xcscheme deleted file mode 100644 index d5047fe..0000000 --- a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/DTrace.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/mig.xcscheme b/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/mig.xcscheme deleted file mode 100644 index c786252..0000000 --- a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/mig.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/securityd.xcscheme b/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/securityd.xcscheme deleted file mode 100644 index 08af7ac..0000000 --- a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/securityd.xcscheme +++ /dev/null @@ -1,86 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/startup.xcscheme b/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/startup.xcscheme deleted file mode 100644 index c32c278..0000000 --- a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/startup.xcscheme +++ /dev/null @@ -1,59 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/xcschememanagement.plist b/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/xcschememanagement.plist deleted file mode 100644 index c757875..0000000 --- a/securityd.xcodeproj/xcuserdata/keith.xcuserdatad/xcschemes/xcschememanagement.plist +++ /dev/null @@ -1,52 +0,0 @@ - - - - - SchemeUserState - - DTrace.xcscheme - - orderHint - 1 - - mig.xcscheme - - orderHint - 2 - - securityd.xcscheme - - orderHint - 0 - - startup.xcscheme - - orderHint - 3 - - - SuppressBuildableAutocreation - - AA6D4B7A0E6F3A910050206D - - primary - - - AA6D4B810E6F3B210050206D - - primary - - - AA6D4B890E6F3BB80050206D - - primary - - - C26CF02C0CD934260094DD9D - - primary - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcdebugger/Breakpoints.xcbkptlist b/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcdebugger/Breakpoints.xcbkptlist deleted file mode 100644 index 05301bc..0000000 --- a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcdebugger/Breakpoints.xcbkptlist +++ /dev/null @@ -1,5 +0,0 @@ - - - diff --git a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/DTrace.xcscheme b/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/DTrace.xcscheme deleted file mode 100644 index 8e88040..0000000 --- a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/DTrace.xcscheme +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/mig.xcscheme b/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/mig.xcscheme deleted file mode 100644 index f0b1212..0000000 --- a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/mig.xcscheme +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/securityd.xcscheme b/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/securityd.xcscheme deleted file mode 100644 index 8bd2c8e..0000000 --- a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/securityd.xcscheme +++ /dev/null @@ -1,85 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/startup.xcscheme b/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/startup.xcscheme deleted file mode 100644 index e8a0b01..0000000 --- a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/startup.xcscheme +++ /dev/null @@ -1,58 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/xcschememanagement.plist b/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/xcschememanagement.plist deleted file mode 100644 index c757875..0000000 --- a/securityd.xcodeproj/xcuserdata/keith_henrickson.xcuserdatad/xcschemes/xcschememanagement.plist +++ /dev/null @@ -1,52 +0,0 @@ - - - - - SchemeUserState - - DTrace.xcscheme - - orderHint - 1 - - mig.xcscheme - - orderHint - 2 - - securityd.xcscheme - - orderHint - 0 - - startup.xcscheme - - orderHint - 3 - - - SuppressBuildableAutocreation - - AA6D4B7A0E6F3A910050206D - - primary - - - AA6D4B810E6F3B210050206D - - primary - - - AA6D4B890E6F3BB80050206D - - primary - - - C26CF02C0CD934260094DD9D - - primary - - - - - diff --git a/securityd_service/KeyStore/AppleKeyStoreEvents.h b/securityd_service/KeyStore/AppleKeyStoreEvents.h new file mode 100644 index 0000000..50b7019 --- /dev/null +++ b/securityd_service/KeyStore/AppleKeyStoreEvents.h @@ -0,0 +1,9 @@ +/* Copyright (c) 2013 Apple Inc. All rights reserved. */ + +#ifndef __APPLEKEYSTORE_EVENTS_H +#define __APPLEKEYSTORE_EVENTS_H + +#define kAppleKeyStoreLockStatusNotificationID "com.apple.keystore.lockstatus" +#define kAppleKeyStoreFirstUnlockNotificationID "com.apple.keystore.firstunlock" + +#endif // __APPLEKEYSTORE_EVENTS_H diff --git a/securityd_service/KeyStore/KeyStore-Info.plist b/securityd_service/KeyStore/KeyStore-Info.plist new file mode 100644 index 0000000..505cb03 --- /dev/null +++ b/securityd_service/KeyStore/KeyStore-Info.plist @@ -0,0 +1,28 @@ + + + + + CFBundleDevelopmentRegion + English + CFBundleExecutable + ${EXECUTABLE_NAME} + CFBundleIdentifier + com.apple.${PRODUCT_NAME:rfc1034identifier} + CFBundleInfoDictionaryVersion + 6.0 + CFBundleName + ${PRODUCT_NAME} + CFBundlePackageType + BNDL + CFBundleShortVersionString + 1.0 + CFBundleSignature + ???? + CFBundleVersion + 1 + NSHumanReadableCopyright + Copyright © 2013 Apple. All rights reserved. + XPCEventModuleInitializer + init_keystore_events + + diff --git a/securityd_service/KeyStore/KeyStoreEvents.c b/securityd_service/KeyStore/KeyStoreEvents.c new file mode 100644 index 0000000..0ca8985 --- /dev/null +++ b/securityd_service/KeyStore/KeyStoreEvents.c @@ -0,0 +1,54 @@ +/* Copyright (c) 2013 Apple Inc. All rights reserved. */ + +#include "AppleKeyStoreEvents.h" + +#include +#include +#include +#include +#include +#include +#include + +static void aksNotificationCallback(void *refcon,io_service_t service, natural_t messageType, void *messageArgument) +{ + if(messageType == kAppleKeyStoreLockStateChangeMessage) { +// syslog(LOG_ERR, "KeyStoreNotifier - %s posting notification: %s\n", __func__, kAppleKeyStoreLockStatusNotificationID); + notify_post(kAppleKeyStoreLockStatusNotificationID); + } else if (messageType == kAppleKeyStoreFirstUnlockMessage) { +// syslog(LOG_ERR, "KeyStoreNotifier - %s posting notification: %s\n", __func__, kAppleKeyStoreFirstUnlockNotificationID); + notify_post(kAppleKeyStoreFirstUnlockNotificationID); + } +} + +static void start(dispatch_queue_t queue) +{ + IOReturn result; + io_service_t aksService = IO_OBJECT_NULL; + IONotificationPortRef aksNotifyPort = IO_OBJECT_NULL; + io_object_t notification = IO_OBJECT_NULL; + + aksService = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching(kAppleKeyStoreServiceName)); + require_action(aksService, cleanup, syslog(LOG_ERR, "KeyStoreNotifier - Can't find %s service", kAppleKeyStoreServiceName)); + + aksNotifyPort = IONotificationPortCreate(kIOMasterPortDefault); + require_action(aksNotifyPort, cleanup, syslog(LOG_ERR, "KeyStoreNotifier - Can't create notification port")); + + IONotificationPortSetDispatchQueue(aksNotifyPort, queue); + + result = IOServiceAddInterestNotification(aksNotifyPort, aksService, kIOGeneralInterest, aksNotificationCallback, NULL, ¬ification); + require_noerr_action(result, cleanup, syslog(LOG_ERR, "KeyStoreNotifier - Can't register for notification: %08x", result)); + return; + +cleanup: + if (aksNotifyPort) IONotificationPortDestroy(aksNotifyPort); + if (notification) IOObjectRelease(notification); + if (aksService) IOObjectRelease(aksService); + return; +} + +void +init_keystore_events(xpc_event_module_t module) +{ + start(xpc_event_module_get_queue(module)); +} diff --git a/securityd_service/securityd_service.xcodeproj/project.pbxproj b/securityd_service/securityd_service.xcodeproj/project.pbxproj new file mode 100644 index 0000000..b31f75c --- /dev/null +++ b/securityd_service/securityd_service.xcodeproj/project.pbxproj @@ -0,0 +1,634 @@ +// !$*UTF8*$! +{ + archiveVersion = 1; + classes = { + }; + objectVersion = 46; + objects = { + +/* Begin PBXBuildFile section */ + 189D4639166AC95C001D8533 /* main.c in Sources */ = {isa = PBXBuildFile; fileRef = 189D4638166AC95C001D8533 /* main.c */; }; + 189D4644166BFDCE001D8533 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 189D4643166BFDCE001D8533 /* Security.framework */; }; + 189D4647166C03CD001D8533 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 189D4646166C03CD001D8533 /* CoreFoundation.framework */; }; + 189D4649166C11A6001D8533 /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 189D4648166C11A6001D8533 /* IOKit.framework */; }; + 189D465E166C15C1001D8533 /* main.c in Sources */ = {isa = PBXBuildFile; fileRef = 189D465D166C15C1001D8533 /* main.c */; }; + 189D4667166C1809001D8533 /* com.apple.securityd_service.plist in Copy launchd plist */ = {isa = PBXBuildFile; fileRef = 189D4666166C171B001D8533 /* com.apple.securityd_service.plist */; }; + 189D4668166C19CF001D8533 /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 189D4646166C03CD001D8533 /* CoreFoundation.framework */; }; + 18CD2B721714D48900633846 /* securityd_service_client.c in Sources */ = {isa = PBXBuildFile; fileRef = 18CD2B711714D48300633846 /* securityd_service_client.c */; }; + 18CD2B791715CEC800633846 /* libaks.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 18CD2B781715CEC800633846 /* libaks.a */; }; + 18D7BBD2171639F0008F80B3 /* com.apple.securitydservice.sb in Copy sandbox profile */ = {isa = PBXBuildFile; fileRef = 18D7BBD0171638B9008F80B3 /* com.apple.securitydservice.sb */; }; + 18F4808F17497521009724DB /* CoreFoundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 189D4646166C03CD001D8533 /* CoreFoundation.framework */; }; + 18F4809D174976DA009724DB /* KeyStoreEvents.c in Sources */ = {isa = PBXBuildFile; fileRef = 18F4809C174976D2009724DB /* KeyStoreEvents.c */; }; + 18F4809E1749774F009724DB /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 189D4648166C11A6001D8533 /* IOKit.framework */; }; + 18F480A217498ADD009724DB /* AppleKeyStoreEvents.h in Headers */ = {isa = PBXBuildFile; fileRef = 18F4809F17498963009724DB /* AppleKeyStoreEvents.h */; settings = {ATTRIBUTES = (Public, ); }; }; + 80C312B6169BA50700DA5DC6 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 189D4643166BFDCE001D8533 /* Security.framework */; }; +/* End PBXBuildFile section */ + +/* Begin PBXContainerItemProxy section */ + 189D4664166C166E001D8533 /* PBXContainerItemProxy */ = { + isa = PBXContainerItemProxy; + containerPortal = 189D462D166AC95C001D8533 /* Project object */; + proxyType = 1; + remoteGlobalIDString = 189D465A166C15C1001D8533; + remoteInfo = securitydservicectrl; + }; + 18F4809A174975FF009724DB /* PBXContainerItemProxy */ = { + isa = PBXContainerItemProxy; + containerPortal = 189D462D166AC95C001D8533 /* Project object */; + proxyType = 1; + remoteGlobalIDString = 18F4808D17497521009724DB; + remoteInfo = KeyStore; + }; +/* End PBXContainerItemProxy section */ + +/* Begin PBXCopyFilesBuildPhase section */ + 189D4633166AC95C001D8533 /* Copy launchd plist */ = { + isa = PBXCopyFilesBuildPhase; + buildActionMask = 2147483647; + dstPath = /System/Library/LaunchDaemons; + dstSubfolderSpec = 0; + files = ( + 189D4667166C1809001D8533 /* com.apple.securityd_service.plist in Copy launchd plist */, + ); + name = "Copy launchd plist"; + runOnlyForDeploymentPostprocessing = 1; + }; + 189D4659166C15C1001D8533 /* CopyFiles */ = { + isa = PBXCopyFilesBuildPhase; + buildActionMask = 2147483647; + dstPath = /usr/share/man/man1/; + dstSubfolderSpec = 0; + files = ( + ); + runOnlyForDeploymentPostprocessing = 1; + }; + 18D7BBD1171639CE008F80B3 /* Copy sandbox profile */ = { + isa = PBXCopyFilesBuildPhase; + buildActionMask = 8; + dstPath = "$(SYSTEM_LIBRARY_DIR)/Sandbox/Profiles"; + dstSubfolderSpec = 0; + files = ( + 18D7BBD2171639F0008F80B3 /* com.apple.securitydservice.sb in Copy sandbox profile */, + ); + name = "Copy sandbox profile"; + runOnlyForDeploymentPostprocessing = 1; + }; +/* End PBXCopyFilesBuildPhase section */ + +/* Begin PBXFileReference section */ + 1843240E1714797D00196B52 /* libsecuritydservice_client.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = libsecuritydservice_client.a; sourceTree = BUILT_PRODUCTS_DIR; }; + 189D4635166AC95C001D8533 /* securityd_service */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = securityd_service; sourceTree = BUILT_PRODUCTS_DIR; }; + 189D4638166AC95C001D8533 /* main.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = main.c; sourceTree = ""; }; + 189D4641166AC9B6001D8533 /* securityd_service.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = securityd_service.h; sourceTree = ""; }; + 189D4642166BD755001D8533 /* service.entitlements */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xml; path = service.entitlements; sourceTree = ""; }; + 189D4643166BFDCE001D8533 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = /System/Library/Frameworks/Security.framework; sourceTree = ""; }; + 189D4646166C03CD001D8533 /* CoreFoundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreFoundation.framework; path = /System/Library/Frameworks/CoreFoundation.framework; sourceTree = ""; }; + 189D4648166C11A6001D8533 /* IOKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = IOKit.framework; path = /System/Library/Frameworks/IOKit.framework; sourceTree = ""; }; + 189D465B166C15C1001D8533 /* securitydservicectrl */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = securitydservicectrl; sourceTree = BUILT_PRODUCTS_DIR; }; + 189D465D166C15C1001D8533 /* main.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = main.c; sourceTree = ""; }; + 189D4666166C171B001D8533 /* com.apple.securityd_service.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = com.apple.securityd_service.plist; sourceTree = ""; }; + 18CD2B711714D48300633846 /* securityd_service_client.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; name = securityd_service_client.c; path = securityd_service/securityd_service_client.c; sourceTree = ""; }; + 18CD2B731714D4B300633846 /* securityd_service_client.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = securityd_service_client.h; path = securityd_service/securityd_service_client.h; sourceTree = ""; }; + 18CD2B781715CEC800633846 /* libaks.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; name = libaks.a; path = /usr/local/lib/libaks.a; sourceTree = ""; }; + 18D7BBD0171638B9008F80B3 /* com.apple.securitydservice.sb */ = {isa = PBXFileReference; lastKnownFileType = text; path = com.apple.securitydservice.sb; sourceTree = ""; }; + 18F4808E17497521009724DB /* com.apple.KeyStore.plugin */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = com.apple.KeyStore.plugin; sourceTree = BUILT_PRODUCTS_DIR; }; + 18F4809217497521009724DB /* KeyStore-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "KeyStore-Info.plist"; sourceTree = ""; }; + 18F4809C174976D2009724DB /* KeyStoreEvents.c */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.c; path = KeyStoreEvents.c; sourceTree = ""; }; + 18F4809F17498963009724DB /* AppleKeyStoreEvents.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = AppleKeyStoreEvents.h; sourceTree = ""; }; +/* End PBXFileReference section */ + +/* Begin PBXFrameworksBuildPhase section */ + 1843240B1714797D00196B52 /* Frameworks */ = { + isa = PBXFrameworksBuildPhase; + buildActionMask = 2147483647; + files = ( + ); + runOnlyForDeploymentPostprocessing = 0; + }; + 189D4632166AC95C001D8533 /* Frameworks */ = { + isa = PBXFrameworksBuildPhase; + buildActionMask = 2147483647; + files = ( + 18CD2B791715CEC800633846 /* libaks.a in Frameworks */, + 189D4649166C11A6001D8533 /* IOKit.framework in Frameworks */, + 189D4647166C03CD001D8533 /* CoreFoundation.framework in Frameworks */, + 189D4644166BFDCE001D8533 /* Security.framework in Frameworks */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; + 189D4658166C15C1001D8533 /* Frameworks */ = { + isa = PBXFrameworksBuildPhase; + buildActionMask = 2147483647; + files = ( + 80C312B6169BA50700DA5DC6 /* Security.framework in Frameworks */, + 189D4668166C19CF001D8533 /* CoreFoundation.framework in Frameworks */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; + 18F4808B17497521009724DB /* Frameworks */ = { + isa = PBXFrameworksBuildPhase; + buildActionMask = 2147483647; + files = ( + 18F4809E1749774F009724DB /* IOKit.framework in Frameworks */, + 18F4808F17497521009724DB /* CoreFoundation.framework in Frameworks */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; +/* End PBXFrameworksBuildPhase section */ + +/* Begin PBXGroup section */ + 189D462C166AC95C001D8533 = { + isa = PBXGroup; + children = ( + 189D4637166AC95C001D8533 /* securityd_service */, + 18CD2B3B1714D43C00633846 /* securityd_service_client */, + 189D465C166C15C1001D8533 /* securitydservicectrl */, + 18F4809017497521009724DB /* KeyStore */, + 189D4645166BFDD4001D8533 /* Frameworks */, + 189D4636166AC95C001D8533 /* Products */, + ); + sourceTree = ""; + }; + 189D4636166AC95C001D8533 /* Products */ = { + isa = PBXGroup; + children = ( + 189D4635166AC95C001D8533 /* securityd_service */, + 189D465B166C15C1001D8533 /* securitydservicectrl */, + 1843240E1714797D00196B52 /* libsecuritydservice_client.a */, + 18F4808E17497521009724DB /* com.apple.KeyStore.plugin */, + ); + name = Products; + sourceTree = ""; + }; + 189D4637166AC95C001D8533 /* securityd_service */ = { + isa = PBXGroup; + children = ( + 189D4638166AC95C001D8533 /* main.c */, + 189D4641166AC9B6001D8533 /* securityd_service.h */, + 189D4642166BD755001D8533 /* service.entitlements */, + 189D4666166C171B001D8533 /* com.apple.securityd_service.plist */, + 18D7BBD0171638B9008F80B3 /* com.apple.securitydservice.sb */, + ); + path = securityd_service; + sourceTree = ""; + }; + 189D4645166BFDD4001D8533 /* Frameworks */ = { + isa = PBXGroup; + children = ( + 18CD2B781715CEC800633846 /* libaks.a */, + 189D4648166C11A6001D8533 /* IOKit.framework */, + 189D4646166C03CD001D8533 /* CoreFoundation.framework */, + 189D4643166BFDCE001D8533 /* Security.framework */, + ); + name = Frameworks; + path = /Volumes/Data/wade/src/projects/securityd_service; + sourceTree = ""; + }; + 189D465C166C15C1001D8533 /* securitydservicectrl */ = { + isa = PBXGroup; + children = ( + 189D465D166C15C1001D8533 /* main.c */, + ); + path = securitydservicectrl; + sourceTree = ""; + }; + 18CD2B3B1714D43C00633846 /* securityd_service_client */ = { + isa = PBXGroup; + children = ( + 18CD2B711714D48300633846 /* securityd_service_client.c */, + 18CD2B731714D4B300633846 /* securityd_service_client.h */, + ); + name = securityd_service_client; + sourceTree = ""; + }; + 18F4809017497521009724DB /* KeyStore */ = { + isa = PBXGroup; + children = ( + 18F4809117497521009724DB /* Supporting Files */, + 18F4809C174976D2009724DB /* KeyStoreEvents.c */, + 18F4809F17498963009724DB /* AppleKeyStoreEvents.h */, + ); + path = KeyStore; + sourceTree = ""; + }; + 18F4809117497521009724DB /* Supporting Files */ = { + isa = PBXGroup; + children = ( + 18F4809217497521009724DB /* KeyStore-Info.plist */, + ); + name = "Supporting Files"; + sourceTree = ""; + }; +/* End PBXGroup section */ + +/* Begin PBXHeadersBuildPhase section */ + 1843240C1714797D00196B52 /* Headers */ = { + isa = PBXHeadersBuildPhase; + buildActionMask = 2147483647; + files = ( + ); + runOnlyForDeploymentPostprocessing = 0; + }; + 18F480A117498AD8009724DB /* Headers */ = { + isa = PBXHeadersBuildPhase; + buildActionMask = 2147483647; + files = ( + 18F480A217498ADD009724DB /* AppleKeyStoreEvents.h in Headers */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; +/* End PBXHeadersBuildPhase section */ + +/* Begin PBXNativeTarget section */ + 1843240D1714797D00196B52 /* securitydservice_client */ = { + isa = PBXNativeTarget; + buildConfigurationList = 184324111714797D00196B52 /* Build configuration list for PBXNativeTarget "securitydservice_client" */; + buildPhases = ( + 1843240A1714797D00196B52 /* Sources */, + 1843240B1714797D00196B52 /* Frameworks */, + 1843240C1714797D00196B52 /* Headers */, + ); + buildRules = ( + ); + dependencies = ( + ); + name = securitydservice_client; + productName = securitydservice_client; + productReference = 1843240E1714797D00196B52 /* libsecuritydservice_client.a */; + productType = "com.apple.product-type.library.static"; + }; + 189D4634166AC95C001D8533 /* securityd_service */ = { + isa = PBXNativeTarget; + buildConfigurationList = 189D463E166AC95C001D8533 /* Build configuration list for PBXNativeTarget "securityd_service" */; + buildPhases = ( + 189D4631166AC95C001D8533 /* Sources */, + 189D4632166AC95C001D8533 /* Frameworks */, + 189D4633166AC95C001D8533 /* Copy launchd plist */, + 18D7BBD1171639CE008F80B3 /* Copy sandbox profile */, + ); + buildRules = ( + ); + dependencies = ( + 18F4809B174975FF009724DB /* PBXTargetDependency */, + 189D4665166C166E001D8533 /* PBXTargetDependency */, + ); + name = securityd_service; + productName = securityd_service; + productReference = 189D4635166AC95C001D8533 /* securityd_service */; + productType = "com.apple.product-type.tool"; + }; + 189D465A166C15C1001D8533 /* securitydservicectrl */ = { + isa = PBXNativeTarget; + buildConfigurationList = 189D4661166C15C1001D8533 /* Build configuration list for PBXNativeTarget "securitydservicectrl" */; + buildPhases = ( + 189D4657166C15C1001D8533 /* Sources */, + 189D4658166C15C1001D8533 /* Frameworks */, + 189D4659166C15C1001D8533 /* CopyFiles */, + ); + buildRules = ( + ); + dependencies = ( + ); + name = securitydservicectrl; + productName = securitydservicectrl; + productReference = 189D465B166C15C1001D8533 /* securitydservicectrl */; + productType = "com.apple.product-type.tool"; + }; + 18F4808D17497521009724DB /* KeyStoreEvents */ = { + isa = PBXNativeTarget; + buildConfigurationList = 18F4809917497521009724DB /* Build configuration list for PBXNativeTarget "KeyStoreEvents" */; + buildPhases = ( + 18F4808A17497521009724DB /* Sources */, + 18F4808B17497521009724DB /* Frameworks */, + 18F4808C17497521009724DB /* Resources */, + 18F480A117498AD8009724DB /* Headers */, + ); + buildRules = ( + ); + dependencies = ( + ); + name = KeyStoreEvents; + productName = KeyStore; + productReference = 18F4808E17497521009724DB /* com.apple.KeyStore.plugin */; + productType = "com.apple.product-type.bundle"; + }; +/* End PBXNativeTarget section */ + +/* Begin PBXProject section */ + 189D462D166AC95C001D8533 /* Project object */ = { + isa = PBXProject; + attributes = { + LastUpgradeCheck = 0460; + ORGANIZATIONNAME = Apple; + }; + buildConfigurationList = 189D4630166AC95C001D8533 /* Build configuration list for PBXProject "securityd_service" */; + compatibilityVersion = "Xcode 3.2"; + developmentRegion = English; + hasScannedForEncodings = 0; + knownRegions = ( + en, + ); + mainGroup = 189D462C166AC95C001D8533; + productRefGroup = 189D4636166AC95C001D8533 /* Products */; + projectDirPath = ""; + projectRoot = ""; + targets = ( + 189D4634166AC95C001D8533 /* securityd_service */, + 189D465A166C15C1001D8533 /* securitydservicectrl */, + 1843240D1714797D00196B52 /* securitydservice_client */, + 18F4808D17497521009724DB /* KeyStoreEvents */, + ); + }; +/* End PBXProject section */ + +/* Begin PBXResourcesBuildPhase section */ + 18F4808C17497521009724DB /* Resources */ = { + isa = PBXResourcesBuildPhase; + buildActionMask = 2147483647; + files = ( + ); + runOnlyForDeploymentPostprocessing = 0; + }; +/* End PBXResourcesBuildPhase section */ + +/* Begin PBXSourcesBuildPhase section */ + 1843240A1714797D00196B52 /* Sources */ = { + isa = PBXSourcesBuildPhase; + buildActionMask = 2147483647; + files = ( + 18CD2B721714D48900633846 /* securityd_service_client.c in Sources */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; + 189D4631166AC95C001D8533 /* Sources */ = { + isa = PBXSourcesBuildPhase; + buildActionMask = 2147483647; + files = ( + 189D4639166AC95C001D8533 /* main.c in Sources */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; + 189D4657166C15C1001D8533 /* Sources */ = { + isa = PBXSourcesBuildPhase; + buildActionMask = 2147483647; + files = ( + 189D465E166C15C1001D8533 /* main.c in Sources */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; + 18F4808A17497521009724DB /* Sources */ = { + isa = PBXSourcesBuildPhase; + buildActionMask = 2147483647; + files = ( + 18F4809D174976DA009724DB /* KeyStoreEvents.c in Sources */, + ); + runOnlyForDeploymentPostprocessing = 0; + }; +/* End PBXSourcesBuildPhase section */ + +/* Begin PBXTargetDependency section */ + 189D4665166C166E001D8533 /* PBXTargetDependency */ = { + isa = PBXTargetDependency; + target = 189D465A166C15C1001D8533 /* securitydservicectrl */; + targetProxy = 189D4664166C166E001D8533 /* PBXContainerItemProxy */; + }; + 18F4809B174975FF009724DB /* PBXTargetDependency */ = { + isa = PBXTargetDependency; + target = 18F4808D17497521009724DB /* KeyStoreEvents */; + targetProxy = 18F4809A174975FF009724DB /* PBXContainerItemProxy */; + }; +/* End PBXTargetDependency section */ + +/* Begin XCBuildConfiguration section */ + 1843240F1714797D00196B52 /* Debug */ = { + isa = XCBuildConfiguration; + buildSettings = { + CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x"; + CLANG_CXX_LIBRARY = "libc++"; + CLANG_ENABLE_MODULES = YES; + CLANG_WARN_BOOL_CONVERSION = YES; + CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; + CLANG_WARN_ENUM_CONVERSION = YES; + CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; + EXECUTABLE_PREFIX = lib; + GCC_C_LANGUAGE_STANDARD = gnu99; + GCC_PREPROCESSOR_DEFINITIONS = ( + "DEBUG=1", + "$(inherited)", + ); + GCC_WARN_UNDECLARED_SELECTOR = YES; + PRODUCT_NAME = "$(TARGET_NAME)"; + }; + name = Debug; + }; + 184324101714797D00196B52 /* Release */ = { + isa = XCBuildConfiguration; + buildSettings = { + CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x"; + CLANG_CXX_LIBRARY = "libc++"; + CLANG_ENABLE_MODULES = YES; + CLANG_WARN_BOOL_CONVERSION = YES; + CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; + CLANG_WARN_ENUM_CONVERSION = YES; + CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; + ENABLE_NS_ASSERTIONS = NO; + EXECUTABLE_PREFIX = lib; + GCC_C_LANGUAGE_STANDARD = gnu99; + GCC_WARN_UNDECLARED_SELECTOR = YES; + PRODUCT_NAME = "$(TARGET_NAME)"; + }; + name = Release; + }; + 189D463C166AC95C001D8533 /* Debug */ = { + isa = XCBuildConfiguration; + buildSettings = { + ALWAYS_SEARCH_USER_PATHS = NO; + ARCHS = "$(ARCHS_STANDARD_64_BIT)"; + CLANG_ENABLE_OBJC_ARC = YES; + CLANG_WARN_CONSTANT_CONVERSION = YES; + CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES; + CLANG_WARN_EMPTY_BODY = YES; + CLANG_WARN_INT_CONVERSION = YES; + CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; + CODE_SIGN_IDENTITY = "-"; + COPY_PHASE_STRIP = NO; + DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; + GCC_DYNAMIC_NO_PIC = NO; + GCC_ENABLE_OBJC_EXCEPTIONS = YES; + GCC_OPTIMIZATION_LEVEL = 0; + GCC_PREPROCESSOR_DEFINITIONS = ( + "RC_BUILDIT_$(RC_BUILDIT)=1", + "DEBUG=1", + "$(inherited)", + ); + GCC_STRICT_ALIASING = YES; + GCC_SYMBOLS_PRIVATE_EXTERN = NO; + GCC_WARN_64_TO_32_BIT_CONVERSION = YES; + GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO; + GCC_WARN_ABOUT_RETURN_TYPE = YES; + GCC_WARN_UNINITIALIZED_AUTOS = YES; + GCC_WARN_UNUSED_VARIABLE = YES; + ONLY_ACTIVE_ARCH = YES; + }; + name = Debug; + }; + 189D463D166AC95C001D8533 /* Release */ = { + isa = XCBuildConfiguration; + buildSettings = { + ALWAYS_SEARCH_USER_PATHS = NO; + ARCHS = "$(ARCHS_STANDARD_64_BIT)"; + CLANG_ENABLE_OBJC_ARC = YES; + CLANG_WARN_CONSTANT_CONVERSION = YES; + CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES; + CLANG_WARN_EMPTY_BODY = YES; + CLANG_WARN_INT_CONVERSION = YES; + CLANG_WARN__DUPLICATE_METHOD_MATCH = YES; + CODE_SIGN_IDENTITY = "-"; + COPY_PHASE_STRIP = YES; + DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym"; + GCC_ENABLE_OBJC_EXCEPTIONS = YES; + GCC_PREPROCESSOR_DEFINITIONS = ( + "RC_BUILDIT_$(RC_BUILDIT)=1", + "NDEBUG=1", + ); + GCC_STRICT_ALIASING = YES; + GCC_WARN_64_TO_32_BIT_CONVERSION = YES; + GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO; + GCC_WARN_ABOUT_RETURN_TYPE = YES; + GCC_WARN_UNINITIALIZED_AUTOS = YES; + GCC_WARN_UNUSED_VARIABLE = YES; + }; + name = Release; + }; + 189D463F166AC95C001D8533 /* Debug */ = { + isa = XCBuildConfiguration; + buildSettings = { + CODE_SIGN_ENTITLEMENTS = securityd_service/service.entitlements; + INSTALL_PATH = /usr/libexec; + PRODUCT_NAME = "$(TARGET_NAME)"; + }; + name = Debug; + }; + 189D4640166AC95C001D8533 /* Release */ = { + isa = XCBuildConfiguration; + buildSettings = { + CODE_SIGN_ENTITLEMENTS = securityd_service/service.entitlements; + INSTALL_PATH = /usr/libexec; + PRODUCT_NAME = "$(TARGET_NAME)"; + }; + name = Release; + }; + 189D4662166C15C1001D8533 /* Debug */ = { + isa = XCBuildConfiguration; + buildSettings = { + PRODUCT_NAME = "$(TARGET_NAME)"; + }; + name = Debug; + }; + 189D4663166C15C1001D8533 /* Release */ = { + isa = XCBuildConfiguration; + buildSettings = { + PRODUCT_NAME = "$(TARGET_NAME)"; + }; + name = Release; + }; + 18F4809717497521009724DB /* Debug */ = { + isa = XCBuildConfiguration; + buildSettings = { + BUNDLE_LOADER = /usr/libexec/UserEventAgent; + CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x"; + CLANG_CXX_LIBRARY = "libc++"; + CLANG_ENABLE_MODULES = YES; + CLANG_WARN_BOOL_CONVERSION = YES; + CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; + CLANG_WARN_ENUM_CONVERSION = YES; + CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; + GCC_C_LANGUAGE_STANDARD = gnu99; + GCC_PRECOMPILE_PREFIX_HEADER = YES; + GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR; + GCC_WARN_UNDECLARED_SELECTOR = YES; + GCC_WARN_UNUSED_FUNCTION = YES; + INFOPLIST_FILE = "KeyStore/KeyStore-Info.plist"; + INSTALL_PATH = "$(SYSTEM_LIBRARY_DIR)/UserEventPlugins"; + PRODUCT_NAME = com.apple.KeyStore; + PUBLIC_HEADERS_FOLDER_PATH = /usr/local/include; + WRAPPER_EXTENSION = plugin; + }; + name = Debug; + }; + 18F4809817497521009724DB /* Release */ = { + isa = XCBuildConfiguration; + buildSettings = { + BUNDLE_LOADER = /usr/libexec/UserEventAgent; + CLANG_CXX_LANGUAGE_STANDARD = "gnu++0x"; + CLANG_CXX_LIBRARY = "libc++"; + CLANG_ENABLE_MODULES = YES; + CLANG_WARN_BOOL_CONVERSION = YES; + CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR; + CLANG_WARN_ENUM_CONVERSION = YES; + CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR; + ENABLE_NS_ASSERTIONS = NO; + GCC_C_LANGUAGE_STANDARD = gnu99; + GCC_PRECOMPILE_PREFIX_HEADER = YES; + GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR; + GCC_WARN_UNDECLARED_SELECTOR = YES; + GCC_WARN_UNUSED_FUNCTION = YES; + INFOPLIST_FILE = "KeyStore/KeyStore-Info.plist"; + INSTALL_PATH = "$(SYSTEM_LIBRARY_DIR)/UserEventPlugins"; + PRODUCT_NAME = com.apple.KeyStore; + PUBLIC_HEADERS_FOLDER_PATH = /usr/local/include; + WRAPPER_EXTENSION = plugin; + }; + name = Release; + }; +/* End XCBuildConfiguration section */ + +/* Begin XCConfigurationList section */ + 184324111714797D00196B52 /* Build configuration list for PBXNativeTarget "securitydservice_client" */ = { + isa = XCConfigurationList; + buildConfigurations = ( + 1843240F1714797D00196B52 /* Debug */, + 184324101714797D00196B52 /* Release */, + ); + defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; + }; + 189D4630166AC95C001D8533 /* Build configuration list for PBXProject "securityd_service" */ = { + isa = XCConfigurationList; + buildConfigurations = ( + 189D463C166AC95C001D8533 /* Debug */, + 189D463D166AC95C001D8533 /* Release */, + ); + defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; + }; + 189D463E166AC95C001D8533 /* Build configuration list for PBXNativeTarget "securityd_service" */ = { + isa = XCConfigurationList; + buildConfigurations = ( + 189D463F166AC95C001D8533 /* Debug */, + 189D4640166AC95C001D8533 /* Release */, + ); + defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; + }; + 189D4661166C15C1001D8533 /* Build configuration list for PBXNativeTarget "securitydservicectrl" */ = { + isa = XCConfigurationList; + buildConfigurations = ( + 189D4662166C15C1001D8533 /* Debug */, + 189D4663166C15C1001D8533 /* Release */, + ); + defaultConfigurationIsVisible = 0; + defaultConfigurationName = Release; + }; + 18F4809917497521009724DB /* Build configuration list for PBXNativeTarget "KeyStoreEvents" */ = { + isa = XCConfigurationList; + buildConfigurations = ( + 18F4809717497521009724DB /* Debug */, + 18F4809817497521009724DB /* Release */, + ); + defaultConfigurationIsVisible = 0; + }; +/* End XCConfigurationList section */ + }; + rootObject = 189D462D166AC95C001D8533 /* Project object */; +} diff --git a/securityd_service/securityd_service/com.apple.securityd_service.plist b/securityd_service/securityd_service/com.apple.securityd_service.plist new file mode 100644 index 0000000..11f3a12 --- /dev/null +++ b/securityd_service/securityd_service/com.apple.securityd_service.plist @@ -0,0 +1,17 @@ + + + + + EnableTransactions + + Label + com.apple.securityd_service + Program + /usr/libexec/securityd_service + MachServices + + com.apple.securitydservice + + + + diff --git a/securityd_service/securityd_service/com.apple.securitydservice.sb b/securityd_service/securityd_service/com.apple.securitydservice.sb new file mode 100644 index 0000000..32d0470 --- /dev/null +++ b/securityd_service/securityd_service/com.apple.securitydservice.sb @@ -0,0 +1,31 @@ +(version 1) + +(deny default) + +(import "system.sb") + +(allow file-read*) + +(allow file-read* + (literal "/usr/libexec") + (literal "/usr/libexec/securityd_service") + (literal "/usr/sbin") + (literal "/usr/sbin/securityd")) + +(allow file-read* file-write* + (subpath "/private/var/keybags") + (regex #"/Keychains/") + (subpath "/private/var/db/mds")) + +(allow mach-lookup + (global-name "com.apple.SecurityServer")) + +(allow iokit-open + (iokit-user-client-class "AppleFDEKeyStoreUserClient") + (iokit-user-client-class "AppleKeyStoreUserClient")) + +(allow ipc-posix-shm + (ipc-posix-name "apple.shm.notification_center") + (ipc-posix-name "com.apple.AppleDatabaseChanged")) + +(allow system-audit) diff --git a/securityd_service/securityd_service/main.c b/securityd_service/securityd_service/main.c new file mode 100644 index 0000000..18283a8 --- /dev/null +++ b/securityd_service/securityd_service/main.c @@ -0,0 +1,932 @@ +/* Copyright (c) 2013 Apple Inc. All rights reserved. */ + +#include "securityd_service.h" +#include "securityd_service_client.h" +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include + +#if DEBUG +#define LOG(...) syslog(LOG_NOTICE, ##__VA_ARGS__); +#else +#define LOG(...) +#endif + +// exported from libaks.a +kern_return_t _aks_stash_create_internal(keybag_handle_t handle, bool stage_key, const void * passcode, int length); +kern_return_t _aks_stash_load_internal(keybag_handle_t handle, bool verify, uint8_t * data, size_t length, keybag_handle_t * handle_out); +kern_return_t _aks_stash_destroy_internal(void); +kern_return_t _aks_stash_commit_internal(void ** data, int * length); + +const char * kb_home_path = "Library/Keychains"; +const char * kb_user_bag = "user.kb"; +const char * kb_stash_bag = "stash.kb"; + +typedef struct { + uid_t uid; + gid_t gid; + char * name; + char * home; +} service_user_record_t; + +typedef enum { + kb_bag_type_user, + kb_bag_type_stash +} kb_bag_type_t; + +static io_connect_t +openiodev(void) +{ + io_registry_entry_t service; + io_connect_t conn; + kern_return_t kr; + + service = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching(kAppleFDEKeyStoreServiceName)); + if (service == IO_OBJECT_NULL) + return IO_OBJECT_NULL; + + kr = IOServiceOpen(service, mach_task_self(), 0, &conn); + if (kr != KERN_SUCCESS) + return IO_OBJECT_NULL; + + kr = IOConnectCallMethod(conn, kAppleFDEKeyStoreUserClientOpen, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL); + if (kr != KERN_SUCCESS) { + IOServiceClose(conn); + return IO_OBJECT_NULL; + } + + return conn; +} + +static void +closeiodev(io_connect_t conn) +{ + kern_return_t kr; + kr = IOConnectCallMethod(conn, kAppleFDEKeyStoreUserClientClose, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL); + if (kr != KERN_SUCCESS) + return; + IOServiceClose(conn); +} + +static dispatch_queue_t +_kb_service_get_dispatch_queue() +{ + static dispatch_once_t onceToken = 0; + static dispatch_queue_t connection_queue = NULL; + + dispatch_once(&onceToken, ^{ + connection_queue = dispatch_queue_create("kb-service-queue", DISPATCH_QUEUE_SERIAL); + }); + + return connection_queue; +} + +static service_user_record_t * get_user_record(uid_t uid) +{ + service_user_record_t * ur = NULL; + long bufsize = 0; + if ((bufsize = sysconf(_SC_GETPW_R_SIZE_MAX)) == -1) { + bufsize = 4096; + } + char buf[bufsize]; + struct passwd pwbuf, *pw = NULL; + if ((getpwuid_r(uid, &pwbuf, buf, bufsize, &pw) == 0) && pw != NULL) { + ur = calloc(1u, sizeof(service_user_record_t)); + require(ur, done); + ur->uid = pw->pw_uid; + ur->gid = pw->pw_gid; + ur->home = strdup(pw->pw_dir); + ur->name = strdup(pw->pw_name); + } else { + syslog(LOG_ERR, "failed to lookup user record for uid: %d", uid); + } + +done: + return ur; +} + +static void free_user_record(service_user_record_t * ur) +{ + if (ur != NULL) { + if (ur->home) { + free(ur->home); + } + if (ur->name) { + free(ur->name); + } + free(ur); + } +} + +static const char * get_host_uuid() +{ + static uuid_string_t hostuuid = {}; + static dispatch_once_t onceToken; + dispatch_once(&onceToken, ^{ + struct timespec timeout = {30, 0}; + uuid_t uuid = {}; + if (gethostuuid(uuid, &timeout) == 0) { + uuid_unparse(uuid, hostuuid); + } else { + syslog(LOG_ERR, "failed to get host uuid"); + } + }); + + return hostuuid; +} + +static char * +_kb_copy_bag_filename(service_user_record_t * ur, kb_bag_type_t type) +{ + char * bag_file = NULL; + const char * name = NULL; + + require(ur, done); + switch(type) { + case kb_bag_type_user: + name = kb_user_bag; + break; + case kb_bag_type_stash: + name = kb_stash_bag; + break; + default: + goto done; + } + + bag_file = calloc(1u, PATH_MAX); + require(bag_file, done); + + snprintf(bag_file, PATH_MAX, "%s/%s/%s/%s", ur->home, kb_home_path, get_host_uuid(), name); + +done: + return bag_file; +} + +static bool +_kb_verify_create_path(service_user_record_t * ur) +{ + bool created = false; + struct stat st_info = {}; + char new_path[PATH_MAX] = {}; + char kb_path[PATH_MAX] = {}; + snprintf(kb_path, sizeof(kb_path), "%s/%s/%s", ur->home, kb_home_path, get_host_uuid()); + if (lstat(kb_path, &st_info) == 