0

I'm getting ready to deploy an app on OS X. This is the first time I've written an application on this platform which requires root permissions to run properly, so I need that functionality integrated for every startup attempt.

The application itself is written in Python 2.7, and then compiled to binary using PyInstaller. So far, I've tried:

  • Running PyInstaller using sudo pyinstaller -w --icon=/path/to/icon /path/to/script.py

  • Invoking the PyInstaller command using sudo su

I don't know what else to try at this point. Is it something that could be achieved using symlinks?

Jules
  • 14,200
  • 13
  • 56
  • 101

2 Answers2

2

Apple recommend that no GUI applications run as root, as the libraries that are included in such applications increase the attack vector for malware.

Instead, it is recommended to refactor your code into two parts, the Gui and a separate helper app, which is given root privileges.

There's an example application here.

TheDarkKnight
  • 27,181
  • 6
  • 55
  • 85
1

Running the installer as root will have no effect when you later start the application itself as a normal user.

Try sudo python /path/to/script.py instead.

If that works, then put this into a shell script and run that to start the app as root from now on (and the people who know MacOS can probably tell you how you can create a nice icon for the script).

WARNING Doing this makes your system vulnerable to attacks. If you do this on your own Mac, that's fine. If you're developing a product that you're selling to other people, then you need to revisit your design since it's severely broken.

Aaron Digulla
  • 321,842
  • 108
  • 597
  • 820
  • This was helpful, but this causes a terminal window to open up prompting for a root password. Given the target audience of this application, it would be preferable to get the usual GUI popup asking for a password. Is there any way to do that? On a side note, the `.py` script is not in the end product. It all gets compiled to binary by PyInstaller. – Jules Sep 11 '14 at 15:36
  • Well, you're about to ruin the security of your system, so it shouldn't be comfortable. My guess right now is that you don't really know what you're doing and "run it as root" seemed like a "solution" to whatever problem you're having. **It isn't.** Your app must run without root. If you're getting errors or have a problem with that, ask us for a solution. But running millions lines of unsafe code as root is like inviting every criminal on the world for a house party. – Aaron Digulla Sep 18 '14 at 07:44
  • My app is a wrapper built around a major, third-party component that requires root privileges to run, the source code of which is far too large for me to put changes into, that asks for permissions only via terminal. If my comments seem uninformed, it's because I'm not normally an Objective-C developer - as I mentioned, all the source code for the wrapper is Python, compiled using PyInstaller. – Jules Sep 18 '14 at 12:58
  • Security works the same way, no matter whether you use Python or Objective-C. What's this third-party component and why does it need root? – Aaron Digulla Sep 18 '14 at 14:50
  • @AaronDigulla I'd like to isolate the parts, but can't translate from the linked code, to python. Could you please add a simple example? In particular, I'd like to only give permission to 'keyboard.add_hotkey'; do I just put JUST this in a separate file, and only give THAT file root? I still have to import the functions it triggers from another file. – one_observation Aug 09 '18 at 19:03
  • @AaronDigulla In particular, would this be dangerous?: `script = """python -c "import keyboard; import callback; keyboard.add_hotkey('cmd+x', callback)""" os.system("""osascript -e 'do shell script "{}" with administrator privileges'""".format(script))` where the calling script is the one with the GUI? – one_observation Aug 10 '18 at 17:58
  • @one_observation It's a bit hard to talk about this in comments. I fear the `callback` part won't work or it will add a security risk because the code of `callback` will be executed with root permissions. Please ask a new question where you give more details what you want to do. – Aaron Digulla Aug 23 '18 at 12:58
  • @AaronDigulla https://stackoverflow.com/questions/51801282/selectively-request-root-access-for-a-piece-of-a-packaged-python-app/51936407#51936407 ; – one_observation Aug 23 '18 at 15:26