使用 root 权限部署应用程序
我编写了一个 Cocoa 应用程序，它使用 libpcap 来监视网络流量。由于 libpcap 需要 root 权限，我想知道授予它 root 权限的最佳方法是什么（例如使用 Package Maker？）。我是否能够使用拖放安装程序来部署它，或者 Package Maker 是我唯一的选择吗？
此外，我想知道授予我的应用程序根权限所带来的安全风险。该应用程序还写入磁盘（sqlite 数据库），我读到给予应用程序写入磁盘根权限并不是一个好主意。
I have written a Cocoa app which uses libpcap to monitor network traffic. Since libpcap requires root privileges I was wondering what's the best way to give it root privileges (e.g. using Package Maker?). Would I be able to deploy it using a drag-and-drop installer or is Package Maker my only option?
Additionally I would like to know of the security risks posed by giving my app root permissions. The app also writes to disk (sqlite database) and I read that giving an app that writes to disk root privileges is not a good idea.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
推荐的 Apple 方法如下：
为了使上述工作正常进行，特权 exe 必须安装为 root 拥有并设置了 setuid 位。您可以使用软件包制作工具来执行此操作，也可以创建 Apple 术语 自我修复帮助工具。这是一个工具，用于检查它是否以 root 身份运行，如果不是，则通过 AuthorizationExecuteWithPrivileges 来修复其 setuid 位和所有权。然后它对操作进行授权并执行操作。
如果您使用自我修复工具，则可以将其与您的应用程序捆绑在一起，并使用拖放安装过程。
我强烈建议您阅读整个 授权编程指南。它更详细地讨论了所有这些内容，并包含一些示例代码。
The recommended Apple way to do what you want is as follows:
For the above to work, the privileged exe has to be installed as owned by root with the setuid bit set. You can either do this with package maker or you can create what Apple terms a self repairing helper tool. This is a tool that checks if it is running as root and if not calls itself via AuthorizationExecuteWithPrivileges to repair its setuid bit and ownership. Then it does the authorization for the operation and performs the operation.
If you use the self repairing tool, you can bundle it in with your application and use a drag and drop installation process.
I strongly advise you to read the whole of the Authorization Programming Guide. It talks about all this stuff in more detail and includes some example code.