0) { + if (S_ISDIR(st_info.st_mode)) { + created = true; + } else { + syslog(LOG_ERR, "invalid directory at '%s' moving aside", kb_path); + snprintf(new_path, sizeof(new_path), "%s-invalid", kb_path); + unlink(new_path); + if (rename(kb_path, new_path) != 0) { + syslog(LOG_ERR, "failed to rename file: %s (%s)", kb_path, strerror(errno)); + goto done; + } + } + } + if (!created) { + require_action(mkpath_np(kb_path, 0700) == 0, done, syslog(LOG_ERR, "could not create path: %s (%s)", kb_path, strerror(errno))); + created = true; + } + +done: + return created; +} + +static void +_set_thread_credentials(service_user_record_t * ur) +{ + int rc = pthread_setugid_np(ur->uid, ur->gid); + if (rc) { syslog(LOG_ERR, "failed to set thread credential: %i (%s)", errno, strerror(errno)); } + + rc = initgroups(ur->name, ur->gid); + if (rc) { syslog(LOG_ERR, "failed to initgroups: %i", rc); } +} + +static void +_clear_thread_credentials() +{ + int rc = pthread_setugid_np(KAUTH_UID_NONE, KAUTH_GID_NONE); + if (rc) { syslog(LOG_ERR, "failed to reset thread credential: %i (%s)", errno, strerror(errno)); } +} + +static bool +_kb_bag_exists(service_user_record_t * ur, const char * bag_file) +{ + bool exists = false; + struct stat st_info = {}; + char new_file[PATH_MAX] = {}; + + require(ur, done); + + _set_thread_credentials(ur); + if (lstat(bag_file, &st_info) == 0) { + if (S_ISREG(st_info.st_mode)) { + exists = true; + } else { + syslog(LOG_ERR, "invalid file at '%s' moving aside", bag_file); + snprintf(new_file, sizeof(new_file), "%s-invalid", bag_file); + unlink(new_file); + if (rename(bag_file, new_file) != 0) { + syslog(LOG_ERR, "failed to rename file: %s (%s)", bag_file, strerror(errno)); + } + } + } + +done: + _clear_thread_credentials(); + return exists; +} + +static bool +_kb_save_bag_to_disk(service_user_record_t * ur, const char * bag_file, void * data, size_t length) +{ + bool result = false; + int fd = -1; + + require(bag_file, done); + + _set_thread_credentials(ur); + require(_kb_verify_create_path(ur), done); + + fd = open(bag_file, O_CREAT | O_TRUNC | O_WRONLY | O_NOFOLLOW, 0600); + require_action(fd != -1, done, syslog(LOG_ERR, "could not create file: %s (%s)", bag_file, strerror(errno))); + require_action(write(fd, data, length) != -1, done, syslog(LOG_ERR, "failed to write keybag to disk %s", strerror(errno))); + + result = true; + +done: + if (fd != -1) { close(fd); } + _clear_thread_credentials(); + return result; +} + +static bool +_kb_load_bag_from_disk(service_user_record_t * ur, const char * bag_file, uint8_t ** data, size_t * length) +{ + bool result = false; + int fd = -1; + uint8_t * buf = NULL; + size_t buf_size = 0; + struct stat st_info = {}; + + require(bag_file, done); + + _set_thread_credentials(ur); + require(_kb_verify_create_path(ur), done); + require_quiet(lstat(bag_file, &st_info) == 0, done); + require_action(S_ISREG(st_info.st_mode), done, syslog(LOG_ERR, "failed to load, not a file: %s", bag_file)); + buf_size = (size_t)st_info.st_size; + + fd = open(bag_file, O_RDONLY | O_NOFOLLOW); + require_action(fd != -1, done, syslog(LOG_ERR, "could not open file: %s (%s)", bag_file, strerror(errno))); + + buf = (uint8_t *)calloc(1u, buf_size); + require(buf != NULL, done); + require(read(fd, buf, buf_size) == buf_size, done); + + *data = buf; + *length = buf_size; + buf = NULL; + result = true; + +done: + if (fd != -1) { close(fd); } + if (buf) { free(buf); } + _clear_thread_credentials(); + return result; +} + +static void +_kb_rename_bag_on_disk(service_user_record_t * ur, const char * bag_file) +{ + char new_file[PATH_MAX] = {}; + if (bag_file) { + _set_thread_credentials(ur); + snprintf(new_file, sizeof(new_file), "%s-invalid", bag_file); + unlink(new_file); + rename(bag_file, new_file); + _clear_thread_credentials(); + } +} + +static void +_kb_delete_bag_on_disk(service_user_record_t * ur, const char * bag_file) +{ + if (bag_file) { + _set_thread_credentials(ur); + unlink(bag_file); + _clear_thread_credentials(); + } +} + +static void +_kb_migrate_old_bag_if_exists(service_user_record_t * ur) +{ + char session_file[PATH_MAX] = {}; + struct stat st_info = {}; + char * bag_file = _kb_copy_bag_filename(ur, kb_bag_type_user); + + if (bag_file) { + snprintf(session_file, sizeof(session_file), "/var/keybags/%i.kb", ur->uid); + + // if the bag_file does not exist + // check for the session_file and copy it into place + if (!_kb_bag_exists(ur, bag_file)) { + if (lstat(session_file, &st_info) == 0 && (S_ISREG(st_info.st_mode))) { + lchmod("/var/keybags", 0777); + lchmod(session_file, 0666); + _set_thread_credentials(ur); + _kb_verify_create_path(ur); + syslog(LOG_ERR, "migrating %s to %s", session_file, bag_file); + copyfile(session_file, bag_file, NULL, COPYFILE_ALL | COPYFILE_MOVE | COPYFILE_NOFOLLOW | COPYFILE_EXCL); + lchmod(bag_file, 0600); + _clear_thread_credentials(); + } + } + free(bag_file); + } +} + +static int +_kb_get_session_handle(service_context_t * context, keybag_handle_t * handle_out) +{ + int rc = KB_BagNotLoaded; + keybag_handle_t session_handle = bad_keybag_handle; + require_noerr_quiet(aks_get_system(context->s_uid, &session_handle), done); + + *handle_out = session_handle; + rc = KB_Success; + +done: + return rc; +} + +static int +service_kb_create(service_context_t * context, const void * secret, int secret_len) +{ + __block int rc = KB_GeneralError; + + dispatch_sync(_kb_service_get_dispatch_queue(), ^{ + uint8_t * buf = NULL; + size_t buf_size = 0; + keybag_handle_t session_handle = bad_keybag_handle; + service_user_record_t * ur = get_user_record(context->s_uid); + char * bag_file = _kb_copy_bag_filename(ur, kb_bag_type_user); + + require(bag_file, done); + + // check for the existance of the bagfile + require_action(!_kb_bag_exists(ur, bag_file), done, rc = KB_BagExists); + + require_noerr(rc = aks_create_bag(secret, secret_len, kAppleKeyStoreDeviceBag, &session_handle), done); + require_noerr(rc = aks_save_bag(session_handle, (void**)&buf, (int*)&buf_size), done); + require_action(_kb_save_bag_to_disk(ur, bag_file, buf, buf_size), done, rc = KB_BagError); + require_noerr(rc = aks_set_system(session_handle, context->s_uid), done); + aks_unload_bag(session_handle); + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + + if (secret && rc == KB_Success) { + aks_unlock_bag(session_handle, secret, secret_len); + } + + done: + if (buf) free(buf); + if (bag_file) { free(bag_file); } + if (ur) free_user_record(ur); + }); + + return rc; +} + +static int +service_kb_load(service_context_t * context) +{ + __block int rc = KB_GeneralError; + + dispatch_sync(_kb_service_get_dispatch_queue(), ^{ + uint8_t * buf = NULL; + size_t buf_size = 0; + keybag_handle_t session_handle = bad_keybag_handle; + service_user_record_t * ur = NULL; + char * bag_file = NULL; + + rc = aks_get_system(context->s_uid, &session_handle); + if (rc == kIOReturnNotFound) { + require_action(ur = get_user_record(context->s_uid), done, rc = KB_GeneralError); + require_action(bag_file = _kb_copy_bag_filename(ur, kb_bag_type_user), done, rc = KB_GeneralError); + require_action_quiet(_kb_load_bag_from_disk(ur, bag_file, &buf, &buf_size), done, rc = KB_BagNotFound); + rc = aks_load_bag(buf, (int)buf_size, &session_handle); + if (rc == kIOReturnNotPermitted) { + syslog(LOG_ERR, "error loading keybag for uid (%i) in session (%i)", context->s_uid, context->s_id); + _kb_rename_bag_on_disk(ur, bag_file); + rc = KB_BagNotFound; + } + require_noerr(rc, done); + require_noerr(rc = aks_set_system(session_handle, context->s_uid), done); + aks_unload_bag(session_handle); + } + require(rc == KB_Success, done); + + done: + if (buf) free(buf); + if (ur) free_user_record(ur); + if (bag_file) free(bag_file); + }); + + return rc; +} + + +static int +service_kb_unlock(service_context_t * context, const void * secret, int secret_len) +{ + int rc = KB_GeneralError; + keybag_handle_t session_handle; + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + + rc = aks_unlock_bag(session_handle, secret, secret_len); + +done: + return rc; +} + +static int +service_kb_lock(service_context_t * context) +{ + int rc = KB_GeneralError; + keybag_handle_t session_handle; + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + + rc = aks_lock_bag(session_handle); + +done: + return rc; +} + +static int +service_kb_change_secret(service_context_t * context, const void * secret, int secret_len, const void * new_secret, int new_secret_len) +{ + __block int rc = KB_GeneralError; + keybag_handle_t session_handle; + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + + dispatch_sync(_kb_service_get_dispatch_queue(), ^{ + uint8_t * buf = NULL; + size_t buf_size = 0; + service_user_record_t * ur = NULL; + char * bag_file = NULL; + + require_noerr(rc = aks_change_secret(session_handle, secret, secret_len, new_secret, new_secret_len), done); + require_noerr(rc = aks_save_bag(session_handle, (void**)&buf, (int*)&buf_size), done); + require_action(ur = get_user_record(context->s_uid), done, rc = KB_GeneralError); + require_action(bag_file = _kb_copy_bag_filename(ur, kb_bag_type_user), done, rc = KB_GeneralError); + require_action(_kb_save_bag_to_disk(ur, bag_file, buf, buf_size), done, rc = KB_BagError); + + rc = KB_Success; + + done: + if (buf) free(buf); + if (ur) free_user_record(ur); + if (bag_file) free(bag_file); + return; + }); + +done: + return rc; +} + +static int +service_kb_reset(service_context_t * context, const void * secret, int secret_len) +{ + __block int rc = KB_GeneralError; + service_user_record_t * ur = NULL; + char * bag_file = NULL; + + require_action(ur = get_user_record(context->s_uid), done, rc = KB_GeneralError); + require_action(bag_file = _kb_copy_bag_filename(ur, kb_bag_type_user), done, rc = KB_GeneralError); + + dispatch_sync(_kb_service_get_dispatch_queue(), ^{ + uint8_t * buf = NULL; + size_t buf_size = 0; + keybag_handle_t session_handle = bad_keybag_handle; + + syslog(LOG_ERR, "resetting keybag for uid (%i) in session (%i)", context->s_uid, context->s_id); + _kb_rename_bag_on_disk(ur, bag_file); + + require_noerr(rc = aks_create_bag(secret, secret_len, kAppleKeyStoreDeviceBag, &session_handle), done); + require_noerr(rc = aks_save_bag(session_handle, (void**)&buf, (int*)&buf_size), done); + require_action(_kb_save_bag_to_disk(ur, bag_file, buf, buf_size), done, rc = KB_BagError); + require_noerr(rc = aks_set_system(session_handle, context->s_uid), done); + aks_unload_bag(session_handle); + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + + if (secret && rc == KB_Success) { + aks_unlock_bag(session_handle, secret, secret_len); + } + + done: + if (buf) free(buf); + return; + }); + +done: + if (ur) free_user_record(ur); + if (bag_file) free(bag_file); + return rc; +} + +static int +service_kb_is_locked(service_context_t * context, xpc_object_t reply) +{ + int rc = KB_GeneralError; + keybag_state_t state; + keybag_handle_t session_handle; + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + + require_noerr(rc = aks_get_lock_state(session_handle, &state), done); + + xpc_dictionary_set_bool(reply, SERVICE_XPC_LOCKED, state & keybag_state_locked); + xpc_dictionary_set_bool(reply, SERVICE_XPC_NO_PIN, state & keybag_state_no_pin); + +done: + return rc; +} + +static int +service_kb_stash_create(service_context_t * context, const void * key, unsigned key_size) +{ + int rc = KB_GeneralError; + char * bag_file = NULL; + keybag_handle_t session_handle; + service_user_record_t * ur = NULL; + void * stashbag = NULL; + unsigned stashbag_size = 0; + __block bool saved = false; + + require(key, done); + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + require_action(ur = get_user_record(context->s_uid), done, rc = KB_GeneralError); + require_noerr(rc = _aks_stash_create_internal(session_handle, false, key, key_size), done); + require_noerr(rc = _aks_stash_commit_internal((void**)&stashbag, (int*)&stashbag_size), done); + + require_action(bag_file = _kb_copy_bag_filename(ur, kb_bag_type_stash), done, rc = KB_GeneralError); + + // sync writing the bag to disk + dispatch_sync(_kb_service_get_dispatch_queue(), ^{ + saved = _kb_save_bag_to_disk(ur, bag_file, stashbag, stashbag_size); + }); + require_action(saved, done, rc = KB_BagError); + rc = KB_Success; + +done: + if (stashbag) { free(stashbag); } + if (bag_file) { free(bag_file); } + if (ur) free_user_record(ur); + return rc; +} + +static int +service_kb_stash_load(service_context_t * context, const void * key, unsigned key_size) +{ + __block int rc = KB_GeneralError; + char * bag_file = NULL; + keybag_handle_t session_handle; + service_user_record_t * ur = NULL; + __block uint8_t * stashbag = NULL; + __block size_t stashbag_size = 0; + + require(key, done); + require_noerr(rc = _kb_get_session_handle(context, &session_handle), done); + require_action(ur = get_user_record(context->s_uid), done, rc = KB_GeneralError); + require_action(bag_file = _kb_copy_bag_filename(ur, kb_bag_type_stash), done, rc = KB_GeneralError); + + // sync loading the bag from disk + dispatch_sync(_kb_service_get_dispatch_queue(), ^{ + if (!_kb_load_bag_from_disk(ur, bag_file, &stashbag, &stashbag_size)) { + rc = KB_BagError; + } + }); + require_noerr(rc, done); + + require_noerr(rc = _aks_stash_create_internal(session_handle, true, key, key_size), done); + require_noerr(rc = _aks_stash_load_internal(session_handle, false, stashbag, stashbag_size, NULL), done); + rc = KB_Success; + +done: + if (stashbag) { free(stashbag); } + if (bag_file) { + _kb_delete_bag_on_disk(ur, bag_file); + free(bag_file); + } + if (ur) free_user_record(ur); + return rc; +} + +// +// Get the keychain master key from the AppleFDEKeyStore. +// Note that this is a one-time call - the master key is +// removed from the keystore after it is returned. +// Requires the entitlement: com.apple.private.securityd.keychain +// +OSStatus service_stash_get_key(service_context_t * context, xpc_object_t event, xpc_object_t reply) +{ + getStashKey_InStruct_t inStruct; + getStashKey_OutStruct_t outStruct; + size_t outSize = sizeof(outStruct); + kern_return_t kr = KERN_INVALID_ARGUMENT; + + io_connect_t conn = openiodev(); + require(conn, done); + inStruct.type = kAppleFDEKeyStoreStash_master; + + kr = IOConnectCallMethod(conn, kAppleFDEKeyStore_getStashKey, + NULL, 0, + &inStruct, sizeof(inStruct), + NULL, NULL, + &outStruct, &outSize); + + if (kr == KERN_SUCCESS) { + xpc_dictionary_set_data(reply, SERVICE_XPC_KEY, outStruct.outBuf.key.key, outStruct.outBuf.key.keysize); + service_kb_stash_load(context, outStruct.outBuf.key.key, outStruct.outBuf.key.keysize); + } + +done: + if (conn) + closeiodev(conn); + + return kr; +} + +// +// Stash the keychain master key in the AppleFDEKeyStore and +// flag it as the keychain master key to be added to the +// reboot NVRAM blob. +// This requires two calls to the AKS: the first to store the +// key and get its uuid. The second uses the uuid to flag the +// key for blob inclusion. +// +OSStatus service_stash_set_key(service_context_t * context, xpc_object_t event, xpc_object_t reply) +{ + kern_return_t kr = KERN_INVALID_ARGUMENT; + size_t keydata_len = 0; + size_t len; + + io_connect_t conn = openiodev(); + require(conn, done); + + // Store the key in the keystore and get its uuid + setKeyGetUUID_InStruct_t inStruct1; + uuid_OutStruct_t outStruct1; + + + const uint8_t *keydata = xpc_dictionary_get_data(event, SERVICE_XPC_KEY, &keydata_len); + require(keydata, done); + + memcpy(&inStruct1.inKey.key.key, keydata, keydata_len); + inStruct1.inKey.key.keysize = (cryptosize_t) keydata_len; + len = sizeof(outStruct1); + kr = IOConnectCallMethod(conn, kAppleFDEKeyStore_setKeyGetUUID, + NULL, 0, + &inStruct1, sizeof(inStruct1), + NULL, NULL, + &outStruct1, &len); + require(kr == KERN_SUCCESS, done); + + // Now using the uuid stash it as the master key + setStashKey_InStruct_t inStruct2; + memcpy(&inStruct2.uuid, &outStruct1.uuid, sizeof(outStruct1.uuid)); + inStruct2.type = kAppleFDEKeyStoreStash_master; + + kr = IOConnectCallMethod(conn, kAppleFDEKeyStore_setStashKey, + NULL, 0, + &inStruct2, sizeof(inStruct2), + NULL, NULL, + NULL, NULL); + + if (kr == KERN_SUCCESS) { + service_kb_stash_create(context, keydata, (unsigned)keydata_len); + } +done: + if (conn) + closeiodev(conn); + + return kr; +} + +// +// Signal the AppleFDEKeyStore to take the tagged FDE key +// and keychain master key, stash them in an encrypted +// blob structure and write the blob to NVRAM. The random +// encryption key is written to the SMC. +// +#if DEBUG +OSStatus service_stash_blob(xpc_object_t event, xpc_object_t reply) +{ + kern_return_t kr = KERN_INVALID_ARGUMENT; + + io_connect_t conn = openiodev(); + require(conn, done); + + kr = IOConnectCallMethod(conn, kAppleFDEKeyStore_commitStash, + NULL, 0, + NULL, 0, + NULL, NULL, + NULL, NULL); +done: + if (conn) + closeiodev(conn); + + return kr; +} +#endif + +bool peer_has_entitlement(xpc_connection_t peer, const char * entitlement) +{ + bool entitled = false; + + xpc_object_t value = xpc_connection_copy_entitlement_value(peer, entitlement); + if (value && (xpc_get_type(value) == XPC_TYPE_BOOL)) { + entitled = xpc_bool_get_value(value); + } + + if (value) xpc_release(value); + return entitled; +} + +void service_peer_event_handler(xpc_connection_t connection, xpc_object_t event) +{ + xpc_type_t type = xpc_get_type(event); + + if (type == XPC_TYPE_ERROR) { + if (event == XPC_ERROR_CONNECTION_INVALID) { + } + } else { + assert(type == XPC_TYPE_DICTIONARY); + + int rc = KB_GeneralError; + uint64_t request = 0; + const uint8_t * secret = NULL, * new_secret = NULL; + size_t secret_len = 0, new_secret_len = 0, data_len = 0; + service_context_t * context = NULL; + const void * data; + + xpc_object_t reply = xpc_dictionary_create_reply(event); + + data = xpc_dictionary_get_data(event, SERVICE_XPC_CONTEXT, &data_len); + require(data, done); + require(data_len == sizeof(service_context_t), done); + context = (service_context_t*)data; + + request = xpc_dictionary_get_uint64(event, SERVICE_XPC_REQUEST); + + require_action(context->s_id != AU_DEFAUDITSID, done, rc = KB_InvalidSession); + require_action(context->s_uid != AU_DEFAUDITID, done, rc = KB_InvalidSession); // we only want to work in actual user sessions. + + switch (request) { + case SERVICE_KB_CREATE: + // if (kb_service_has_entitlement(peer, "com.apple.keystore.device")) { + secret = xpc_dictionary_get_data(event, SERVICE_XPC_SECRET, &secret_len); + rc = service_kb_create(context, secret, (int)secret_len); + // } + break; + case SERVICE_KB_LOAD: + rc = service_kb_load(context); + break; + case SERVICE_KB_UNLOCK: + secret = xpc_dictionary_get_data(event, SERVICE_XPC_SECRET, &secret_len); + rc = service_kb_unlock(context, secret, (int)secret_len); + break; + case SERVICE_KB_LOCK: + rc = service_kb_lock(context); + break; + case SERVICE_KB_CHANGE_SECRET: + secret = xpc_dictionary_get_data(event, SERVICE_XPC_SECRET, &secret_len); + new_secret = xpc_dictionary_get_data(event, SERVICE_XPC_SECRET_NEW, &new_secret_len); + rc = service_kb_change_secret(context, secret, (int)secret_len, new_secret, (int)new_secret_len); + break; + case SERVICE_KB_RESET: + secret = xpc_dictionary_get_data(event, SERVICE_XPC_SECRET, &secret_len); + rc = service_kb_reset(context, secret, (int)secret_len); + break; + case SERVICE_KB_IS_LOCKED: + rc = service_kb_is_locked(context, reply); + break; + case SERVICE_STASH_GET_KEY: + rc = service_stash_get_key(context, event, reply); + break; + case SERVICE_STASH_SET_KEY: + rc = service_stash_set_key(context, event, reply); + break; +#if DEBUG + case SERVICE_STASH_BLOB: + rc = service_stash_blob(event, reply); + break; +#endif + default: + LOG("unknown service type"); + break; + } + + done: + LOG("selector: %llu, error: %x, secret_len: %zu, new_secret_len: %zu, sid: %d, suid: %d)", request, rc, secret_len, new_secret_len, context ? context->s_id : 0, context ? context->s_uid : 0); + xpc_dictionary_set_int64(reply, SERVICE_XPC_RC, rc); + xpc_connection_send_message(connection, reply); + xpc_release(reply); + } +} + +bool check_signature(xpc_connection_t connection) +{ + CFStringRef reqStr = CFSTR("identifier com.apple.securityd and anchor apple"); + SecRequirementRef requirement = NULL; + SecCodeRef codeRef = NULL; + CFMutableDictionaryRef codeDict = NULL; + CFNumberRef codePid = NULL; + pid_t pid = xpc_connection_get_pid(connection); + + OSStatus status = SecRequirementCreateWithString(reqStr, kSecCSDefaultFlags, &requirement); + require_action(status == errSecSuccess, done, LOG("failed to create requirement")); + + codeDict = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks); + codePid = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &pid); + CFDictionarySetValue(codeDict, kSecGuestAttributePid, codePid); + status = SecCodeCopyGuestWithAttributes(NULL, codeDict, kSecCSDefaultFlags, &codeRef); + require_action(status == errSecSuccess, done, LOG("failed to get code ref")); + + status = SecCodeCheckValidity(codeRef, kSecCSDefaultFlags, +#if DEBUG || RC_BUILDIT_YES + NULL); +#else + requirement); +#endif + require_action(status == errSecSuccess, done, syslog(LOG_ERR, "pid %d, does not satisfy code requirment (%d)", pid, status)); + +done: + if (codeRef) CFRelease(codeRef); + if (requirement) CFRelease(requirement); + if (codeDict) CFRelease(codeDict); + if (codePid) CFRelease(codePid); + + return (status == errSecSuccess); +} + +int main(int argc, const char * argv[]) +{ + char * errorbuf; + if (sandbox_init(SECURITYD_SERVICE_NAME, SANDBOX_NAMED, &errorbuf) != 0) { + syslog(LOG_ERR, "sandbox_init failed %s", errorbuf); + sandbox_free_error(errorbuf); +#ifndef DEBUG + abort(); +#endif + } + + xpc_connection_t listener = xpc_connection_create_mach_service(SECURITYD_SERVICE_NAME, NULL, XPC_CONNECTION_MACH_SERVICE_LISTENER); + xpc_connection_set_event_handler(listener, ^(xpc_object_t peer) { + // It is safe to cast 'peer' to xpc_connection_t assuming + // we have a correct configuration in our launchd.plist. + + if (xpc_connection_get_euid(peer) != 0) { + xpc_connection_cancel(peer); + return; + } + + if (!check_signature(peer)) { + xpc_connection_cancel(peer); + return; + } + + xpc_connection_set_event_handler(peer, ^(xpc_object_t event) { + vproc_transaction_t transaction = vproc_transaction_begin(NULL); + service_peer_event_handler(peer, event); + vproc_transaction_end(NULL, transaction); + }); + xpc_connection_resume(peer); + }); + xpc_connection_resume(listener); + + dispatch_main(); + exit(EXIT_FAILURE); +} + diff --git a/securityd_service/securityd_service/securityd_service.h b/securityd_service/securityd_service/securityd_service.h new file mode 100644 index 0000000..d4a6e72 --- /dev/null +++ b/securityd_service/securityd_service/securityd_service.h @@ -0,0 +1,30 @@ +/* Copyright (c) 2013 Apple Inc. All rights reserved. */ + +#ifndef securityd_service_securityd_service_h +#define securityd_service_securityd_service_h + +#define SECURITYD_SERVICE_NAME "com.apple.securitydservice" + +#define SERVICE_XPC_REQUEST "_request" +#define SERVICE_XPC_RC "_rc" +#define SERVICE_XPC_KEY "_key" +#define SERVICE_XPC_SECRET "_secret" +#define SERVICE_XPC_SECRET_NEW "_secret_new" +#define SERVICE_XPC_CONTEXT "_context" +#define SERVICE_XPC_LOCKED "_locked" +#define SERVICE_XPC_NO_PIN "_no_pin" + +enum { + SERVICE_STASH_SET_KEY = 1, + SERVICE_STASH_GET_KEY, + SERVICE_STASH_BLOB, + SERVICE_KB_LOAD, + SERVICE_KB_UNLOCK, + SERVICE_KB_LOCK, + SERVICE_KB_CHANGE_SECRET, + SERVICE_KB_CREATE, + SERVICE_KB_IS_LOCKED, + SERVICE_KB_RESET +}; + +#endif diff --git a/securityd_service/securityd_service/securityd_service_client.c b/securityd_service/securityd_service/securityd_service_client.c new file mode 100644 index 0000000..b27ba18 --- /dev/null +++ b/securityd_service/securityd_service/securityd_service_client.c @@ -0,0 +1,216 @@ +/* Copyright (c) 2013 Apple Inc. All rights reserved. */ + +#include "securityd_service.h" +#include "securityd_service_client.h" +#include +#include +#include +#include + +static xpc_connection_t +_service_get_connection() +{ + static dispatch_once_t onceToken; + static xpc_connection_t connection = NULL; + + dispatch_once(&onceToken, ^{ + connection = xpc_connection_create_mach_service(SECURITYD_SERVICE_NAME, NULL, XPC_CONNECTION_MACH_SERVICE_PRIVILEGED); + require(connection, done); + + xpc_connection_set_event_handler(connection, ^(xpc_object_t event) { + if (xpc_get_type(event) == XPC_TYPE_ERROR) { + if (event == XPC_ERROR_CONNECTION_INVALID) { + syslog(LOG_ERR, "securityd_service not available"); + } + // XPC_ERROR_CONNECTION_INTERRUPTED + // XPC_ERROR_TERMINATION_IMMINENT + } else { + char * desc = xpc_copy_description(event); + syslog(LOG_ERR, "securityd_service should never get messages on this connection: %s", desc); + free(desc); + } + }); + + xpc_connection_resume(connection); + done: + return; + }); + + return connection; +} + +static int +_service_send_msg(service_context_t *context, xpc_object_t message, xpc_object_t * reply_out) +{ + int rc = KB_GeneralError; + xpc_object_t reply = NULL; + xpc_connection_t conn = NULL; + + require(context, done); + require(message, done); + conn = _service_get_connection(); + require(conn, done); + + xpc_dictionary_set_data(message, SERVICE_XPC_CONTEXT, context, sizeof(service_context_t)); + + reply = xpc_connection_send_message_with_reply_sync(conn, message); + require(reply, done); + require(xpc_get_type(reply) != XPC_TYPE_ERROR, done); + + rc = (int)xpc_dictionary_get_int64(reply, SERVICE_XPC_RC); + + if (reply_out) { + *reply_out = reply; + reply = NULL; + } + +done: + if (reply) xpc_release(reply); + return rc; +} + +int +_service_client_send_secret(service_context_t *context, uint64_t request, const void * secret, int secret_len, const void * new_secret, int new_secret_len) +{ + int rc = KB_GeneralError; + xpc_object_t message = NULL; + + message = xpc_dictionary_create(NULL, NULL, 0); + require_quiet(message, done); + + xpc_dictionary_set_uint64(message, SERVICE_XPC_REQUEST, request); + if (secret) { + xpc_dictionary_set_data(message, SERVICE_XPC_SECRET, secret, secret_len); + } + + if (new_secret) { + xpc_dictionary_set_data(message, SERVICE_XPC_SECRET_NEW, new_secret, new_secret_len); + } + + rc = _service_send_msg(context, message, NULL); + +done: + if (message) xpc_release(message); + return rc; +} + +int +service_client_kb_create(service_context_t *context, const void * secret, int secret_len) +{ + return _service_client_send_secret(context, SERVICE_KB_CREATE, secret, secret_len, NULL, 0); +} + +int +service_client_kb_load(service_context_t *context) +{ + return _service_client_send_secret(context, SERVICE_KB_LOAD, NULL, 0, NULL, 0); + } + +int +service_client_kb_unlock(service_context_t *context, const void * secret, int secret_len) +{ + return _service_client_send_secret(context, SERVICE_KB_UNLOCK, secret, secret_len, NULL, 0); +} + +int +service_client_kb_lock(service_context_t *context) +{ + return _service_client_send_secret(context, SERVICE_KB_LOCK, NULL, 0, NULL, 0); +} + +int +service_client_kb_change_secret(service_context_t *context, const void * secret, int secret_len, const void * new_secret, int new_secret_len) +{ + return _service_client_send_secret(context, SERVICE_KB_CHANGE_SECRET, secret, secret_len, new_secret, new_secret_len); +} + +int +service_client_kb_reset(service_context_t *context, const void * secret, int secret_len) +{ + return _service_client_send_secret(context, SERVICE_KB_RESET, secret, secret_len, NULL, 0); +} + +int service_client_kb_is_locked(service_context_t *context, bool *locked, bool *no_pin) +{ + int rc = KB_GeneralError; + xpc_object_t message = NULL; + xpc_object_t reply = NULL; + + if (locked) *locked = false; + if (no_pin) *no_pin = false; + + message = xpc_dictionary_create(NULL, NULL, 0); + require_quiet(message, done); + + xpc_dictionary_set_uint64(message, SERVICE_XPC_REQUEST, SERVICE_KB_IS_LOCKED); + + rc = _service_send_msg(context, message, &reply); + + if (rc == KB_Success) { + if (locked) { + *locked = xpc_dictionary_get_bool(reply, SERVICE_XPC_LOCKED); + } + if (no_pin) { + *no_pin = xpc_dictionary_get_bool(reply, SERVICE_XPC_NO_PIN); + } + } + +done: + if (message) xpc_release(message); + if (reply) xpc_release(reply); + return rc; +} + +int +service_client_stash_set_key(service_context_t *context, const void * key, int key_len) +{ + int rc = KB_GeneralError; + xpc_object_t message = NULL; + + message = xpc_dictionary_create(NULL, NULL, 0); + require_quiet(message, done); + + xpc_dictionary_set_uint64(message, SERVICE_XPC_REQUEST, SERVICE_STASH_SET_KEY); + + if (key) + xpc_dictionary_set_data(message, SERVICE_XPC_KEY, key, key_len); + + rc = _service_send_msg(context, message, NULL); + +done: + if (message) xpc_release(message); + return rc; +} + +int +service_client_stash_get_key(service_context_t *context, void ** key, int * key_len) +{ + int rc = KB_GeneralError; + xpc_object_t message = NULL; + xpc_object_t reply = NULL; + + require(key, done); + require(key_len, done); + + message = xpc_dictionary_create(NULL, NULL, 0); + require_quiet(message, done); + + xpc_dictionary_set_uint64(message, SERVICE_XPC_REQUEST, SERVICE_STASH_GET_KEY); + + rc = _service_send_msg(context, message, &reply); + + if (rc == KB_Success) { + size_t data_len = 0; + const void * data = xpc_dictionary_get_data(reply, SERVICE_XPC_KEY, &data_len); + if (data) { + *key = calloc(1u, data_len); + memcpy(*key, data, data_len); + *key_len = (int)data_len; + } + } + +done: + if (message) xpc_release(message); + if (reply) xpc_release(reply); + return rc; +} diff --git a/securityd_service/securityd_service/securityd_service_client.h b/securityd_service/securityd_service/securityd_service_client.h new file mode 100644 index 0000000..ca9b0c0 --- /dev/null +++ b/securityd_service/securityd_service/securityd_service_client.h @@ -0,0 +1,45 @@ +/* Copyright (c) 2013 Apple Inc. All rights reserved. */ + +#ifndef __SECURITYD_SERVICE_CLIENT_H +#define __SECURITYD_SERVICE_CLIENT_H + +#if defined(__cplusplus) +extern "C" { +#endif + +#include +#include +#include + +enum { + KB_Success = 0, + KB_GeneralError, + KB_BagNotFound, + KB_BagError, + KB_BagNotLoaded, + KB_BagExists, + KB_InvalidSession +}; + +typedef struct { + au_asid_t s_id; + uid_t s_uid; + audit_token_t procToken; +} service_context_t; + +int service_client_kb_create(service_context_t *context, const void * secret, int secret_len); +int service_client_kb_load(service_context_t *context); +int service_client_kb_unlock(service_context_t *context, const void * secret, int secret_len); +int service_client_kb_lock(service_context_t *context); +int service_client_kb_change_secret(service_context_t *context, const void * secret, int secret_len, const void * new_secret, int new_secret_len); +int service_client_kb_is_locked(service_context_t *context, bool *locked, bool *no_pin); +int service_client_kb_reset(service_context_t *context, const void * secret, int secret_len); + +int service_client_stash_set_key(service_context_t *context, const void * key, int key_len); +int service_client_stash_get_key(service_context_t *context, void ** key, int * key_len); + +#if defined(__cplusplus) +} +#endif + +#endif // __SECURITYD_SERVICE_CLIENT_H diff --git a/securityd_service/securityd_service/service.entitlements b/securityd_service/securityd_service/service.entitlements new file mode 100644 index 0000000..b4ad641 --- /dev/null +++ b/securityd_service/securityd_service/service.entitlements @@ -0,0 +1,14 @@ + + + + + com.apple.keystore.stash.access + + com.apple.keystore.device + + com.apple.private.securityd.keychain + + com.apple.private.securityd.stash + + + diff --git a/securityd_service/securitydservicectrl/main.c b/securityd_service/securitydservicectrl/main.c new file mode 100644 index 0000000..f8c3752 --- /dev/null +++ b/securityd_service/securitydservicectrl/main.c @@ -0,0 +1,114 @@ +// +// main.c +// securitydservicectrl +// +// Created by Wade Benson on 12/2/12. +// Copyright (c) 2012 Apple. All rights reserved. +// + +#include "securityd_service.h" + +#include +#include +#include +#include +#include +#include + +static inline char * +hextostr(const uint8_t *buf, size_t len, char *hexbuf) +{ + char *s = hexbuf; + size_t i; + static const char hexdigits[] = "0123456789abcdef"; + for (i = 0; i < len; i++) { + *s++ = hexdigits[buf[i]>>4]; + *s++ = hexdigits[buf[i]&0xf]; + } + *s = '\0'; + return hexbuf; +} + +int main(int argc, const char * argv[]) +{ + uint64_t action = 0; + OSStatus status = noErr; + uint8_t testkey[128] = "\xde\xad\xbe\xef\xde\xad\xbe\xef\xde\xad\xbe\xef\xde\xad\xbe\xef"; + xpc_connection_t connection = xpc_connection_create_mach_service(SECURITYD_SERVICE_NAME, NULL, XPC_CONNECTION_MACH_SERVICE_PRIVILEGED); + + xpc_connection_set_event_handler(connection, ^(xpc_object_t event) { + if (xpc_get_type(event) == XPC_TYPE_ERROR) { + printf("XPC error\n"); + } + }); + xpc_connection_resume(connection); + + if (argc != 2) { + printf("Usage: securityservicectrl < get | set | stash | login | loginstash >\n"); + return 1; + } + + if (strcmp(argv[1], "get") == 0) { + action = SERVICE_STASH_GET_KEY; + printf("Get key\n"); + + } else if (strcmp(argv[1], "set") == 0) { + action = SERVICE_STASH_SET_KEY; + printf("Set key\n"); + + } else if (strcmp(argv[1], "stash") == 0) { + action = SERVICE_STASH_BLOB; + printf("Stash\n"); + + } else if (strcmp(argv[1], "login") == 0) { + printf("SecKeychainLogin() null passwd\n"); + status = SecKeychainLogin((uint32) strlen("test"), "test", 0, NULL); + printf("Returned: %i\n", status); + return status ? 1 : 0; + + } else if (strcmp(argv[1], "loginstash") == 0) { + printf("SecKeychainStash()\n"); + status = SecKeychainStash(); + printf("Returned: %i\n", status); + return status ? 1 : 0; + + } else { + printf("%s not known\n", argv[1]); + return 1; + } + + // Send + xpc_object_t message = xpc_dictionary_create(NULL, NULL, 0); + xpc_dictionary_set_uint64(message, SERVICE_XPC_REQUEST, action); + + if (action == SERVICE_STASH_SET_KEY) + xpc_dictionary_set_data(message, SERVICE_XPC_KEY, testkey, 16); + + xpc_object_t reply = xpc_connection_send_message_with_reply_sync(connection, message); + require_action(reply != NULL, done, status = -1); + require_action(xpc_get_type(reply) != XPC_TYPE_ERROR, done, status = -1); + + if (action == SERVICE_STASH_GET_KEY) { + size_t len = 0; + const uint8_t *keydata = xpc_dictionary_get_data(reply, SERVICE_XPC_KEY, &len); + if (keydata) { + char buf[sizeof(testkey) + 1]; + printf("\tkey = %s\n", hextostr(keydata, len > sizeof(testkey) ? sizeof(testkey) : len, buf)); + } + } + + status = (OSStatus)xpc_dictionary_get_int64(reply, SERVICE_XPC_RC); + +done: + if (message) + xpc_release(message); + if (reply) + xpc_release(reply); + if (connection) + xpc_release(connection); + + printf("Returned: %i\n", status); + + return status ? 1 : 0; +} + diff --git a/src/SharedMemoryServer.cpp b/src/SharedMemoryServer.cpp index 2c82c68..699542c 100644 --- a/src/SharedMemoryServer.cpp +++ b/src/SharedMemoryServer.cpp @@ -6,6 +6,7 @@ #include #include #include +#include static const char* kPrefix = "/private/var/db/mds/messages/se_"; diff --git a/src/acl_keychain.cpp b/src/acl_keychain.cpp index e783cfa..72a248f 100644 --- a/src/acl_keychain.cpp +++ b/src/acl_keychain.cpp @@ -90,33 +90,68 @@ bool KeychainPromptAclSubject::validate(const AclValidationContext &context, StLock _(process); Server::active().longTermActivity(); clientCode = process.currentGuest(); - if (clientCode) + if (clientCode) { validation = SecCodeCheckValidity(clientCode, kSecCSDefaultFlags, NULL); - switch (validation) { - case noErr: // client is signed and valid - secdebug("kcacl", "client is valid, proceeding"); + } + + switch (validation) + { + case noErr: // client is signed and valid + { + bool forceAllow = false; + secdebug("kcacl", "client is valid, proceeding"); + CFDictionaryRef codeDictionary = NULL; + if (errSecSuccess == SecCodeCopySigningInformation(clientCode, kSecCSDefaultFlags, &codeDictionary)) { + CFTypeRef entitlementsDictionary = NULL; + entitlementsDictionary = CFDictionaryGetValue(codeDictionary, kSecCodeInfoEntitlementsDict); + if (NULL != entitlementsDictionary) { + if (CFGetTypeID(entitlementsDictionary) == CFDictionaryGetTypeID()) { + CFTypeRef migrationEntitlement = CFDictionaryGetValue((CFDictionaryRef)entitlementsDictionary, CFSTR("com.apple.private.security.allow-migration")); + if (NULL != migrationEntitlement) { + if (CFGetTypeID(migrationEntitlement) == CFBooleanGetTypeID()) { + if (migrationEntitlement == kCFBooleanTrue) { + secdebug("kcacl", "client has migration entitlement, allowing"); + forceAllow = true; + } + } + } + } + } + CFRelease(codeDictionary); + } + if (forceAllow) { + return true; + } + } break; - case errSecCSUnsigned: // client is not signed - if (!(mode & CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED)) { - secdebug("kcacl", "client is unsigned, suppressing prompt"); - return false; + + case errSecCSUnsigned: + { // client is not signed + if (!(mode & CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED)) { + secdebug("kcacl", "client is unsigned, suppressing prompt"); + return false; + } } break; - case errSecCSSignatureFailed: // client signed but signature is broken - case errSecCSGuestInvalid: // client signed but dynamically invalid - case errSecCSStaticCodeNotFound: // client not on disk (or unreadable) - if (!(mode & CSSM_ACL_KEYCHAIN_PROMPT_INVALID)) { - secdebug("kcacl", "client is invalid, suppressing prompt"); - Syslog::info("suppressing keychain prompt for invalidly signed client %s(%d)", + + case errSecCSSignatureFailed: // client signed but signature is broken + case errSecCSGuestInvalid: // client signed but dynamically invalid + case errSecCSStaticCodeNotFound: // client not on disk (or unreadable) + { + if (!