[launchd-dev] SMJobBless & secure launched helper tool

[Eric Gorr]

I have a couple of questions about SMJobBless - both the sample code (http://developer.apple.com/library/mac/#samplecode/SMJobBless/Introduction/Intro.html#//apple_ref/doc/uid/DTS40010071) and function and how it relates to a launchd secure helper tool.

The primary question regards the sample SMJobBless sample code - When running the application, under what circumstances will an admin password be requested?

What little I could find seemed to indicate that it should only be asking for the password when the SMJobBless function needs to install the helper tool because either the helper tool was never installed or the SMJobBless function sees that a new version needs to be installed. However, the behavior I am seeing is that an admin password will be requested each time the SMJobBless application is launched (so long as X amount of time passes between launches). Is there a bug here or are things behaving correctly?

Since I am hesitant to believe there is a bug in the APIs or that the sample code is incorrect, what appears to be necessary is to first check the version of the installed helper tool vs. the version in the application package. I am doing this with the following code:

----------
VVVVVVVVVV
----------
NSDictionary* installedHelperJobData;

installedHelperJobData  = (NSDictionary*)SMJobCopyDictionary( kSMDomainSystemLaunchd, (CFStringRef)@"com.apple.bsd.SMJobBlessHelper" );

NSString*       installedPath           = [[installedHelperJobData objectForKey:@"ProgramArguments"] objectAtIndex:0];
NSURL*          installedPathURL        = [NSURL fileURLWithPath:installedPath];
  
NSDictionary*   installedInfoPlist      = (NSDictionary*)CFBundleCopyInfoDictionaryForURL( (CFURLRef)installedPathURL );
NSString*       installedBundleVersion  = [installedInfoPlist objectForKey:@"CFBundleVersion"];
NSInteger       installedVersion        = [installedBundleVersion integerValue];
    
NSLog( @"installedVersion: %ld", (long)installedVersion );

NSBundle*       appBundle       = [NSBundle mainBundle];
NSURL*          appBundleURL    = [appBundle bundleURL];
       
NSURL*          currentHelperToolURL    = [appBundleURL URLByAppendingPathComponent:@"Contents/Library/LaunchServices/com.apple.bsd.SMJobBlessHelper"];
NSDictionary*   currentInfoPlist        = (NSDictionary*)CFBundleCopyInfoDictionaryForURL( (CFURLRef)currentHelperToolURL );
NSString*       currentBundleVersion    = [currentInfoPlist objectForKey:@"CFBundleVersion"];
NSInteger       currentVersion          = [currentBundleVersion integerValue];

NSLog( @"currentVersion: %ld", (long)currentVersion );
----------
^^^^^^^^^^
----------

I altered the sample code a little to guarantee that the version # is just an increasing integer.

Is there a better way to check the version numbers? Is there some other method I should be using to determine whether or not blessHelperWithLabel should be called?

Only if the two versions are different does blessHelperWithLabel get called. However, this code seems like it should be unnecessary because SMJobBless is doing a version check.

Thank you.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.macosforge.org/pipermail/launchd-dev/attachments/20111003/e5f92c41/attachment.html>