Apple pia inapendekeza njia nyingine ya kuthibitisha ikiwa mchakato unaounganisha una idhini ya kuita njia ya XPC iliyofunuliwa.
Wakati programu inahitaji kutekeleza vitendo kama mtumiaji aliye na mamlaka, badala ya kuendesha programu kama mtumiaji aliye na mamlaka kawaida inaunda kama mtumiaji wa mizizi HelperTool kama huduma ya XPC ambayo inaweza kuitwa na programu kutekeleza vitendo hivyo. Walakini, programu inayoitisha huduma hiyo inapaswa kuwa na idhini ya kutosha.
ShouldAcceptNewConnection daima YES
Mfano unaweza kupatikana katika EvenBetterAuthorizationSample. Katika App/AppDelegate.m inajaribu kuunganisha kwenye HelperTool. Na katika HelperTool/HelperTool.m kazi ya shouldAcceptNewConnectionhaitathibitisha mahitaji yoyote yaliyotajwa hapo awali. Itarudi daima YES:
- (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection
// Called by our XPC listener when a new connection comes in. We configure the connection
// with our protocol and ourselves as the main object.
{
assert(listener == self.listener);
#pragma unused(listener)
assert(newConnection != nil);
newConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(HelperToolProtocol)];
newConnection.exportedObject = self;
[newConnection resume];
return YES;
}
Kwa habari zaidi kuhusu jinsi ya configure hii check ipasavyo:
Hata hivyo, kuna idhini inayoendelea wakati njia kutoka HelperTool inaitwa.
Kazi applicationDidFinishLaunching kutoka App/AppDelegate.m itaunda kumbukumbu ya idhini tupu baada ya programu kuanza. Hii daima inapaswa kufanya kazi.
Kisha, itajaribu kuongeza baadhi ya haki kwenye kumbukumbu hiyo ya idhini kwa kuita setupAuthorizationRights:
- (void)applicationDidFinishLaunching:(NSNotification *)note
{
[...]
err = AuthorizationCreate(NULL, NULL, 0, &self->_authRef);
if (err == errAuthorizationSuccess) {
err = AuthorizationMakeExternalForm(self->_authRef, &extForm);
}
if (err == errAuthorizationSuccess) {
self.authorization = [[NSData alloc] initWithBytes:&extForm length:sizeof(extForm)];
}
assert(err == errAuthorizationSuccess);
// If we successfully connected to Authorization Services, add definitions for our default
// rights (unless they're already in the database).
if (self->_authRef) {
[Common setupAuthorizationRights:self->_authRef];
}
[self.window makeKeyAndOrderFront:self];
}
Funguo setupAuthorizationRights kutoka Common/Common.m itahifadhi katika database ya idhini /var/db/auth.db haki za programu. Tafadhali kumbuka jinsi itakavyoongeza haki ambazo bado hazipo katika database:
+ (void)setupAuthorizationRights:(AuthorizationRef)authRef
// See comment in header.
{
assert(authRef != NULL);
[Common enumerateRightsUsingBlock:^(NSString * authRightName, id authRightDefault, NSString * authRightDesc) {
OSStatus blockErr;
// First get the right. If we get back errAuthorizationDenied that means there's
// no current definition, so we add our default one.
blockErr = AuthorizationRightGet([authRightName UTF8String], NULL);
if (blockErr == errAuthorizationDenied) {
blockErr = AuthorizationRightSet(
authRef, // authRef
[authRightName UTF8String], // rightName
(__bridge CFTypeRef) authRightDefault, // rightDefinition
(__bridge CFStringRef) authRightDesc, // descriptionKey
NULL, // bundle (NULL implies main bundle)
CFSTR("Common") // localeTableName
);
assert(blockErr == errAuthorizationSuccess);
} else {
// A right already exists (err == noErr) or any other error occurs, we
// assume that it has been set up in advance by the system administrator or
// this is the second time we've run. Either way, there's nothing more for
// us to do.