(mode & CSSM_ACL_KEYCHAIN_PROMPT_INVALID)) { + secdebug("kcacl", "client is invalid, suppressing prompt"); + Syslog::info("suppressing keychain prompt for invalidly signed client %s(%d)", + process.getPath().c_str(), process.pid()); + return false; + } + Syslog::info("attempting keychain prompt for invalidly signed client %s(%d)", process.getPath().c_str(), process.pid()); - return false; } - Syslog::info("attempting keychain prompt for invalidly signed client %s(%d)", - process.getPath().c_str(), process.pid()); break; - default: // something else went wrong - secdebug("kcacl", "client validation failed rc=%d, suppressing prompt", int32_t(validation)); - return false; + + default: // something else went wrong + secdebug("kcacl", "client validation failed rc=%d, suppressing prompt", int32_t(validation)); + return false; } } diff --git a/src/acls.cpp b/src/acls.cpp index 6d885bb..2c2cb5b 100644 --- a/src/acls.cpp +++ b/src/acls.cpp @@ -37,6 +37,8 @@ #include #include +#include +#include // // SecurityServerAcl is virtual @@ -87,18 +89,6 @@ void SecurityServerAcl::changeOwner(const AclOwnerPrototype &newOwner, void SecurityServerAcl::validate(AclAuthorization auth, const AccessCredentials *cred, Database *db) { SecurityServerEnvironment env(*this, db); - - { - // Migrator gets a free ride - Process &thisProcess = Server::process(); - StLock _(thisProcess); - SecCodeRef clientRef = thisProcess.currentGuest(); - if (clientRef) { - std::string clientPath = codePath(clientRef); - if (clientPath == std::string("/usr/libexec/KeychainMigrator")) - return; - } - } StLock objectSequence(aclSequence); StLock processSequence(Server::process().aclSequence); diff --git a/src/agentquery.cpp b/src/agentquery.cpp index b2e25ab..c3df404 100644 --- a/src/agentquery.cpp +++ b/src/agentquery.cpp @@ -31,12 +31,51 @@ #include #include #include +#include #include #include #include // AUE_ssauthint #include #include #include +#include +#include +#include "securityd_service/securityd_service/securityd_service_client.h" + +#define SECURITYAGENT_BOOTSTRAP_NAME_BASE "com.apple.security.agentMain" +#define SECURITYAGENT_STUB_BOOTSTRAP_NAME_BASE "com.apple.security.agentStub" +#define AUTHORIZATIONHOST_BOOTSTRAP_NAME_BASE "com.apple.security.authhost" + +#define AUTH_XPC_ITEM_NAME "_item_name" +#define AUTH_XPC_ITEM_FLAGS "_item_flags" +#define AUTH_XPC_ITEM_VALUE "_item_value" +#define AUTH_XPC_ITEM_TYPE "_item_type" + +#define AUTH_XPC_REQUEST_METHOD_KEY "_agent_request_key" +#define AUTH_XPC_REQUEST_METHOD_CREATE "_agent_request_create" +#define AUTH_XPC_REQUEST_METHOD_INVOKE "_agent_request_invoke" +#define AUTH_XPC_REQUEST_METHOD_DEACTIVATE "_agent_request_deactivate" +#define AUTH_XPC_REQUEST_METHOD_DESTROY "_agent_request_destroy" +#define AUTH_XPC_REPLY_METHOD_KEY "_agent_reply_key" +#define AUTH_XPC_REPLY_METHOD_RESULT "_agent_reply_result" +#define AUTH_XPC_REPLY_METHOD_INTERRUPT "_agent_reply_interrupt" +#define AUTH_XPC_REPLY_METHOD_CREATE "_agent_reply_create" +#define AUTH_XPC_REPLY_METHOD_DEACTIVATE "_agent_reply_deactivate" +#define AUTH_XPC_PLUGIN_NAME "_agent_plugin" +#define AUTH_XPC_MECHANISM_NAME "_agent_mechanism" +#define AUTH_XPC_HINTS_NAME "_agent_hints" +#define AUTH_XPC_CONTEXT_NAME "_agent_context" +#define AUTH_XPC_IMMUTABLE_HINTS_NAME "_agent_immutable_hints" +#define AUTH_XPC_REQUEST_INSTANCE "_agent_instance" +#define AUTH_XPC_REPLY_RESULT_VALUE "_agent_reply_result_value" +#define AUTH_XPC_AUDIT_SESSION_PORT "_agent_audit_session_port" +#define AUTH_XPC_BOOTSTRAP_PORT "_agent_bootstrap_port" +#define AUTH_XPC_SESSION_UUID "_agent_session_uuid" +#define AUTH_XPC_SESSION_PREFS "_agent_session_prefs" +#define AUTH_XPC_SESSION_INPUT_METHOD "_agent_session_inputMethod" + +#define UUID_INITIALIZER_FROM_SESSIONID(sessionid) \ +{ 0,0,0,0, 0,0,0,0, 0,0,0,0, (unsigned char)((0xff000000 & (sessionid))>>24), (unsigned char)((0x00ff0000 & (sessionid))>>16), (unsigned char)((0x0000ff00 & (sessionid))>>8), (unsigned char)((0x000000ff & (sessionid))) } // // NOSA support functions. This is a test mode where the SecurityAgent @@ -77,11 +116,11 @@ static void getNoSA(char *buffer, size_t bufferSize, const char *fmt, ...) // SecurityAgentConnection -SecurityAgentConnection::SecurityAgentConnection(const AuthHostType type, Session &session) - : mAuthHostType(type), - mHostInstance(session.authhost(mAuthHostType)), - mConnection(&Server::connection()), - mAuditToken(Server::connection().auditToken()) +SecurityAgentConnection::SecurityAgentConnection(const AuthHostType type, Session &session) +: mAuthHostType(type), +mHostInstance(session.authhost(mAuthHostType)), +mConnection(&Server::connection()), +mAuditToken(Server::connection().auditToken()) { // this may take a while Server::active().longTermActivity(); @@ -94,7 +133,7 @@ SecurityAgentConnection::~SecurityAgentConnection() mConnection->useAgent(NULL); } -void +void SecurityAgentConnection::activate() { secdebug("SecurityAgentConnection", "activate(%p)", this); @@ -107,11 +146,11 @@ SecurityAgentConnection::activate() // send the the userPrefs to SecurityAgent if (mAuthHostType == securityAgent || mAuthHostType == userAuthHost) { CFRef userPrefs(mHostInstance->session().copyUserPrefs()); - if (NULL != userPrefs) + if (0 != userPrefs) { FILE *mbox = NULL; int fd = 0; - mbox = tmpfile(); + mbox = tmpfile(); if (NULL != mbox) { fd = dup(fileno(mbox)); @@ -139,7 +178,7 @@ SecurityAgentConnection::activate() } mConnection->useAgent(this); - try + try { StLock _(*mHostInstance); @@ -154,13 +193,13 @@ SecurityAgentConnection::activate() SecurityAgent::Client::activate(mPort); secdebug("SecurityAgentConnection", "%p activated", this); - } - catch (MacOSError &err) + } + catch (MacOSError &err) { mConnection->useAgent(NULL); // guess not Syslog::error("SecurityAgentConnection: error activating %s instance %p", - mAuthHostType == privilegedAuthHost - ? "authorizationhost" + mAuthHostType == privilegedAuthHost + ? "authorizationhost" : "SecurityAgent", this); throw; } @@ -196,49 +235,145 @@ SecurityAgentConnection::terminate() } -// SecurityAgentTransaction +// SecurityAgentConnection -SecurityAgentTransaction::SecurityAgentTransaction(const AuthHostType type, Session &session, bool startNow) - : SecurityAgentConnection(type, session), - mStarted(false) +SecurityAgentXPCConnection::SecurityAgentXPCConnection(const AuthHostType type, Session &session) +: mAuthHostType(type), +mHostInstance(session.authhost(mAuthHostType)), +mSession(session), +mConnection(&Server::connection()), +mAuditToken(Server::connection().auditToken()) { - secdebug("SecurityAgentTransaction", "New SecurityAgentTransaction(%p)", this); - activate(); // start agent now, or other SAConnections will kill and spawn new agents - if (startNow) - start(); + // this may take a while + Server::active().longTermActivity(); + secdebug("SecurityAgentConnection", "new SecurityAgentConnection(%p)", this); + mXPCConnection = NULL; + mNobodyUID = -2; + struct passwd *pw = getpwnam("nobody"); + if (NULL != pw) { + mNobodyUID = pw->pw_uid; + } } -SecurityAgentTransaction::~SecurityAgentTransaction() +SecurityAgentXPCConnection::~SecurityAgentXPCConnection() { - try { end(); } catch(...) {} - secdebug("SecurityAgentTransaction", "Destroying %p", this); + secdebug("SecurityAgentConnection", "SecurityAgentConnection(%p) dying", this); + mConnection->useAgent(NULL); + + // If a connection has been established, we need to tear it down. + if (NULL != mXPCConnection) { + // Tearing this down is a multi-step process. First, request a cancellation. + // This is safe even if the connection is already in the cancelled state. + xpc_connection_cancel(mXPCConnection); + + // Then release the XPC connection + xpc_release(mXPCConnection); + mXPCConnection = NULL; + + if (NULL != mXPCStubConnection) { + // We may or may not have one of these + xpc_release(mXPCStubConnection); + mXPCStubConnection = NULL; + } + } } -void -SecurityAgentTransaction::start() +bool SecurityAgentXPCConnection::inDarkWake() { - secdebug("SecurityAgentTransaction", "start(%p)", this); - MacOSError::check(SecurityAgentQuery::Client::startTransaction(mPort)); - mStarted = true; - secdebug("SecurityAgentTransaction", "started(%p)", this); + return mSession.server().inDarkWake(); } -void -SecurityAgentTransaction::end() +void +SecurityAgentXPCConnection::activate(bool ignoreUid) { - if (started()) - { - MacOSError::check(SecurityAgentQuery::Client::endTransaction(mPort)); - mStarted = false; + secdebug("SecurityAgentConnection", "activate(%p)", this); + + mConnection->useAgent(this); + if (mXPCConnection != NULL) { + // If we already have an XPC connection, there's nothing to do. + return; } - secdebug("SecurityAgentTransaction", "End SecurityAgentTransaction(%p)", this); + try + { + if (mAuthHostType == securityAgent) { + uuid_t sessionUUID = UUID_INITIALIZER_FROM_SESSIONID(mSession.sessionId()); + // Yes, these need to be throws, as we're still in securityd, and thus still have to do flow control with exceptions. + if (!(mSession.attributes() & sessionHasGraphicAccess)) + CssmError::throwMe(CSSM_ERRCODE_NO_USER_INTERACTION); + if (inDarkWake()) + CssmError::throwMe(CSSM_ERRCODE_IN_DARK_WAKE); + uid_t targetUid = mHostInstance->session().originatorUid(); + secdebug("SecurityAgentXPCConnection","Retrieved UID %d for this session", targetUid); + if ((int32_t)targetUid != -1) { + mXPCStubConnection = xpc_connection_create_mach_service(SECURITYAGENT_STUB_BOOTSTRAP_NAME_BASE, NULL, 0); + xpc_connection_set_target_uid(mXPCStubConnection, targetUid); + secdebug("SecurityAgentXPCConnection", "Creating a security agent stub"); + xpc_connection_set_event_handler(mXPCStubConnection, ^(xpc_object_t object){}); // Yes, this is a dummy handler, we never ever care about any responses from the stub. It can die in a fire for all I care. + xpc_connection_resume(mXPCStubConnection); + + xpc_object_t wakeupMessage = xpc_dictionary_create(NULL, NULL, 0); + xpc_dictionary_set_data(wakeupMessage, AUTH_XPC_SESSION_UUID, sessionUUID, sizeof(uuid_t)); + xpc_object_t responseMessage = xpc_connection_send_message_with_reply_sync(mXPCStubConnection, wakeupMessage); + if (xpc_get_type(responseMessage) == XPC_TYPE_DICTIONARY) { + secdebug("SecurityAgentXPCConnection", "Valid response received from stub"); + } else { + secdebug("SecurityAgentXPCConnection", "Error response received from stub"); + } + xpc_release(wakeupMessage); + xpc_release(responseMessage); + } + + mXPCConnection = xpc_connection_create_mach_service(SECURITYAGENT_BOOTSTRAP_NAME_BASE, NULL,0); + xpc_connection_set_instance(mXPCConnection, sessionUUID); + secdebug("SecurityAgentXPCConnection", "Creating a security agent"); + } else { + mXPCConnection = xpc_connection_create_mach_service(AUTHORIZATIONHOST_BOOTSTRAP_NAME_BASE, NULL, 0); + secdebug("SecurityAgentXPCConnection", "Creating a standard authhost"); + } + + xpc_connection_set_event_handler(mXPCConnection, ^(xpc_object_t object) { + if (xpc_get_type(object) == XPC_TYPE_ERROR) { + secdebug("SecurityAgentXPCConnection", "error during xpc: %s", xpc_dictionary_get_string(object, XPC_ERROR_KEY_DESCRIPTION)); + } + }); + + xpc_connection_resume(mXPCConnection); + + secdebug("SecurityAgentXPCConnection", "%p activated", this); + } + catch (MacOSError &err) + { + mConnection->useAgent(NULL); // guess not + Syslog::error("SecurityAgentConnection: error activating %s instance %p", + mAuthHostType == privilegedAuthHost + ? "authorizationhost" + : "SecurityAgent", this); + throw; + } + + secdebug("SecurityAgentXPCConnection", "contact didn't throw (%p)", this); } +void +SecurityAgentXPCConnection::reconnect() +{ +} + +void +SecurityAgentXPCConnection::terminate() +{ + activate(false); + + // @@@ This happens already in the destructor; presumably we do this to tear things down orderly + mConnection->useAgent(NULL); +} + + using SecurityAgent::Reason; using namespace Authorization; -SecurityAgentQuery::SecurityAgentQuery(const AuthHostType type, Session &session) - : SecurityAgentConnection(type, session) +SecurityAgentQuery::SecurityAgentQuery(const AuthHostType type, Session &session) +: SecurityAgentConnection(type, session) { secdebug("SecurityAgentQuery", "new SecurityAgentQuery(%p)", this); } @@ -246,16 +381,16 @@ SecurityAgentQuery::SecurityAgentQuery(const AuthHostType type, Session &session SecurityAgentQuery::~SecurityAgentQuery() { secdebug("SecurityAgentQuery", "SecurityAgentQuery(%p) dying", this); - + #if defined(NOSA) if (getenv("NOSA")) { printf(" [query done]\n"); return; } -#endif - +#endif + if (SecurityAgent::Client::state() != SecurityAgent::Client::dead) - destroy(); + destroy(); } void @@ -268,7 +403,7 @@ SecurityAgentQuery::inferHints(Process &thisProcess) guestPath = codePath(clientCode); } AuthItemSet processHints = clientHints(SecurityAgent::bundle, guestPath, - thisProcess.pid(), thisProcess.uid()); + thisProcess.pid(), thisProcess.uid()); mClientHints.insert(processHints.begin(), processHints.end()); } @@ -288,28 +423,28 @@ SecurityAgentQuery::readChoice() AuthItem *allowAction = outContext().find(AGENT_CONTEXT_ALLOW); if (allowAction) { - string allowString; - if (allowAction->getString(allowString) - && (allowString == "YES")) - allow = true; + string allowString; + if (allowAction->getString(allowString) + && (allowString == "YES")) + allow = true; } AuthItem *rememberAction = outContext().find(AGENT_CONTEXT_REMEMBER_ACTION); if (rememberAction) { - string rememberString; - if (rememberAction->getString(rememberString) - && (rememberString == "YES")) - remember = true; + string rememberString; + if (rememberAction->getString(rememberString) + && (rememberString == "YES")) + remember = true; } -} +} void SecurityAgentQuery::disconnect() { SecurityAgent::Client::destroy(); } - + void SecurityAgentQuery::terminate() { @@ -332,6 +467,284 @@ SecurityAgentQuery::create(const char *pluginId, const char *mechanismId, const if (status) MacOSError::throwMe(status); } +ModuleNexus gAllXPCClientsMutex; +ModuleNexus > allXPCClients; + +void +SecurityAgentXPCQuery::killAllXPCClients() +{ + // grab the lock for the client list -- we need to make sure no one modifies the structure while we are iterating it. + StLock _(gAllXPCClientsMutex()); + + set::iterator clientIterator = allXPCClients().begin(); + while (clientIterator != allXPCClients().end()) + { + set::iterator thisClient = clientIterator++; + if ((*thisClient)->getTerminateOnSleep()) + { + (*thisClient)->terminate(); + } + } +} + + +SecurityAgentXPCQuery::SecurityAgentXPCQuery(const AuthHostType type, Session &session) +: SecurityAgentXPCConnection(type, session), mAgentConnected(false), mTerminateOnSleep(false) +{ + secdebug("SecurityAgentXPCQuery", "new SecurityAgentXPCQuery(%p)", this); +} + +SecurityAgentXPCQuery::~SecurityAgentXPCQuery() +{ + secdebug("SecurityAgentXPCQuery", "SecurityAgentXPCQuery(%p) dying", this); + if (mAgentConnected) { + this->disconnect(); + } +} + +void +SecurityAgentXPCQuery::inferHints(Process &thisProcess) +{ + string guestPath; + if (SecCodeRef clientCode = thisProcess.currentGuest()) + guestPath = codePath(clientCode); + + AuthItemSet clientHints; + SecurityAgent::RequestorType type = SecurityAgent::bundle; + pid_t clientPid = thisProcess.pid(); + uid_t clientUid = thisProcess.uid(); + + clientHints.insert(AuthItemRef(AGENT_HINT_CLIENT_TYPE, AuthValueOverlay(sizeof(type), &type))); + clientHints.insert(AuthItemRef(AGENT_HINT_CLIENT_PATH, AuthValueOverlay(guestPath))); + clientHints.insert(AuthItemRef(AGENT_HINT_CLIENT_PID, AuthValueOverlay(sizeof(clientPid), &clientPid))); + clientHints.insert(AuthItemRef(AGENT_HINT_CLIENT_UID, AuthValueOverlay(sizeof(clientUid), &clientUid))); + + + mClientHints.insert(clientHints.begin(), clientHints.end()); + + bool validSignature = thisProcess.checkAppleSigned(); + AuthItemSet clientImmutableHints; + + clientImmutableHints.insert(AuthItemRef(AGENT_HINT_PROCESS_SIGNED, AuthValueOverlay(sizeof(validSignature), &validSignature))); + + mImmutableHints.insert(clientImmutableHints.begin(), clientImmutableHints.end()); +} + +void SecurityAgentXPCQuery::addHint(const char *name, const void *value, UInt32 valueLen, UInt32 flags) +{ + AuthorizationItem item = { name, valueLen, const_cast(value), flags }; + mClientHints.insert(AuthItemRef(item)); +} + + +void +SecurityAgentXPCQuery::readChoice() +{ + allow = false; + remember = false; + + AuthItem *allowAction = mOutContext.find(AGENT_CONTEXT_ALLOW); + if (allowAction) + { + string allowString; + if (allowAction->getString(allowString) + && (allowString == "YES")) + allow = true; + } + + AuthItem *rememberAction = mOutContext.find(AGENT_CONTEXT_REMEMBER_ACTION); + if (rememberAction) + { + string rememberString; + if (rememberAction->getString(rememberString) + && (rememberString == "YES")) + remember = true; + } +} + +void +SecurityAgentXPCQuery::disconnect() +{ + if (NULL != mXPCConnection) { + xpc_object_t requestObject = xpc_dictionary_create(NULL, NULL, 0); + xpc_dictionary_set_string(requestObject, AUTH_XPC_REQUEST_METHOD_KEY, AUTH_XPC_REQUEST_METHOD_DESTROY); + xpc_connection_send_message(mXPCConnection, requestObject); + xpc_release(requestObject); + } + + StLock _(gAllXPCClientsMutex()); + allXPCClients().erase(this); +} + +void +SecurityAgentXPCQuery::terminate() +{ + this->disconnect(); +} + +static void xpcArrayToAuthItemSet(AuthItemSet *setToBuild, xpc_object_t input) { + setToBuild->clear(); + + xpc_array_apply(input, ^bool(size_t index, xpc_object_t item) { + const char *name = xpc_dictionary_get_string(item, AUTH_XPC_ITEM_NAME); + + size_t length; + const void *data = xpc_dictionary_get_data(item, AUTH_XPC_ITEM_VALUE, &length); + void *dataCopy = malloc(length); + memcpy(dataCopy, data, length); + + uint64_t flags = xpc_dictionary_get_uint64(item, AUTH_XPC_ITEM_FLAGS); + AuthItemRef nextItem(name, AuthValueOverlay((uint32_t)length, dataCopy), (uint32_t)flags); + setToBuild->insert(nextItem); + memset(dataCopy, 0, length); // The authorization items contain things like passwords, so wiping clean is important. + free(dataCopy); + return true; + }); +} + +void +SecurityAgentXPCQuery::create(const char *pluginId, const char *mechanismId, const SessionId inSessionId) +{ + bool ignoreUid = false; + + do { + activate(ignoreUid); + + mAgentConnected = false; + + xpc_object_t requestObject = xpc_dictionary_create(NULL, NULL, 0); + xpc_dictionary_set_string(requestObject, AUTH_XPC_REQUEST_METHOD_KEY, AUTH_XPC_REQUEST_METHOD_CREATE); + xpc_dictionary_set_string(requestObject, AUTH_XPC_PLUGIN_NAME, pluginId); + xpc_dictionary_set_string(requestObject, AUTH_XPC_MECHANISM_NAME, mechanismId); + + uid_t targetUid = Server::process().uid(); + bool doSwitchAudit = true; // (ignoreUid) || ((targetUid == 0) || (targetUid == mNobodyUID)); + bool doSwitchBootstrap = true; // (ignoreUid) || ((targetUid == 0) || (targetUid == mNobodyUID)); + + if (doSwitchAudit) { + mach_port_name_t jobPort; + if (0 == audit_session_port(mSession.sessionId(), &jobPort)) { + secdebug("SecurityAgentXPCQuery", "attaching an audit session port because the uid was %d", targetUid); + xpc_dictionary_set_mach_send(requestObject, AUTH_XPC_AUDIT_SESSION_PORT, jobPort); + } + } + + if (doSwitchBootstrap) { + secdebug("SecurityAgentXPCQuery", "attaching a bootstrap port because the uid was %d", targetUid); + MachPlusPlus::Bootstrap processBootstrap = Server::process().taskPort().bootstrap(); + xpc_dictionary_set_mach_send(requestObject, AUTH_XPC_BOOTSTRAP_PORT, processBootstrap); + } + + xpc_object_t