Extra functionality to macOS app
Budget: $250 – $750 USD
Strong Objective-C knowledge is needed.
Short description of what is needed:
- add a timer to the existing app.
This is the repo:
https://github.com/SAP/macOS-enterprise-privileges
Here are some questions:
1. Currently the app gives administration control to have full access to the machine in order to install/uninstall apps, right?
2. I've seen that the app also has timer preferences which you can set to automatically revert the user to a standard one when the time is up. Do we want a different timer?
3. is the problem that needs to be fixed: https://github.com/SAP/macOS-enterprise-privileges/pull/5 ?
Answers:
1. That's correct. The app is designed to promote a standard user to admin user by simply requesting those rights (technically the user is added to the "admin" group with ID 80). Then the user can install apps, reconfigure settings or anything else by himself until the rights are removed again. The basic idea is to empower the users (you obviously need to trust them not to do bad things)
2. Regarding the timer: Yes, that's the catch. The app has a built-in timeout feature, and that's what we want to use. But the timer does not work in every circumstance, but only if the privileges are acquired by using "Toggle Privileges" from the contextual menu that appears by right-clicking on the app's Dock icon. There is no timeout if you get admin privileges by simply starting the application or using the PrivilegesCLI command. That's the missing feature we need to address: make the timer work regardless of the invocation method.
3. Yes, that basically is the problem. I don't know if the solution provided there is correct, so we probably need to discuss the technical details. You might also want to have a look at https://github.com/peetinc/AdminScripts/tree/main/PrivilegesTools/RevokePrivileges, which also attempts to add the timeout. This isn't integrated in the app and doesn't honor the apps timeout preferences (it has a fixed timeout), but i guess we would also need a similar approach with an additional LaunchDaemon so we revoke the Privileges even if the app is not running or the user reboots the machine while the time is running. (Right now Privileges uses some timing feature provided by Dock app, that's why the timer only works when using the Dock contextual menu).
So that's the problem to solve.
You can freely decide about the actual technical implementation, as you probably know more about me. The only limitations are:
a) it should solve the problem
b) it should be as clean as possible
The final version of the code should be compiled inside the app and not in a separate script.
If you have a better, cleaner, or more elegant solution than to use a LaunchDaemon, then I would happily accept those.
Short description of what is needed:
- add a timer to the existing app.
This is the repo:
https://github.com/SAP/macOS-enterprise-privileges
Here are some questions:
1. Currently the app gives administration control to have full access to the machine in order to install/uninstall apps, right?
2. I've seen that the app also has timer preferences which you can set to automatically revert the user to a standard one when the time is up. Do we want a different timer?
3. is the problem that needs to be fixed: https://github.com/SAP/macOS-enterprise-privileges/pull/5 ?
Answers:
1. That's correct. The app is designed to promote a standard user to admin user by simply requesting those rights (technically the user is added to the "admin" group with ID 80). Then the user can install apps, reconfigure settings or anything else by himself until the rights are removed again. The basic idea is to empower the users (you obviously need to trust them not to do bad things)
2. Regarding the timer: Yes, that's the catch. The app has a built-in timeout feature, and that's what we want to use. But the timer does not work in every circumstance, but only if the privileges are acquired by using "Toggle Privileges" from the contextual menu that appears by right-clicking on the app's Dock icon. There is no timeout if you get admin privileges by simply starting the application or using the PrivilegesCLI command. That's the missing feature we need to address: make the timer work regardless of the invocation method.
3. Yes, that basically is the problem. I don't know if the solution provided there is correct, so we probably need to discuss the technical details. You might also want to have a look at https://github.com/peetinc/AdminScripts/tree/main/PrivilegesTools/RevokePrivileges, which also attempts to add the timeout. This isn't integrated in the app and doesn't honor the apps timeout preferences (it has a fixed timeout), but i guess we would also need a similar approach with an additional LaunchDaemon so we revoke the Privileges even if the app is not running or the user reboots the machine while the time is running. (Right now Privileges uses some timing feature provided by Dock app, that's why the timer only works when using the Dock contextual menu).
So that's the problem to solve.
You can freely decide about the actual technical implementation, as you probably know more about me. The only limitations are:
a) it should solve the problem
b) it should be as clean as possible
The final version of the code should be compiled inside the app and not in a separate script.
If you have a better, cleaner, or more elegant solution than to use a LaunchDaemon, then I would happily accept those.