osx - how to mach_inject without sudo -
i've written plugin finder on mac(mountain lion) , works perfectly, have run bundle sudo. make package(packagemaker) run bundle , failed(install correctly , if run clicking desktop icon failed, if run though commandline sudo, works). know how fix issue installing dropbox (and sync icon shows)
the problem you're facing that, internally, mach_inject calls function task_for_pid.
this function returns kernel task id given process pid , due security reasons, apple requires use of function can take place users members of either root or procmod groups. explains why running sudo works you.
if you're developing own use, simplest method add procmod group. however, if want distribute application, you'll need ensure installer installs program run member of root or procmod groups.
one possibility separate application 2 parts, second registered run elevated privileges using smjobbless. if don't program in objective-c, don't worry parts of smjobbless required c function calls; authorizationcopyrights , smjobbless in given example code.
alternatively, if application code-signed, should work too, though it's not i've tried myself. can read here.
as of os x 10.11 (el capitan), task_for_pid
entitled function call, available software specific entitlement in certificate , no longer available 3rd party developers.
this breaks mach_inject, making harder retrieve process's mach task, whilst sip (system integrity projection) enabled.
Comments
Post a Comment