object = xpc_connection_send_message_with_reply_sync(mXPCConnection, requestObject); + if (xpc_get_type(object) == XPC_TYPE_DICTIONARY) { + const char *replyType = xpc_dictionary_get_string(object, AUTH_XPC_REPLY_METHOD_KEY); + if (0 == strcmp(replyType, AUTH_XPC_REPLY_METHOD_CREATE)) { + uint64_t status = xpc_dictionary_get_uint64(object, AUTH_XPC_REPLY_RESULT_VALUE); + if (status == kAuthorizationResultAllow) { + mAgentConnected = true; + } else { + secdebug("SecurityAgentXPCQuery", "plugin create failed in SecurityAgent"); + MacOSError::throwMe(errAuthorizationInternal); + } + } + } else if (xpc_get_type(object) == XPC_TYPE_ERROR) { + if (XPC_ERROR_CONNECTION_INVALID == object) { + // If we get an error before getting the create response, try again without the UID + if (ignoreUid) { + secdebug("SecurityAgentXPCQuery", "failed to establish connection, no retries left"); + xpc_release(object); + MacOSError::throwMe(errAuthorizationInternal); + } else { + secdebug("SecurityAgentXPCQuery", "failed to establish connection, retrying with no UID"); + ignoreUid = true; + xpc_release(mXPCConnection); + mXPCConnection = NULL; + } + } else if (XPC_ERROR_CONNECTION_INTERRUPTED == object) { + // If we get an error before getting the create response, try again + } + } + xpc_release(object); + xpc_release(requestObject); + } while (!mAgentConnected); + + StLock _(gAllXPCClientsMutex()); + allXPCClients().insert(this); +} + +static xpc_object_t authItemSetToXPCArray(AuthItemSet input) { + xpc_object_t outputArray = xpc_array_create(NULL, 0); + for (AuthItemSet::iterator i = input.begin(); i != input.end(); i++) { + AuthItemRef item = *i; + + xpc_object_t xpc_data = xpc_dictionary_create(NULL, NULL, 0); + xpc_dictionary_set_string(xpc_data, AUTH_XPC_ITEM_NAME, item->name()); + AuthorizationValue value = item->value(); + if (value.data != NULL) { + xpc_dictionary_set_data(xpc_data, AUTH_XPC_ITEM_VALUE, value.data, value.length); + } + xpc_dictionary_set_uint64(xpc_data, AUTH_XPC_ITEM_FLAGS, item->flags()); + xpc_array_append_value(outputArray, xpc_data); + xpc_release(xpc_data); + } + return outputArray; +} + +OSStatus +SecurityAgentXPCQuery::invoke() { + __block OSStatus status = kAuthorizationResultUndefined; + + xpc_object_t hintsArray = authItemSetToXPCArray(mInHints); + xpc_object_t contextArray = authItemSetToXPCArray(mInContext); + xpc_object_t immutableHintsArray = authItemSetToXPCArray(mImmutableHints); + + xpc_object_t requestObject = xpc_dictionary_create(NULL, NULL, 0); + xpc_dictionary_set_string(requestObject, AUTH_XPC_REQUEST_METHOD_KEY, AUTH_XPC_REQUEST_METHOD_INVOKE); + xpc_dictionary_set_value(requestObject, AUTH_XPC_HINTS_NAME, hintsArray); + xpc_dictionary_set_value(requestObject, AUTH_XPC_CONTEXT_NAME, contextArray); + xpc_dictionary_set_value(requestObject, AUTH_XPC_IMMUTABLE_HINTS_NAME, immutableHintsArray); + + xpc_object_t object = xpc_connection_send_message_with_reply_sync(mXPCConnection, requestObject); + if (xpc_get_type(object) == XPC_TYPE_DICTIONARY) { + const char *replyType = xpc_dictionary_get_string(object, AUTH_XPC_REPLY_METHOD_KEY); + if (0 == strcmp(replyType, AUTH_XPC_REPLY_METHOD_RESULT)) { + xpc_object_t xpcHints = xpc_dictionary_get_value(object, AUTH_XPC_HINTS_NAME); + xpc_object_t xpcContext = xpc_dictionary_get_value(object, AUTH_XPC_CONTEXT_NAME); + AuthItemSet tempHints, tempContext; + xpcArrayToAuthItemSet(&tempHints, xpcHints); + xpcArrayToAuthItemSet(&tempContext, xpcContext); + mOutHints = tempHints; + mOutContext = tempContext; + mLastResult = xpc_dictionary_get_uint64(object, AUTH_XPC_REPLY_RESULT_VALUE); + } + } else if (xpc_get_type(object) == XPC_TYPE_ERROR) { + if (XPC_ERROR_CONNECTION_INVALID == object) { + // If the connection drops, return an "auth undefined" result, because we cannot continue + } else if (XPC_ERROR_CONNECTION_INTERRUPTED == object) { + // If the agent dies, return an "auth undefined" result, because we cannot continue + } + } + xpc_release(object); + + xpc_release(hintsArray); + xpc_release(contextArray); + xpc_release(immutableHintsArray); + xpc_release(requestObject); + + return status; +} + +void SecurityAgentXPCQuery::checkResult() +{ + // now check the OSStatus return from the server side + switch (mLastResult) { + case kAuthorizationResultAllow: return; + case kAuthorizationResultDeny: + case kAuthorizationResultUserCanceled: CssmError::throwMe(CSSM_ERRCODE_USER_CANCELED); + default: MacOSError::throwMe(errAuthorizationInternal); + } +} + // // Perform the "rogue app" access query dialog // @@ -387,11 +800,10 @@ Reason QueryKeychainUse::queryUser (const char *database, const char *descriptio // item name into hints - hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_ITEM_NAME, AuthValueOverlay(description ? strlen(description) : 0, const_cast(description)))); + hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_ITEM_NAME, AuthValueOverlay(description ? (uint32_t)strlen(description) : 0, const_cast(description)))); // keychain name into hints - hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay(database ? strlen(database) : 0, const_cast(database)))); - + hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay(database ? (uint32_t)strlen(database) : 0, const_cast(database)))); if (mPassphraseCheck) { @@ -423,13 +835,13 @@ Reason QueryKeychainUse::queryUser (const char *database, const char *descriptio checkResult(); - AuthItem *passwordItem = outContext().find(kAuthorizationEnvironmentPassword); + AuthItem *passwordItem = mOutContext.find(kAuthorizationEnvironmentPassword); if (!passwordItem) continue; passwordItem->getCssmData(data); } - while (reason = (const_cast(mPassphraseCheck)->decode(data) ? SecurityAgent::noReason : SecurityAgent::invalidPassphrase)); + while ((reason = (const_cast(mPassphraseCheck)->decode(data) ? SecurityAgent::noReason : SecurityAgent::invalidPassphrase))); } else { @@ -473,8 +885,8 @@ bool QueryCodeCheck::operator () (const char *aclPath) // prepopulate with client hints hints.insert(mClientHints.begin(), mClientHints.end()); - hints.insert(AuthItemRef(AGENT_HINT_APPLICATION_PATH, AuthValueOverlay(strlen(aclPath), const_cast(aclPath)))); - + hints.insert(AuthItemRef(AGENT_HINT_APPLICATION_PATH, AuthValueOverlay((uint32_t)strlen(aclPath), const_cast(aclPath)))); + create("builtin", "code-identity", noSecuritySession); setInput(hints, context); @@ -484,7 +896,7 @@ bool QueryCodeCheck::operator () (const char *aclPath) // MacOSError::check(status); - return kAuthorizationResultAllow == result(); + return kAuthorizationResultAllow == mLastResult; } @@ -515,10 +927,10 @@ Reason QueryOld::query() // prepopulate with client hints const char *keychainPath = database.dbName(); - hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay(strlen(keychainPath), const_cast(keychainPath)))); + hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay((uint32_t)strlen(keychainPath), const_cast(keychainPath)))); hints.insert(mClientHints.begin(), mClientHints.end()); - + create("builtin", "unlock-keychain", noSecuritySession); do @@ -546,14 +958,14 @@ Reason QueryOld::query() checkResult(); - AuthItem *passwordItem = outContext().find(kAuthorizationEnvironmentPassword); + AuthItem *passwordItem = mOutContext.find(kAuthorizationEnvironmentPassword); if (!passwordItem) continue; passwordItem->getCssmData(passphrase); } - while (reason = accept(passphrase)); + while ((reason = accept(passphrase))); return SecurityAgent::noReason; } @@ -579,6 +991,155 @@ Reason QueryUnlock::accept(CssmManagedData &passphrase) return SecurityAgent::invalidPassphrase; } +Reason QueryUnlock::retrievePassword(CssmOwnedData &passphrase) { + CssmAutoData pass(Allocator::standard(Allocator::sensitive)); + + AuthItem *passwordItem = mOutContext.find(kAuthorizationEnvironmentPassword); + if (!passwordItem) + return SecurityAgent::invalidPassphrase; + + passwordItem->getCssmData(pass); + + passphrase = pass; + + return SecurityAgent::noReason; +} + +QueryKeybagPassphrase::QueryKeybagPassphrase(Session & session, int32_t tries) : mSession(session), mContext(), mRetries(tries) +{ + setTerminateOnSleep(true); + mContext = mSession.get_current_service_context(); +} + +Reason QueryKeybagPassphrase::query() +{ + Reason reason = SecurityAgent::noReason; + OSStatus status; + AuthValueVector arguments; + AuthItemSet hints, context; + CssmAutoData passphrase(Allocator::standard(Allocator::sensitive)); + int retryCount = 0; + + // prepopulate with client hints + + const char *keychainPath = "iCloud"; + hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay((uint32_t)strlen(keychainPath), const_cast(keychainPath)))); + + hints.insert(mClientHints.begin(), mClientHints.end()); + + create("builtin", "unlock-keychain", noSecuritySession); + + do + { + if (retryCount > mRetries) + { + return SecurityAgent::tooManyTries; + } + + AuthItemRef triesHint(AGENT_HINT_TRIES, AuthValueOverlay(sizeof(retryCount), &retryCount)); + hints.erase(triesHint); hints.insert(triesHint); // replace + + AuthItemRef retryHint(AGENT_HINT_RETRY_REASON, AuthValueOverlay(sizeof(reason), &reason)); + hints.erase(retryHint); hints.insert(retryHint); // replace + + setInput(hints, context); + status = invoke(); + + checkResult(); + + AuthItem *passwordItem = mOutContext.find(kAuthorizationEnvironmentPassword); + if (!passwordItem) + continue; + + passwordItem->getCssmData(passphrase); + + ++retryCount; + } + while ((reason = accept(passphrase))); + + return SecurityAgent::noReason; +} + +Reason QueryKeybagPassphrase::accept(Security::CssmManagedData & password) +{ + if (service_client_kb_unlock(&mContext, password.data(), (int)password.length()) == 0) { + mSession.keybagSetState(session_keybag_unlocked); + return SecurityAgent::noReason; + } else + return SecurityAgent::invalidPassphrase; +} + +QueryKeybagNewPassphrase::QueryKeybagNewPassphrase(Session & session) : QueryKeybagPassphrase(session) {} + +Reason QueryKeybagNewPassphrase::query(CssmOwnedData &oldPassphrase, CssmOwnedData &passphrase) +{ + CssmAutoData pass(Allocator::standard(Allocator::sensitive)); + CssmAutoData oldPass(Allocator::standard(Allocator::sensitive)); + Reason reason = SecurityAgent::noReason; + OSStatus status; + AuthValueVector arguments; + AuthItemSet hints, context; + int retryCount = 0; + + // prepopulate with client hints + + const char *keychainPath = "iCloud"; + hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay((uint32_t)strlen(keychainPath), const_cast(keychainPath)))); + + const char *showResetString = "YES"; + hints.insert(AuthItemRef(AGENT_HINT_SHOW_RESET, AuthValueOverlay((uint32_t)strlen(showResetString), const_cast(showResetString)))); + + hints.insert(mClientHints.begin(), mClientHints.end()); + + create("builtin", "change-passphrase", noSecuritySession); + + AuthItem *resetPassword = NULL; + do + { + if (retryCount > mRetries) + { + return SecurityAgent::tooManyTries; + } + + AuthItemRef triesHint(AGENT_HINT_TRIES, AuthValueOverlay(sizeof(retryCount), &retryCount)); + hints.erase(triesHint); hints.insert(triesHint); // replace + + AuthItemRef retryHint(AGENT_HINT_RETRY_REASON, AuthValueOverlay(sizeof(reason), &reason)); + hints.erase(retryHint); hints.insert(retryHint); // replace + + setInput(hints, context); + status = invoke(); + + checkResult(); + + resetPassword = mOutContext.find(AGENT_CONTEXT_RESET_PASSWORD); + if (resetPassword != NULL) { + return SecurityAgent::resettingPassword; + } + + AuthItem *oldPasswordItem = mOutContext.find(AGENT_PASSWORD); + if (!oldPasswordItem) + continue; + + oldPasswordItem->getCssmData(oldPass); + + ++retryCount; + } + while ((reason = accept(oldPass))); + + if (reason == SecurityAgent::noReason) { + AuthItem *passwordItem = mOutContext.find(AGENT_CONTEXT_NEW_PASSWORD); + if (!passwordItem) + return SecurityAgent::invalidPassphrase; + + passwordItem->getCssmData(pass); + + oldPassphrase = oldPass; + passphrase = pass; + } + + return SecurityAgent::noReason; +} QueryPIN::QueryPIN(Database &db) : QueryOld(db), mPin(Allocator::standard()) @@ -627,7 +1188,7 @@ Reason QueryNewPassphrase::query() // keychain name into hints hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay(database.dbName()))); - + switch (initialReason) { case SecurityAgent::newDatabase: @@ -665,21 +1226,21 @@ Reason QueryNewPassphrase::query() if (SecurityAgent::changePassphrase == initialReason) { - AuthItem *oldPasswordItem = outContext().find(AGENT_PASSWORD); + AuthItem *oldPasswordItem = mOutContext.find(AGENT_PASSWORD); if (!oldPasswordItem) continue; oldPasswordItem->getCssmData(oldPassphrase); } - AuthItem *passwordItem = outContext().find(AGENT_CONTEXT_NEW_PASSWORD); + AuthItem *passwordItem = mOutContext.find(AGENT_CONTEXT_NEW_PASSWORD); if (!passwordItem) continue; passwordItem->getCssmData(passphrase); } - while (reason = accept(passphrase, (initialReason == SecurityAgent::changePassphrase) ? &oldPassphrase.get() : NULL)); + while ((reason = accept(passphrase, (initialReason == SecurityAgent::changePassphrase) ? &oldPassphrase.get() : NULL))); return SecurityAgent::noReason; } @@ -688,11 +1249,12 @@ Reason QueryNewPassphrase::query() // // Get new passphrase Query // -Reason QueryNewPassphrase::operator () (CssmOwnedData &passphrase) +Reason QueryNewPassphrase::operator () (CssmOwnedData &oldPassphrase, CssmOwnedData &passphrase) { if (Reason result = query()) return result; // failed passphrase = mPassphrase; + oldPassphrase = mOldPassphrase; return SecurityAgent::noReason; // success } @@ -708,6 +1270,7 @@ Reason QueryNewPassphrase::accept(CssmManagedData &passphrase, CssmData *oldPass // sanity check the new passphrase (but allow user override) if (!(mPassphraseValid && passphrase.get() == mPassphrase)) { mPassphrase = passphrase; + if (oldPassphrase) mOldPassphrase = *oldPassphrase; mPassphraseValid = true; if (mPassphrase.length() == 0) return SecurityAgent::passphraseIsNull; @@ -763,7 +1326,7 @@ Reason QueryGenericPassphrase::query(const CssmData *prompt, bool verify, setInput(hints, context); status = invoke(); checkResult(); - passwordItem = outContext().find(AGENT_PASSWORD); + passwordItem = mOutContext.find(AGENT_PASSWORD); } while (!passwordItem); @@ -797,7 +1360,6 @@ Reason QueryDBBlobSecret::query(DbHandle *dbHandleArray, uint8 dbHandleArrayCoun #endif hints.insert(mClientHints.begin(), mClientHints.end()); - create("builtin", "generic-unlock-kcblob", noSecuritySession); AuthItem *secretItem; @@ -819,12 +1381,12 @@ Reason QueryDBBlobSecret::query(DbHandle *dbHandleArray, uint8 dbHandleArrayCoun setInput(hints, context); status = invoke(); checkResult(); - secretItem = outContext().find(AGENT_PASSWORD); + secretItem = mOutContext.find(AGENT_PASSWORD); if (!secretItem) continue; secretItem->getCssmData(passphrase); - } while (reason = accept(passphrase, dbHandleArray, dbHandleArrayCount, dbHandleAuthenticated)); + } while ((reason = accept(passphrase, dbHandleArray, dbHandleArrayCount, dbHandleAuthenticated))); return reason; } @@ -873,10 +1435,8 @@ void QueryInvokeMechanism::run(const AuthValueVector &inArguments, AuthItemSet & // prepopulate with client hints inHints.insert(mClientHints.begin(), mClientHints.end()); - if (mAuthHostType == securityAgent) { - if (Server::active().inDarkWake()) - CssmError::throwMe(CSSM_ERRCODE_IN_DARK_WAKE); - } + if (Server::active().inDarkWake()) + CssmError::throwMe(CSSM_ERRCODE_IN_DARK_WAKE); setArguments(inArguments); setInput(inHints, inContext); @@ -938,13 +1498,13 @@ QueryKeychainAuth::operator () (const char *database, const char *description, A // put action/operation (sint32) into hints hints.insert(AuthItemRef(AGENT_HINT_ACL_TAG, AuthValueOverlay(sizeof(action), static_cast(&action)))); - hints.insert(AuthItemRef(AGENT_HINT_CUSTOM_PROMPT, AuthValueOverlay(prompt ? strlen(prompt) : 0, const_cast(prompt)))); + hints.insert(AuthItemRef(AGENT_HINT_CUSTOM_PROMPT, AuthValueOverlay(prompt ? (uint32_t)strlen(prompt) : 0, const_cast(prompt)))); // item name into hints - hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_ITEM_NAME, AuthValueOverlay(description ? strlen(description) : 0, const_cast(description)))); + hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_ITEM_NAME, AuthValueOverlay(description ? (uint32_t)strlen(description) : 0, const_cast(description)))); // keychain name into hints - hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay(database ? strlen(database) : 0, const_cast(database)))); + hints.insert(AuthItemRef(AGENT_HINT_KEYCHAIN_PATH, AuthValueOverlay(database ? (uint32_t)strlen(database) : 0, const_cast(database)))); create("builtin", "confirm-access-user-password", noSecuritySession); @@ -981,13 +1541,13 @@ QueryKeychainAuth::operator () (const char *database, const char *description, A logger.logFailure(); throw; } - usernameItem = outContext().find(AGENT_USERNAME); - passwordItem = outContext().find(AGENT_PASSWORD); + usernameItem = mOutContext.find(AGENT_USERNAME); + passwordItem = mOutContext.find(AGENT_PASSWORD); if (!usernameItem || !passwordItem) continue; usernameItem->getString(username); passwordItem->getString(password); - } while (reason = accept(username, password)); + } while ((reason = accept(username, password))); if (SecurityAgent::noReason == reason) logger.logSuccess(); diff --git a/src/agentquery.h b/src/agentquery.h index 1e28e19..fa59da2 100644 --- a/src/agentquery.h +++ b/src/agentquery.h @@ -37,6 +37,7 @@ #include "authhost.h" #include "server.h" #include "session.h" +#include using Authorization::AuthItemSet; using Authorization::AuthValueVector; @@ -46,7 +47,7 @@ using Security::OSXCode; // base for classes talking to SecurityAgent and authorizationhost // class SecurityAgentConnection : public SecurityAgent::Client, - public SecurityAgentConnectionInterface +public SecurityAgentConnectionInterface { public: SecurityAgentConnection(const AuthHostType type = securityAgent, Session &session = Server::session()); @@ -67,25 +68,32 @@ protected: }; // -// Special wrapper around SecurityAgent::Client transaction interfaces. -// Not currently used because this was intended to support -// SecurityAgent's/authorizationhost's use of Foundation's enable/disable-sudden- -// termination APIs, but the latter don't work for non-direct children of -// launchd. Kept around because securityd might need its own child-transaction -// semantics one day. +// base for classes talking to com.apple.security.agent and com.apple.security.authhost // -class SecurityAgentTransaction : public SecurityAgentConnection +class SecurityAgentXPCConnection : public SecurityAgentConnectionInterface { -public: - SecurityAgentTransaction(const AuthHostType type = securityAgent, Session &session = Server::session(), bool startNow = true); - ~SecurityAgentTransaction(); +public: + SecurityAgentXPCConnection(const AuthHostType type = securityAgent, Session &session = Server::session()); + virtual ~SecurityAgentXPCConnection(); + virtual void activate(bool ignoreUid); + virtual void reconnect(); + virtual void disconnect() { }; + virtual void terminate(); - void start(); - void end(); - bool started() { return