Please, please, please, add an option to elevate rights on OSX so I can copy and create files in protected folders. Especially the plugins folder, as my recent APP is a plugin manager. 
I have read the documentation on how to do that on OSX but for some reason (I have some mental disability problems) I can’t get my head around it…
Thanks!
Use STPrivilegedTask. It makes it into a one liner: https://github.com/sveinbjornt/STPrivilegedTask
Thanks. 
Edit: still wish a JUCE alternative would appear…
It’s not something that fits well into a cross-platform framework.
What? Tom, that’s not right, will have to disagree. Otherwise everything that JUCE stands for is mute. There’s a heck tons of stuff that are platform specific, but that mirrors to all platforms, ok, they go. But now something that is needed in all platforms, as rights to protected folders, can be done in Linux, which JUCE already DID. :-\ Humm… On Windows is just a compiler setting. On OSX is more complicated… And on iOS JUCE HAS IT. :-\ Humm…
I agree with William here. Windows has a mechanism for this too. For other platforms you have permission flags etc. that are all supported by JUCE to ask for microphone, camera access etc. so I don’t think asking to OS to elevate privileges, so custom installers etc. can do their job is too strange to include.
To add: you just added (only seven hours ago) the necessary sandboxing flags for OSX.
Here’s the relevant info: https://developer.apple.com/library/archive/documentation/Security/Conceptual/SecureCodingGuide/Articles/AccessControl.html
Rail
I think I must have misunderstood the request, or, at least, there’s a gap in my knowledge here.
macOS and Windows both provide ways of launching or scheduling processes that run with different permissions than the parent. Although similar, they’re not easy to unify into a single API, and I don’t believe anything equivalent exists on the mobile platforms. Wrapping this functionality is different from applying application-wide permissions such as microphone access. What would a good cross-platform API look like?
What have we already done in Linux? I think this might be the bit I’m missing.
JUCE_API void JUCE_CALLTYPE Process::raisePrivilege() { if (geteuid() != 0 && getuid() == 0) swapUserAndEffectiveUser(); }
JUCE_API void JUCE_CALLTYPE Process::lowerPrivilege() { if (geteuid() == 0 && getuid() != 0) swapUserAndEffectiveUser(); }
Still nothing? 
In my case, this would really save my day. As I need it for two situations.
my custom installer, which I can share the source-code and even create a short manual about it. It works great on Windows, thanks to the one-setting it takes me to make it request admin rights.
my plugin manager + bridge, which needs to erase and create bridged plugin files.
So the feature would save my day. 
Cheers, WilliamK
I had to do this myself for my installer… I doubt you’ll get ROLI to add it for you. It’s pretty involved and requires you write a helper tool which will probably be something customized for your needs.
Rail
Ok, I just tried something with the one-liner, and it seems to work. Since I need my entire app to run with elevated rights, I just make the main app a simple caller to the one I really want to use, which I hide inside the data folder. Seems ok, it asks for the password at startup and run correctly
// Create task
STPrivilegedTask *privilegedTask = [[STPrivilegedTask alloc] init];
[privilegedTask setLaunchPath:@"/usr/bin/open"];
[privilegedTask setArguments:@[@"/Users/williamk/Documents/_Wusik Product Installer/Builds/MacOSX/build/Release/Wusik Universal Installer.app"]];Ok, that didn’t work. It does ask for the password and launch the application. But inside the application I can’t write to protected folders such as /Library/Audio/Plug-Ins/VST
But I can call a scrip and it will do anything to that folder above. So I will stick with that for now. I will let me code create the script and run it when needed. A bit of a PITA as every time you do something that needs that, a password will be asked. Ugly…
I believe that’s related to this:
There should be an option in the Projucer with that commit to enable com.apple.security.assets.music.read-write in the app’s entitlements
Oh, that looks good. Will investigate. Thanks.
You spawn a tool to do the copying using AuthorizationExecuteWithPrivileges which will have time limited elevated privileges.
FILE *pipe = NULL;
OSStatus status;
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wdeprecated-declarations"
status = AuthorizationExecuteWithPrivileges (m_auth, tool, kAuthorizationFlagDefaults, args, &pipe);
#pragma clang diagnostic pop
As long as the AuthorizationRef (m_auth) is valid within it’s time limit (around 15 minutes or so) you can call the tool as above in an ObjectiveC function.
I have a tool named accentutil which is a command line app with the usage:
run: accentutil -?
Usage: accentutil -S SourcePath -D DestPath [-R] [-V] [-X] [-?] [/HELP]
You can use either - or / for the parameters
[/R] Copy Recursively (Optional)
[/V] Enable verbose mode (Optional)
[/X] Delete the DestPath recursively if it exists (Optional)
[/HELP] Display this help info. (Optional)
Return values: 0: No Errors
-1: Error copying source to dest
-2: Source doesn't exist
-3: Either the source or dest path is empty
Version: 1.0.1
NOTE: Your tool and calling app must both be signed with the same cert.
Rail
Sadly that is no longer working.
Also, for some reason I can’t open a new ChildProcess and have it run the one liner example. Trying to debug why it won’t run but so far no luck. All my other processes run without problems.
If you build with an older SDK (10.12) and a Deployment Target of 10.7 it works fine (note my pragmas in my posted snippet)
My installer works on Mojave perfectly fine.
Rail