}
}];
}
Funguo enumerateRightsUsingBlock ndiyo hutumika kupata ruhusa za programu, ambazo zimedefiniwa katika commandInfo:
static NSString * kCommandKeyAuthRightName = @"authRightName";
static NSString * kCommandKeyAuthRightDefault = @"authRightDefault";
static NSString * kCommandKeyAuthRightDesc = @"authRightDescription";
+ (NSDictionary *)commandInfo
{
static dispatch_once_t sOnceToken;
static NSDictionary * sCommandInfo;
dispatch_once(&sOnceToken, ^{
sCommandInfo = @{
NSStringFromSelector(@selector(readLicenseKeyAuthorization:withReply:)) : @{
kCommandKeyAuthRightName : @"com.example.apple-samplecode.EBAS.readLicenseKey",
kCommandKeyAuthRightDefault : @kAuthorizationRuleClassAllow,
kCommandKeyAuthRightDesc : NSLocalizedString(
@"EBAS is trying to read its license key.",
@"prompt shown when user is required to authorize to read the license key"
)
},
NSStringFromSelector(@selector(writeLicenseKey:authorization:withReply:)) : @{
kCommandKeyAuthRightName : @"com.example.apple-samplecode.EBAS.writeLicenseKey",
kCommandKeyAuthRightDefault : @kAuthorizationRuleAuthenticateAsAdmin,
kCommandKeyAuthRightDesc : NSLocalizedString(
@"EBAS is trying to write its license key.",
@"prompt shown when user is required to authorize to write the license key"
)
},
NSStringFromSelector(@selector(bindToLowNumberPortAuthorization:withReply:)) : @{
kCommandKeyAuthRightName : @"com.example.apple-samplecode.EBAS.startWebService",
kCommandKeyAuthRightDefault : @kAuthorizationRuleClassAllow,
kCommandKeyAuthRightDesc : NSLocalizedString(
@"EBAS is trying to start its web service.",
@"prompt shown when user is required to authorize to start the web service"
)
}
};
});
return sCommandInfo;
}
+ (NSString *)authorizationRightForCommand:(SEL)command
// See comment in header.
{
return [self commandInfo][NSStringFromSelector(command)][kCommandKeyAuthRightName];
}
+ (void)enumerateRightsUsingBlock:(void (^)(NSString * authRightName, id authRightDefault, NSString * authRightDesc))block
// Calls the supplied block with information about each known authorization right..
{
[self.commandInfo enumerateKeysAndObjectsUsingBlock:^(id key, id obj, BOOL *stop) {
#pragma unused(key)
#pragma unused(stop)
NSDictionary * commandDict;
NSString * authRightName;
id authRightDefault;
NSString * authRightDesc;
// If any of the following asserts fire it's likely that you've got a bug
// in sCommandInfo.
commandDict = (NSDictionary *) obj;
assert([commandDict isKindOfClass:[NSDictionary class]]);
authRightName = [commandDict objectForKey:kCommandKeyAuthRightName];
assert([authRightName isKindOfClass:[NSString class]]);
authRightDefault = [commandDict objectForKey:kCommandKeyAuthRightDefault];
assert(authRightDefault != nil);
authRightDesc = [commandDict objectForKey:kCommandKeyAuthRightDesc];
assert([authRightDesc isKindOfClass:[NSString class]]);
block(authRightName, authRightDefault, authRightDesc);
}];
}
Hii inamaanisha kwamba mwishoni mwa mchakato huu, ruhusa zilizotangazwa ndani ya commandInfo zitahifadhiwa katika /var/db/auth.db. Tafadhali angalia jinsi unavyoweza kupata kwa kila njia itakayohitaji uthibitisho, jina la ruhusa na kCommandKeyAuthRightDefault. Ile ya mwisho inaonyesha ni nani anaweza kupata haki hii.
Kuna mizunguko tofauti ya kuonyesha ni nani anaweza kupata haki. Baadhi yao yamefafanuliwa katika AuthorizationDB.h (unaweza kupata zote hapa), lakini kwa muhtasari:
Jina
Thamani
Maelezo
kAuthorizationRuleClassAllow
ruhusu
Mtu yeyote
kAuthorizationRuleClassDeny
kataa
Hakuna mtu
kAuthorizationRuleIsAdmin
ni-admin
Mtumiaji wa sasa lazima awe msimamizi (ndani ya kikundi cha wasimamizi)
kAuthorizationRuleAuthenticateAsSessionUser
thibitisha-mwenyewe-kama-mtumiaji-wa-kikao
Uliza mtumiaji athibitishe.
kAuthorizationRuleAuthenticateAsAdmin
thibitisha-msimamizi
Uliza mtumiaji athibitishe. Anahitaji kuwa msimamizi (ndani ya kikundi cha wasimamizi)
kAuthorizationRightRule
kanuni
Bayana sheria
kAuthorizationComment
maoni
Bayana maoni ya ziada kuhusu haki
Uhakiki wa Haki
Katika HelperTool/HelperTool.m kazi readLicenseKeyAuthorization inathibitisha ikiwa mpigaji simu ana ruhusa ya kutekeleza njia hiyo kwa kuita kazi checkAuthorization. Kazi hii itachunguza ikiwa authData iliyotumwa na mchakato unayepiga simu ina muundo sahihi na kisha itachunguza nini kinahitajika kupata haki ya kuita njia maalum. Ikiwa mambo yote yanaenda vizuri, kosa lililorejeshwa litakuwa nil:
- (NSError *)checkAuthorization:(NSData *)authData command:(SEL)command
{
[...]