mStarted; } + AuthHostType hostType() { return mAuthHostType; } -private: - bool mStarted; +protected: + AuthHostType mAuthHostType; + RefPointer mHostInstance; + Session &mSession; + xpc_connection_t mXPCConnection; + xpc_connection_t mXPCStubConnection; + const RefPointer mConnection; + audit_token_t *mAuditToken; + uid_t mNobodyUID; + + bool inDarkWake(); + }; // @@ -98,29 +106,73 @@ public: SecurityAgentQuery(const AuthHostType type = securityAgent, Session &session = Server::session()); - + void inferHints(Process &thisProcess); void addHint(const char *name, const void *value = NULL, UInt32 valueLen = 0, UInt32 flags = 0); - + virtual ~SecurityAgentQuery(); + + virtual void disconnect(); + virtual void terminate(); + void create(const char *pluginId, const char *mechanismId, const SessionId inSessionId); + + void readChoice(); + + bool allow; + bool remember; + +protected: + AuthItemSet mClientHints; +}; +// +// The main com.apple.security.agent/com.apple.security.authhost interaction base class +// +class SecurityAgentXPCQuery : public SecurityAgentXPCConnection +{ +public: + static void killAllXPCClients(); + + typedef SecurityAgent::Reason Reason; + + SecurityAgentXPCQuery(const AuthHostType type = securityAgent, Session &session = Server::session()); + + + void inferHints(Process &thisProcess); + void addHint(const char *name, const void *value = NULL, UInt32 valueLen = 0, UInt32 flags = 0); + + virtual ~SecurityAgentXPCQuery(); + virtual void disconnect(); virtual void terminate(); void create(const char *pluginId, const char *mechanismId, const SessionId inSessionId); + OSStatus invoke(); + void setTerminateOnSleep(bool terminateOnSleep) {mTerminateOnSleep = terminateOnSleep;} + bool getTerminateOnSleep() {return mTerminateOnSleep;} + void setInput(const AuthItemSet& inHints, const AuthItemSet& inContext) { mInHints = inHints; mInContext = inContext; } + void checkResult(); void readChoice(); - + bool allow; bool remember; - + protected: AuthItemSet mClientHints; + AuthItemSet mImmutableHints; + AuthItemSet mInHints; + AuthItemSet mInContext; + AuthItemSet mOutHints; + AuthItemSet mOutContext; + bool mAgentConnected; + uint64_t mLastResult; + bool mTerminateOnSleep; }; // // Specialized for "rogue app" alert queries // -class QueryKeychainUse : public SecurityAgentQuery { +class QueryKeychainUse : public SecurityAgentXPCQuery { public: QueryKeychainUse(bool needPass, const Database *db); Reason queryUser (const char* database, const char *description, AclAuthorization action); @@ -133,7 +185,7 @@ private: // // Specialized for code signature adjustment queries // -class QueryCodeCheck : public SecurityAgentQuery { +class QueryCodeCheck : public SecurityAgentXPCQuery { public: bool operator () (const char *aclPath); }; @@ -142,7 +194,7 @@ public: // // A query for an existing passphrase // -class QueryOld : public SecurityAgentQuery { +class QueryOld : public SecurityAgentXPCQuery { static const int maxTries = kMaximumAuthorizationTries; public: QueryOld(Database &db) : database(db) {setTerminateOnSleep(true);} @@ -160,12 +212,32 @@ protected: class QueryUnlock : public QueryOld { public: QueryUnlock(KeychainDatabase &db) : QueryOld(db) { } + Reason retrievePassword(CssmOwnedData &passphrase); protected: Reason accept(CssmManagedData &passphrase); }; +class QueryKeybagPassphrase : public SecurityAgentXPCQuery { +public: + QueryKeybagPassphrase(Session &session, int32_t retries = kMaximumAuthorizationTries); + + Reason query(); + Reason accept(CssmManagedData &passphrase); +protected: + Session &mSession; + service_context_t mContext; + int32_t mRetries; +}; + +class QueryKeybagNewPassphrase : public QueryKeybagPassphrase { +public: + QueryKeybagNewPassphrase(Session &session); + + Reason query(CssmOwnedData &oldPassphrase, CssmOwnedData &passphrase); +}; + // // Repurpose QueryUnlock for PIN prompting // Not very clean - but this stuff is an outdated hack as it is... @@ -187,17 +259,18 @@ private: // // A query for a new passphrase // -class QueryNewPassphrase : public SecurityAgentQuery { +class QueryNewPassphrase : public SecurityAgentXPCQuery { static const int maxTries = kMaximumAuthorizationTries; public: QueryNewPassphrase(Database &db, Reason reason) : database(db), initialReason(reason), mPassphrase(Allocator::standard(Allocator::sensitive)), + mOldPassphrase(Allocator::standard(Allocator::sensitive)), mPassphraseValid(false) { } Database &database; - Reason operator () (CssmOwnedData &passphrase); + Reason operator () (CssmOwnedData &oldPassphrase, CssmOwnedData &passphrase); protected: Reason query(); @@ -206,6 +279,7 @@ protected: private: Reason initialReason; CssmAutoData mPassphrase; + CssmAutoData mOldPassphrase; bool mPassphraseValid; }; @@ -213,7 +287,7 @@ private: // // Generic passphrase query (not associated with a database) // -class QueryGenericPassphrase : public SecurityAgentQuery { +class QueryGenericPassphrase : public SecurityAgentXPCQuery { public: QueryGenericPassphrase() { } Reason operator () (const CssmData *prompt, bool verify, @@ -227,7 +301,7 @@ protected: // // Generic secret query (not associated with a database) // -class QueryDBBlobSecret : public SecurityAgentQuery { +class QueryDBBlobSecret : public SecurityAgentXPCQuery { static const int maxTries = kMaximumAuthorizationTries; public: QueryDBBlobSecret() { } @@ -255,7 +329,7 @@ public: // securityd's use; keep the Frankenstein references to yourself // (the alternative is to ask the user to unlock the system keychain, // and you don't want that, do you?) -class QueryKeychainAuth : public SecurityAgentQuery { +class QueryKeychainAuth : public SecurityAgentXPCQuery { static const int maxTries = kMaximumAuthorizationTries; public: QueryKeychainAuth() { } diff --git a/src/clientid.cpp b/src/clientid.cpp index 7dc6907..24cfe98 100644 --- a/src/clientid.cpp +++ b/src/clientid.cpp @@ -155,6 +155,30 @@ const CssmData ClientIdentification::getHash() const return CssmData(); } +const bool ClientIdentification::checkAppleSigned() const +{ + if (GuestState *guest = current()) { + if (!guest->checkedSignature) { + // This is the clownfish supported way to check for a Mac App Store or B&I signed build + CFStringRef requirementString = CFSTR("(anchor apple) or (anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9])"); + SecRequirementRef secRequirementRef = NULL; + OSStatus status = SecRequirementCreateWithString(requirementString, kSecCSDefaultFlags, &secRequirementRef); + if (status == errSecSuccess) { + OSStatus status = SecCodeCheckValidity(guest->code, kSecCSDefaultFlags, secRequirementRef); + if (status != errSecSuccess) { + secdebug("SecurityAgentXPCQuery", "code requirement check failed (%d)", (int32_t)status); + } else { + guest->appleSigned = true; + } + guest->checkedSignature = true; + } + CFRelease(secRequirementRef); + } + return guest->appleSigned; + } else + return false; +} + // // Bonus function: get the path out of a SecCodeRef diff --git a/src/clientid.h b/src/clientid.h index c961284..8f4aab2 100644 --- a/src/clientid.h +++ b/src/clientid.h @@ -47,6 +47,7 @@ public: // CodeSignatures::Identity personality string getPath() const; const CssmData getHash() const; + const bool checkAppleSigned() const; protected: void setup(pid_t pid); @@ -64,6 +65,8 @@ private: CFRef code; mutable bool gotHash; mutable SHA1::Digest legacyHash; + mutable bool checkedSignature; + mutable bool appleSigned; }; typedef std::map GuestMap; mutable GuestMap mGuests; diff --git a/src/entropy.cpp b/src/entropy.cpp index 83d7d20..c936d8f 100644 --- a/src/entropy.cpp +++ b/src/entropy.cpp @@ -153,21 +153,23 @@ void EntropyManager::collectEntropy() int result; - size_t size = sizeof(mach_timespec_t) * timingsToCollect; - double bytesRemaining = kBytesOfEntropyToCollect; int loopCount = 0; while (bytesRemaining >= 0) { + size_t size = sizeof(mach_timespec_t) * timingsToCollect; + result = sysctl(mib,4, buffer, &size, NULL, 0); if (result == -1) { Syslog::alert("entropy measurement returned no entropy (errno=%d)", errno); + sleep(1); } else if (size == 0) { Syslog::alert("entropy measurement returned no entropy."); + sleep(1); } // remove the non-entropic pieces from the buffer diff --git a/src/kcdatabase.cpp b/src/kcdatabase.cpp index aff328d..68271fa 100644 --- a/src/kcdatabase.cpp +++ b/src/kcdatabase.cpp @@ -54,15 +54,62 @@ #include #include #include +#include "securityd_service/securityd_service/securityd_service_client.h" +#include +#include void unflattenKey(const CssmData &flatKey, CssmKey &rawKey); //>> make static method on KeychainDatabase +static int +unlock_keybag(KeychainDbCommon & dbCommon, const void * secret, int secret_len) +{ + int rc = -1; + + if (!dbCommon.isLoginKeychain()) return 0; + + service_context_t context = dbCommon.session().get_current_service_context(); + + // try to unlock first if not found then load/create or unlock + // loading should happen when the kb common object is created + // if it doesn't exist yet then the unlock will fail and we'll create everything + rc = service_client_kb_unlock(&context, secret, secret_len); + if (rc == KB_BagNotLoaded) { + if (service_client_kb_load(&context) == KB_BagNotFound) { + rc = service_client_kb_create(&context, secret, secret_len); + } else { + rc = service_client_kb_unlock(&context, secret, secret_len); + } + } + + if (rc == 0) { + dbCommon.session().keybagSetState(session_keybag_unlocked|session_keybag_loaded); + } + + return rc; +} + +static void +change_secret_on_keybag(KeychainDbCommon & dbCommon, const void * secret, int secret_len, const void * new_secret, int new_secret_len) +{ + if (!dbCommon.isLoginKeychain()) return; + + service_context_t context = dbCommon.session().get_current_service_context(); + + // if a login.keychain doesn't exist yet it comes into securityd as a create then change_secret + // we need to create the keybag in this case if it doesn't exist + if (service_client_kb_change_secret(&context, secret, secret_len, new_secret, new_secret_len) == KB_BagNotLoaded) { + if (service_client_kb_load(&context) == KB_BagNotFound) { + service_client_kb_create(&context, new_secret, new_secret_len); + } + } +} + // // Create a Database object from initial parameters (create operation) // KeychainDatabase::KeychainDatabase(const DLDbIdentifier &id, const DBParameters ¶ms, Process &proc, const AccessCredentials *cred, const AclEntryPrototype *owner) - : LocalDatabase(proc), mValidData(false), version(0), mBlob(NULL) + : LocalDatabase(proc), mValidData(false), mSecret(Allocator::standard(Allocator::sensitive)), mSaveSecret(false), version(0), mBlob(NULL) { // save a copy of the credentials for later access control mCred = DataWalkers::copy(cred, Allocator::standard()); @@ -111,7 +158,7 @@ KeychainDatabase::KeychainDatabase(const DLDbIdentifier &id, const DBParameters // KeychainDatabase::KeychainDatabase(const DLDbIdentifier &id, const DbBlob *blob, Process &proc, const AccessCredentials *cred) - : LocalDatabase(proc), mValidData(false), version(0) + : LocalDatabase(proc), mValidData(false), mSecret(Allocator::standard(Allocator::sensitive)), mSaveSecret(false), version(0), mBlob(NULL) { validateBlob(blob); @@ -150,7 +197,7 @@ KeychainDatabase::KeychainDatabase(const DLDbIdentifier &id, const DbBlob *blob, // the re-encoding can declare it done. // KeychainDatabase::KeychainDatabase(KeychainDatabase &src, Process &proc, DbHandle dbToClone) - : LocalDatabase(proc), mValidData(false), version(0), mBlob(NULL) + : LocalDatabase(proc), mValidData(false), mSecret(Allocator::standard(Allocator::sensitive)), mSaveSecret(false), version(0), mBlob(NULL) { mCred = DataWalkers::copy(src.mCred, Allocator::standard()); @@ -339,10 +386,13 @@ void KeychainDatabase::changePassphrase(const AccessCredentials *cred) // establish OLD secret - i.e. unlock the database //@@@ do we want to leave the final lock state alone? + if (common().isLoginKeychain()) mSaveSecret = true; makeUnlocked(cred); // establish NEW secret establishNewSecrets(cred, SecurityAgent::changePassphrase); + if (mSecret) { mSecret.reset(); } + mSaveSecret = false; common().invalidateBlob(); // blob state changed secdebug("KCdb", "Database %s(%p) master secret changed", common().dbName(), this); encode(); // force rebuild of local blob @@ -367,8 +417,8 @@ void KeychainDatabase::commitSecretsForSync(KeychainDatabase &cloneDb) CssmError::throwMe(CSSM_ERRCODE_INVALID_DB_HANDLE); // in case we autolocked since starting the sync - unlockDb(); - cloneDb.unlockDb(); + makeUnlocked(); // call this because we already own the lock + cloneDb.unlockDb(); // we may not own the lock here, so calling unlockDb will lock the cloneDb's common lock // Decode all keys whose handles refer to this on-disk keychain so that // if the holding client commits the key back to disk, it's encoded with @@ -451,7 +501,18 @@ void KeychainDatabase::makeUnlocked(const AccessCredentials *cred) assert(mBlob || (mValidData && common().hasMaster())); establishOldSecrets(cred); common().setUnlocked(); // mark unlocked - } + } else if (common().isLoginKeychain()) { + bool locked = false; + service_context_t context = common().session().get_current_service_context(); + if ((service_client_kb_is_locked(&context, &locked, NULL) == 0) && locked) { + StSyncLock uisync(common().uiLock(), common()); + QueryKeybagPassphrase keybagQuery(common().session(), 3); + keybagQuery.inferHints(Server::process()); + if (keybagQuery.query() != SecurityAgent::noReason) { + syslog(LOG_NOTICE, "failed to unlock iCloud keychain"); + } + } + } if (!mValidData) { // need to decode to get our ACLs, master secret available secdebug("KCdb", "%p(%p) is unlocked; decoding for makeUnlocked()", this, &common()); if (!decode()) @@ -461,6 +522,78 @@ void KeychainDatabase::makeUnlocked(const AccessCredentials *cred) assert(mValidData); } +// +// Invoke the securityd_service to retrieve the keychain master +// key from the AppleFDEKeyStore. +// +void KeychainDatabase::stashDbCheck() +{ + CssmAutoData data(Allocator::standard(Allocator::sensitive)); + + // Fetch the key + int rc = 0; + void * stash_key = NULL; + int stash_key_len = 0; + service_context_t context = common().session().get_current_service_context(); + rc = service_client_stash_get_key(&context, &stash_key, &stash_key_len); + if (rc == 0) { + if (stash_key) { + data.copy(CssmData((void *)stash_key,stash_key_len)); + memset(stash_key, 0, stash_key_len); + free(stash_key); + } + } else { + CssmError::throwMe(rc); + } + + { + StLock _(common()); + + // Now establish it as the keychain master key + CssmClient::Key key(Server::csp(), data.get()); + CssmKey::Header &hdr = key.header(); + hdr.keyClass(CSSM_KEYCLASS_SESSION_KEY); + hdr.algorithm(CSSM_ALGID_3DES_3KEY_EDE); + hdr.usage(CSSM_KEYUSE_ANY); + hdr.blobType(CSSM_KEYBLOB_RAW); + hdr.blobFormat(CSSM_KEYBLOB_RAW_FORMAT_OCTET_STRING); + common().setup(mBlob, key); + + if (!decode()) + CssmError::throwMe(CSSM_ERRCODE_OPERATION_AUTH_DENIED); + } + + // when upgrading from pre-10.9 create a keybag if it doesn't exist with the master secret + // only do this after we have verified the master key unlocks the login.keychain + if (service_client_kb_load(&context) == KB_BagNotFound) { + service_client_kb_create(&context, data.data(), (int)data.length()); + } +} + +// +// Get the keychain master key and invoke the securityd_service +// to stash it in the AppleFDEKeyStore ready for commit to the +// NVRAM blob. +// +void KeychainDatabase::stashDb() +{ + CssmAutoData data(Allocator::standard(Allocator::sensitive)); + + { + StLock _(common()); + + if (!common().isValid()) { + CssmError::throwMe(CSSMERR_CSP_INVALID_KEY); + } + + CssmKey key = common().masterKey(); + data.copy(key.keyData()); + } + + service_context_t context = common().session().get_current_service_context(); + int rc = service_client_stash_set_key(&context, data.data(), (int)data.length()); + if (rc != 0) CssmError::throwMe(rc); +} // // The following unlock given an explicit passphrase, rather than using @@ -483,6 +616,15 @@ void KeychainDatabase::makeUnlocked(const CssmData &passphrase) if (!decode()) CssmError::throwMe(CSSM_ERRCODE_OPERATION_AUTH_DENIED); } + + if (common().isLoginKeychain()) { + bool locked = false; + service_context_t context = common().session().get_current_service_context(); + if ((service_client_kb_is_locked(&context, &locked, NULL) == 0) && locked) { + unlock_keybag(common(), passphrase.data(), (int)passphrase.length()); + } + } + assert(!isLocked()); assert(mValidData); } @@ -497,7 +639,33 @@ bool KeychainDatabase::decode(const CssmData &passphrase) { assert(mBlob); common().setup(mBlob, passphrase); - return decode(); + bool success = decode(); + if (success) { + if (common().isLoginKeychain() && (unlock_keybag(common(), passphrase.data(), (int)passphrase.length()) != 0)) { + service_context_t context = common().session().get_current_service_context(); + // check to see if it was locked with the master key if so change the secret to the passphrase + if (!common().session().keybagGetState(session_keybag_check_master_key)) { + + CssmAutoData key(Allocator::standard(Allocator::sensitive)); + key = common().masterKey()->keyData(); + if (service_client_kb_unlock(&context, key.data(), (int)key.length()) == 0) { + service_client_kb_change_secret(&context, key.data(), (int)key.length(), passphrase.data(), (int)passphrase.length()); + } + common().session().keybagSetState(session_keybag_check_master_key); + } + + bool no_pin = false; + if (service_client_kb_is_locked(&context, NULL, &no_pin) == 0) { + if ((passphrase.length() > 0) && no_pin) { + syslog(LOG_ERR, "Updating passphrase for your iCloud keychain"); + service_client_kb_change_secret(&context, NULL, 0, passphrase.data(), (int)passphrase.length()); + } else { + syslog(LOG_ERR, "The passphrase for your login.keychain and your iCloud keychain are out of sync"); + } + } + } + } + return success; } @@ -623,18 +791,43 @@ void KeychainDatabase::establishOldSecrets(const AccessCredentials *creds) bool KeychainDatabase::interactiveUnlock() { secdebug("KCdb", "%p attempting interactive unlock", this); - QueryUnlock query(*this); + SecurityAgent::Reason reason = SecurityAgent::noReason; + QueryUnlock query(*this); // take UI interlock and release DbCommon lock (to avoid deadlocks) StSyncLock uisync(common().uiLock(), common()); // now that we have the UI lock, interact unless another thread unlocked us first if (isLocked()) { query.inferHints(Server::process()); - return query() == SecurityAgent::noReason; + reason = query(); + if (mSaveSecret && reason == SecurityAgent::noReason) { + query.retrievePassword(mSecret); + } + query.disconnect(); } else { secdebug("KCdb", "%p was unlocked during uiLock delay", this); - return true; } + + if (common().isLoginKeychain()) { + bool locked = false; + service_context_t context = common().session().get_current_service_context(); + if ((service_client_kb_is_locked(&context, &locked, NULL) == 0) && locked) { + QueryKeybagNewPassphrase keybagQuery(common().session()); + keybagQuery.inferHints(Server::process()); + CssmAutoData pass(Allocator::standard(Allocator::sensitive)); + CssmAutoData oldPass(Allocator::standard(Allocator::sensitive)); + SecurityAgent::Reason queryReason = keybagQuery.query(oldPass, pass); + if (queryReason == SecurityAgent::noReason) { + service_client_kb_change_secret(&context, oldPass.data(), (int)oldPass.length(), pass.data(), (int)pass.length()); + } else if (queryReason == SecurityAgent::resettingPassword) { + query.retrievePassword(pass); + service_client_kb_reset(&context, pass.data(), (int)pass.length()); + } + + } + } + + return reason == SecurityAgent::noReason; } @@ -657,19 +850,41 @@ void KeychainDatabase::establishNewSecrets(const AccessCredentials *creds, Secur StSyncLock uisync(common().uiLock(), common()); query.inferHints(Server::process()); CssmAutoData passphrase(Allocator::standard(Allocator::sensitive)); - if (query(passphrase) == SecurityAgent::noReason) { + CssmAutoData oldPassphrase(Allocator::standard(Allocator::sensitive)); + if (query(oldPassphrase, passphrase) == SecurityAgent::noReason) { common().setup(NULL, passphrase); + change_secret_on_keybag(common(), oldPassphrase.data(), (int)oldPassphrase.length(), passphrase.data(), (int)passphrase.length()); return; } } break; // try to use an explicitly given passphrase case CSSM_SAMPLE_TYPE_PASSWORD: - secdebug("KCdb", "%p specified explicit passphrase", this); - if (sample.length() != 2) - CssmError::throwMe(CSSM_ERRCODE_INVALID_SAMPLE_VALUE); - common().setup(NULL, sample[1]); - return; + { + secdebug("KCdb", "%p specified explicit passphrase", this); + if (sample.length() != 2) + CssmError::throwMe(CSSM_ERRCODE_INVALID_SAMPLE_VALUE); + common().setup(NULL, sample[1]); + if (common().isLoginKeychain()) { + CssmAutoData oldPassphrase(Allocator::standard(Allocator::sensitive)); + list oldSamples; + creds->samples().collect(CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK, oldSamples); + for (list::iterator oit = oldSamples.begin(); oit != oldSamples.end(); oit++) { + TypedList &tmpList = *oit; + tmpList.checkProper(); + if (tmpList.type() == CSSM_SAMPLE_TYPE_PASSWORD) { + if (tmpList.length() == 2) { + oldPassphrase = tmpList[1].data(); + } + } + } + if (!oldPassphrase.length() && mSecret && mSecret.length()) { + oldPassphrase = mSecret; + } + change_secret_on_keybag(common(), oldPassphrase.data(), (int)oldPassphrase.length(), sample[1].data().data(), (int)sample[1].data().length()); + } + return; + } // try to open with a given master key case CSSM_WORDID_SYMMETRIC_KEY: case CSSM_SAMPLE_TYPE_ASYMMETRIC_KEY: @@ -698,8 +913,10 @@ void KeychainDatabase::establishNewSecrets(const AccessCredentials *creds, Secur StSyncLock uisync(common().uiLock(), common()); query.inferHints(Server::process()); CssmAutoData passphrase(Allocator::standard(Allocator::sensitive)); - if (query(passphrase) == SecurityAgent::noReason) { + CssmAutoData oldPassphrase(Allocator::standard(Allocator::sensitive)); + if (query(oldPassphrase, passphrase) == SecurityAgent::noReason) { common().setup(NULL, passphrase); + change_secret_on_keybag(common(), oldPassphrase.data(), (int)oldPassphrase.length(), passphrase.data(), (int)passphrase.length()); return; } } @@ -874,7 +1091,7 @@ KeyBlob *KeychainDatabase::encodeKey(const CssmKey &key, const CssmData &pubAcl, } StLock _(common()); if(!inTheClear) - unlockDb(); + makeUnlocked(); // tell the cryptocore to form the key blob return common().encodeKeyCore(key, pubAcl, privAcl, inTheClear); @@ -890,7 +1107,7 @@ void KeychainDatabase::decodeKey(KeyBlob *blob, CssmKey &key, void * &pubAcl, vo StLock _(common()); if(!blob->isClearText()) - unlockDb(); // we need our keys + makeUnlocked(); // we need our keys common().decodeKeyCore(blob, key, pubAcl, privAcl); // memory protocol: pubAcl points into blob; privAcl was allocated @@ -1043,23 +1260,36 @@ void KeychainDatabase::dumpNode() // KeychainDbCommon::KeychainDbCommon(Session &ssn, const DbIdentifier &id) : LocalDbCommon(ssn), sequence(0), version(1), mIdentifier(id), - mIsLocked(true), mValidParams(false) + mIsLocked(true), mValidParams(false), mLoginKeychain(false) { // match existing DbGlobal or create a new one - Server &server = Server::active(); - StLock _(server); - if (KeychainDbGlobal *dbglobal = - server.findFirst(&KeychainDbGlobal::identifier, identifier())) { - parent(*dbglobal); - secdebug("KCdb", "%p linking to existing DbGlobal %p", this, dbglobal); - } else { - // DbGlobal not present; make a new one - parent(*new KeychainDbGlobal(identifier())); - secdebug("KCdb", "%p linking to new DbGlobal %p", this, &global()); - } - - // link lifetime to the Session - session().addReference(*this); + { + Server &server = Server::active(); + StLock _(server); + if (KeychainDbGlobal *dbglobal = + server.findFirst(&KeychainDbGlobal::identifier, identifier())) { + parent(*dbglobal); + secdebug("KCdb", "%p linking to existing DbGlobal %p", this, dbglobal); + } else { + // DbGlobal not present; make a new one + parent(*new KeychainDbGlobal(identifier())); + secdebug("KCdb", "%p linking to new DbGlobal %p", this, &global()); + } + + // link lifetime to the Session + session().addReference(*this); + + if (strcasestr(id.dbName(), "login.keychain") != NULL) { + mLoginKeychain = true; + } + } + + if (mLoginKeychain && !session().keybagGetState(session_keybag_loaded)) { + service_context_t context = session().get_current_service_context(); + if (service_client_kb_load(&context) == 0) { + session().keybagSetState(session_keybag_loaded); + } + } } KeychainDbCommon::~KeychainDbCommon() @@ -1068,6 +1298,9 @@ KeychainDbCommon::~KeychainDbCommon() // explicitly unschedule ourselves Server::active().clearTimer(this); + if (mLoginKeychain) { + session().keybagClearState(session_keybag_unlocked); + } } KeychainDbGlobal &KeychainDbCommon::global() const @@ -1147,17 +1380,27 @@ void KeychainDbCommon::setUnlocked() void KeychainDbCommon::lockDb() { - StLock _(*this); - if (!isLocked()) { - DatabaseCryptoCore::invalidate(); - notify(kNotificationEventLocked); - SECURITYD_KEYCHAIN_LOCK(this, (char*)this->dbName()); - Server::active().clearTimer(this); - - mIsLocked = true; // mark locked - - // this call may destroy us if we have no databases anymore - session().removeReference(*this); + bool lock = false; + { + StLock _(*this); + if (!isLocked()) { + DatabaseCryptoCore::invalidate(); + notify(kNotificationEventLocked); + SECURITYD_KEYCHAIN_LOCK(this, (char*)this->dbName()); + Server::active().clearTimer(this); + + mIsLocked = true; // mark locked + lock = true; + + // this call may destroy us if we have no databases anymore + session().removeReference(*this); + } + } + + if (mLoginKeychain && lock) { + service_context_t context = session().get_current_service_context(); + service_client_kb_lock(&context); + session().keybagClearState(session_keybag_unlocked); } } diff --git a/src/kcdatabase.h b/src/kcdatabase.h index 27fcfa5..439ffbe 100644 --- a/src/kcdatabase.h +++ b/src/kcdatabase.h @@ -111,6 +111,7 @@ public: const DbIdentifier &identifier() const {return mIdentifier; } const DLDbIdentifier &dlDbIdent() const { return identifier(); } const char *dbName() const { return dlDbIdent().dbName(); } + bool isLoginKeychain() const { return mLoginKeychain; } DbBlob *encode(KeychainDatabase &db); @@ -144,6 +145,7 @@ private: // all following data protected by object lock bool mIsLocked; // logically locked bool mValidParams; // mParams has been set + bool mLoginKeychain; }; @@ -190,6 +192,9 @@ public: void lockDb(); // unconditional lock void unlockDb(); // full-feature unlock void unlockDb(const CssmData &passphrase); // unlock with passphrase + + void stashDbCheck(); // check AppleKeyStore for master key + void stashDb(); // stash master key in AppleKeyStore bool decode(); // unlock given established master key bool decode(const CssmData &passphrase); // set master key from PP, try unlock @@ -245,6 +250,8 @@ protected: private: // all following data is locked by the common lock bool mValidData; // valid ACL and params (blob decoded) + CssmAutoData mSecret; + bool mSaveSecret; uint32 version; // version stamp for blob validity DbBlob *mBlob; // database blob (encoded) diff --git a/src/securityd.d b/src/securityd.d index 1a711ce..32f5d75 100644 --- a/src/securityd.d +++ b/src/securityd.d @@ -15,7 +15,7 @@ typedef const void *DTHandle; typedef uint32_t DTPort; typedef uint32_t DTGuest; - +typedef uint8_t bool; /* * The main static provider for securityd diff --git a/src/session.cpp b/src/session.cpp index 8e4a1a0..b79f683 100644 --- a/src/session.cpp +++ b/src/session.cpp @@ -44,6 +44,7 @@ #include "database.h" #include "server.h" #include +#include using namespace CommonCriteria; @@ -63,7 +64,7 @@ const char Session::kRealname[] = "realname"; // Create a Session object from initial parameters (create) // Session::Session(const AuditInfo &audit, Server &server) - : mAudit(audit), mSecurityAgent(NULL), mAuthHost(NULL) + : mAudit(audit), mSecurityAgent(NULL), mAuthHost(NULL), mKeybagState(0) { // link to Server as the global nexus in the object mesh parent(server); @@ -129,14 +130,32 @@ Session &Session::find(pid_t id, bool create) void Session::destroy(SessionId id) { // remove session from session map - StLock _(mSessionLock); - SessionMap::iterator it = mSessions.find(id); - if (it != mSessions.end()) { - RefPointer session = it->second; - assert(session->sessionId() == id); - mSessions.erase(it); - session->kill(); - } + bool unlocked = false; + RefPointer session = NULL; + { + StLock _(mSessionLock); + SessionMap::iterator it = mSessions.find(id); + if (it != mSessions.end()) { + session = it->second; + assert(session->sessionId() == id); + mSessions.erase(it); + + for (SessionMap::iterator kb_it = mSessions.begin(); kb_it != mSessions.end(); kb_it++) { + RefPointer kb_session = kb_it->second; + if (kb_session->originatorUid() == session->originatorUid()) { + if (kb_session->keybagGetState(session_keybag_unlocked)) unlocked = true; + } + } + } + } + + if (session.get()) { + if (!unlocked) { + service_context_t context = session->get_current_service_context(); + service_client_kb_lock(&context); + } + session->kill(); + } } @@ -173,7 +192,6 @@ void Session::kill() void Session::updateAudit() const { CommonCriteria::AuditInfo info; - StLock _(mSessionLock); try { info.get(mAudit.sessionId()); } catch (...) { @@ -182,6 +200,59 @@ void Session::updateAudit() const mAudit = info; } +void Session::verifyKeyStorePassphrase(int32_t retries) +{ + QueryKeybagPassphrase keybagQuery(*this, retries); + keybagQuery.inferHints(Server::process()); + if (keybagQuery.query() != SecurityAgent::noReason) { + CssmError::throwMe(CSSM_ERRCODE_OPERATION_AUTH_DENIED); + } +} + +void Session::changeKeyStorePassphrase() +{ + service_context_t context = get_current_service_context(); + QueryKeybagNewPassphrase keybagQuery(*this); + keybagQuery.inferHints(Server::process()); + CssmAutoData pass(Allocator::standard(Allocator::sensitive)); + CssmAutoData oldPass(Allocator::standard(Allocator::sensitive)); + SecurityAgent::Reason queryReason = keybagQuery.query(oldPass, pass); + if (queryReason == SecurityAgent::noReason) { + service_client_kb_change_secret(&context, oldPass.data(), (int)oldPass.length(), pass.data(), (int)pass.length()); + } else { + CssmError::throwMe(CSSM_ERRCODE_OPERATION_AUTH_DENIED); + } +} + +void Session::resetKeyStorePassphrase(const CssmData &passphrase) +{ + service_context_t context = get_current_service_context(); + service_client_kb_reset(&context, passphrase.data(), (int)passphrase.length()); +} + +service_context_t Session::get_current_service_context() +{ + // if this gets called from a timer there is no connection() object. + // need to check for valid connection object and pass the audit token along + service_context_t context = { sessionId(), originatorUid(), {} }; //*Server::connection().auditToken() + return context; +} + +void Session::keybagClearState(int state) +{ + mKeybagState &= ~state; +} + +void Session::keybagSetState(int state) +{ + mKeybagState |= state; +} + +bool Session::keybagGetState(int state) +{ + return mKeybagState & state; +} + // // Manage authorization client processes @@ -210,7 +281,7 @@ void Session::invalidateAuthHosts() // void Session::processSystemSleep() { - SecurityAgent::Clients::killAllClients(); + SecurityAgentXPCQuery::killAllXPCClients(); StLock _(mSessionLock); for (SessionMap::const_iterator it = mSessions.begin(); it != mSessions.end(); it++) @@ -420,6 +491,14 @@ void Session::setupAttributes(SessionCreationFlags flags, SessionAttributeBits a MacOSError::throwMe(errSessionAuthorizationDenied); } +uid_t Session::originatorUid() +{ + if (mAudit.uid() == AU_DEFAUDITID) { + StLock _(*this); + updateAudit(); + } + return mAudit.uid(); +} // // Authorization database I/O diff --git a/src/session.h b/src/session.h index cccaf24..958af36 100644 --- a/src/session.h +++ b/src/session.h @@ -40,12 +40,20 @@ #include #include #include +#include "securityd_service/securityd_service/securityd_service_client.h" class Key; class Connection; class Server; class AuthHostInstance; +enum { + session_keybag_locked = 0, + session_keybag_unlocked = 1 << 0, + session_keybag_check_master_key = 1 << 1, + session_keybag_loaded = 1 << 2, +}; + // // A Session object represents one or more Connections that are known to // belong to the same authentication domain. Informally this means just @@ -78,7 +86,7 @@ public: virtual void setupAttributes(SessionCreationFlags flags, SessionAttributeBits attrs); - virtual uid_t originatorUid() const { updateAudit(); return mAudit.uid(); } + virtual uid_t originatorUid(); virtual CFDataRef copyUserPrefs() = 0; @@ -153,6 +161,17 @@ protected: void kill(); +public: + void verifyKeyStorePassphrase(int32_t retries); + void changeKeyStorePassphrase(); + void resetKeyStorePassphrase(const CssmData &passphrase); + service_context_t get_current_service_context(); + void keybagClearState(int state); + void keybagSetState(int state); + bool keybagGetState(int state); +private: + int mKeybagState; + public: static Session &find(SessionId id, bool create); // find and optionally create template static SessionType &find(SecuritySessionId id); diff --git a/src/token.cpp b/src/token.cpp index 1f8f7c0..55198c1 100644 --- a/src/token.cpp +++ b/src/token.cpp @@ -270,12 +270,16 @@ void Token::insert(::Reader &slot, RefPointer tokend) secdebug("token", "%p installing MDS from %s(%s)", this, tokend->bundlePath().c_str(), mdsDirectory[0] ? mdsDirectory : "ALL"); - string holdGuid = mGuid.toString(); // extend lifetime of .toString() + string holdGuid = mGuid.toString(); // extend lifetime of std::string + string holdTokenUid; + if (tokend->hasTokenUid()) + holdTokenUid = tokend->tokenUid(); + string holdPrintName = this->printName(); MDS_InstallDefaults mdsDefaults = { holdGuid.c_str(), mSubservice, - tokend->hasTokenUid() ? tokend->tokenUid().c_str() : "", - this->printName().c_str() + holdTokenUid.c_str(), + holdPrintName.c_str() }; mds().install(&mdsDefaults, tokend->bundlePath().c_str(), diff --git a/src/tokenacl.cpp b/src/tokenacl.cpp index 0fe9955..9d7c1d6 100644 --- a/src/tokenacl.cpp +++ b/src/tokenacl.cpp @@ -183,7 +183,8 @@ void TokenAcl::pinChange(unsigned int pin, CSSM_ACL_HANDLE handle, TokenDatabase QueryNewPin query(pin, handle, database, SecurityAgent::changePassphrase); query.inferHints(Server::process()); CssmAutoData newPin(Allocator::standard(Allocator::sensitive)); - switch (query(newPin)) { + CssmAutoData oldPin(Allocator::standard(Allocator::sensitive)); + switch (query(oldPin, newPin)) { case SecurityAgent::noReason: // worked return; default: diff --git a/src/tokendatabase.cpp b/src/tokendatabase.cpp index db2bd69..fa077dc 100644 --- a/src/tokendatabase.cpp +++ b/src/tokendatabase.cpp @@ -161,7 +161,9 @@ TokenDaemon &TokenDatabase::tokend() const char *TokenDatabase::dbName() const { - return common().dbName().c_str(); + //store dbName to ensure that will live outside function scope + mDbName = common().dbName(); + return mDbName.c_str(); } bool TokenDatabase::transient() const diff --git a/src/tokendatabase.h b/src/tokendatabase.h index 8ffa2fd..2578367 100644 --- a/src/tokendatabase.h +++ b/src/tokendatabase.h @@ -238,6 +238,7 @@ private: private: AccessCredentials *mOpenCreds; // credentials passed during open + mutable std::string mDbName; // stored name for method dbName() which need to call c_str on object outside function scope }; diff --git a/src/transition.cpp b/src/transition.cpp index c0f6902..49e31f0 100644 --- a/src/transition.cpp +++ b/src/transition.cpp @@ -45,7 +45,9 @@ #include #include #include +#include +#include #include #include @@ -650,13 +652,63 @@ kern_return_t ucsp_server_unlockDb(UCSP_ARGS, DbHandle db) END_IPC(DL) } +static void check_stash_entitlement(Process & proc) +{ + OSStatus status = noErr; + CFDictionaryRef code_info = NULL; + CFDictionaryRef entitlements = NULL; + CFTypeRef value = NULL; + bool entitled = false; + + status = SecCodeCopySigningInformation(proc.processCode(), kSecCSRequirementInformation, &code_info); + require_noerr(status, done); + + if (CFDictionaryGetValueIfPresent(code_info, kSecCodeInfoEntitlementsDict, &value)) { + if (CFGetTypeID(value) == CFDictionaryGetTypeID()) { + entitlements = (CFDictionaryRef)value; + } + } + require(entitlements != NULL, done); + + if (CFDictionaryGetValueIfPresent(entitlements, CFSTR("com.apple.private.securityd.stash"), &value)) { + if (CFGetTypeID(value) && CFBooleanGetTypeID()) { + entitled = CFBooleanGetValue((CFBooleanRef)value); + } + } + +done: + if (code_info) { + CFRelease(code_info); + } + + if (!entitled) { + CssmError::throwMe(CSSM_ERRCODE_OS_ACCESS_DENIED); + } +} + kern_return_t ucsp_server_unlockDbWithPassphrase(UCSP_ARGS, DbHandle db, DATA_IN(passphrase)) { BEGIN_IPC(unlockDbWithPassphrase) - Server::keychain(db)->unlockDb(DATA(passphrase)); + Server::keychain(db)->unlockDb(DATA(passphrase)); END_IPC(DL) } +kern_return_t ucsp_server_stashDb(UCSP_ARGS, DbHandle db) +{ + BEGIN_IPC(stashDb) + check_stash_entitlement(connection.process()); + Server::keychain(db)->stashDb(); + END_IPC(DL) +} + +kern_return_t ucsp_server_stashDbCheck(UCSP_ARGS, DbHandle db) +{ + BEGIN_IPC(stashDbCheck) + check_stash_entitlement(connection.process()); + Server::keychain(db)->stashDbCheck(); + END_IPC(DL) +} + kern_return_t ucsp_server_isLocked(UCSP_ARGS, DbHandle db, boolean_t *locked) { BEGIN_IPC(isLocked) @@ -664,6 +716,26 @@ kern_return_t ucsp_server_isLocked(UCSP_ARGS, DbHandle db, boolean_t *locked) END_IPC(DL) } +kern_return_t ucsp_server_verifyKeyStorePassphrase(UCSP_ARGS, uint32_t retries) +{ + BEGIN_IPC(verifyKeyStorePassphrase) + connection.process().session().verifyKeyStorePassphrase(retries); + END_IPC(DL) +} + +kern_return_t ucsp_server_changeKeyStorePassphrase(UCSP_ARGS) +{ + BEGIN_IPC(verifyKeyStorePassphrase) + connection.process().session().changeKeyStorePassphrase(); + END_IPC(DL) +} + +kern_return_t ucsp_server_resetKeyStorePassphrase(UCSP_ARGS, DATA_IN(passphrase)) +{ + BEGIN_IPC(verifyKeyStorePassphrase) + connection.process().session().resetKeyStorePassphrase(DATA(passphrase)); + END_IPC(DL) +} // // Key management