// First check that authData looks reasonable.
error = nil;
if ( (authData == nil) || ([authData length] != sizeof(AuthorizationExternalForm)) ) {
error = [NSError errorWithDomain:NSOSStatusErrorDomain code:paramErr userInfo:nil];
}
// Create an authorization ref from that the external form data contained within.
if (error == nil) {
err = AuthorizationCreateFromExternalForm([authData bytes], &authRef);
// Authorize the right associated with the command.
if (err == errAuthorizationSuccess) {
AuthorizationItem oneRight = { NULL, 0, NULL, 0 };
AuthorizationRights rights = { 1, &oneRight };
oneRight.name = [[Common authorizationRightForCommand:command] UTF8String];
assert(oneRight.name != NULL);
err = AuthorizationCopyRights(
authRef,
&rights,
NULL,
kAuthorizationFlagExtendRights | kAuthorizationFlagInteractionAllowed,
NULL
);
}
if (err != errAuthorizationSuccess) {
error = [NSError errorWithDomain:NSOSStatusErrorDomain code:err userInfo:nil];
}
}
if (authRef != NULL) {
junk = AuthorizationFree(authRef, 0);
assert(junk == errAuthorizationSuccess);
}
return error;
}
Tafadhali elewa kwamba kuangalia mahitaji ya kupata haki ya kuita hiyo njia, kazi authorizationRightForCommand itaangalia tu kitu kilichotangulia kwenye kitu cha maoni commandInfo. Kisha, itaita AuthorizationCopyRights kuangalia ikiwa ina haki ya kuita hiyo njia (tambua kwamba bendera huruhusu mwingiliano na mtumiaji).
Katika kesi hii, ili kuita hiyo njia readLicenseKeyAuthorizationkCommandKeyAuthRightDefault imedhamiriwa kuwa @kAuthorizationRuleClassAllow. Kwa hivyo yeyote anaweza kuita.
Taarifa ya DB
Ilitajwa kwamba taarifa hii imehifadhiwa katika /var/db/auth.db. Unaweza kuorodhesha sheria zote zilizohifadhiwa kwa:
Unaweza kupata mipangilio yote ya ruhusahapa, lakini mchanganyiko ambao hautahitaji ushirikiano wa mtumiaji ni:
'authenticate-user': 'false'
Hii ni funguo moja moja zaidi. Ikiwekwa kama false, inabainisha kwamba mtumiaji hahitaji kutoa uthibitisho kupata haki hii.
Hutumiwa katika mchanganyiko na moja ya 2 hapa chini au kuonyesha kikundi ambacho mtumiaji lazima awe mwanachama.
'allow-root': 'true'
Ikiwa mtumiaji anafanya kazi kama mtumiaji wa mizizi (ambaye ana ruhusa zilizoinuliwa), na funguo hili limewekwa kama true, mtumiaji wa mizizi anaweza kupata haki hii bila uthibitisho zaidi. Walakini, kwa kawaida, kufikia hadhi ya mtumiaji wa mizizi tayari kunahitaji uthibitisho, kwa hivyo hii siyo hali ya "bila uthibitisho" kwa watumiaji wengi.
'session-owner': 'true'
Ikiwekwa kama true, mmiliki wa kikao (mtumiaji aliyeingia kwenye mfumo) atapata haki hii moja kwa moja. Hii inaweza kupuuza uthibitisho wa ziada ikiwa mtumiaji tayari ameingia kwenye mfumo.
'shared': 'true'
Funguo hili halitoi haki bila uthibitisho. Badala yake, ikiwekwa kama true, inamaanisha kwamba mara haki imeidhinishwa, inaweza kugawanywa kati ya michakato mingi bila kila moja kuhitaji uthibitisho tena. Lakini kuidhinishwa kwa awali kwa haki hiyo bado itahitaji uthibitisho isipokuwa ikiunganishwa na funguo zingine kama 'authenticate-user': 'false'.
Ikiwa utapata kazi: [HelperTool checkAuthorization:command:] labda mchakato unatumia mpango uliotajwa awali kwa idhini:
Kwa hivyo, ikiwa kazi hii inaita kazi kama AuthorizationCreateFromExternalForm, authorizationRightForCommand, AuthorizationCopyRights, AuhtorizationFree, inatumia EvenBetterAuthorizationSample.
Angalia /var/db/auth.db kuona ikiwa ni rahisi kupata ruhusa ya kuita hatua fulani ya kipekee bila ushirikiano wa mtumiaji.
Mawasiliano ya Itifaki
Kisha, unahitaji kupata mpango wa itifaki ili uweze kuanzisha mawasiliano na huduma ya XPC.
Kazi shouldAcceptNewConnection inaonyesha itifaki inayotolewa:
Katika kesi hii, tuna kitu kama katika EvenBetterAuthorizationSample, angalia mstari huu.
Kujua, jina la itifaki iliyotumiwa, ni rahisi kudondosha ufafanuzi wa kichwa chake na:
