Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

10.7: A look at /etc/authorization usage System 10.7
The /etc/authorization file in Mac OS X can be used to control access to the various panes of the System Preferences amongst other things. It's used by some of us Mac Sys Admin's to give Standard Users access to System Prefs panes that only admins could otherwise unlock. It can also be used in the reverse to lock down panes you don't want users messing with. An example by Apple was about allowing non-admin users to change the time zone setting. Often the panes can't be controlled to the exact level you may want via MCX (Local or Managed) or defaults write/plists. Nor do you want to give users admin rights in a large business/university setting.

With 10.6 and now 10.7 the following Preference Panes are locked by default. Meaning you need an admin username and password to unlock them: Security & Privacy, Print & Scan, Network, Sharing, Users & Groups, Parental Controls, Date & Time, Software Update, Time Machine and Startup Disk. As a 'Standard User' you can't unlock these panes.

In 10.6 we could do the following to the /etc/authorization file, to give a standard user semi-admin access to the Preference Panes.
<key>system.preferences</key>
 <dict>
 <key>allow-root</key>
 <true/>
 <key>class</key>
 <string>user</string>
 <key>comment</key>
 <string>Checked by the Admin framework when making changes to certain System Preferences.</string>
 <key>group</key>
  <string>everyone</string> * Changing this from 'admin', to another local group. i.e. staff,
everyone, or a custom group you created yourself.
 <key>shared</key>
 <true/>
 </dict>
This unlocks the majority of the preference panes above, the downside being you probably don't want them all unlocked. (i.e Startup Disk) For some this was acceptable and used. Some of us however just wanted a few unlocked, i.e. Date & Time for laptop users who travel a lot. Time Machine, so staff could connect to a Time Capsule or USB Hard Drive at home. Energy Saver so they could adjust the settings to their liking. etc…

With Lion the /etc/authorization has undergone some changes and has much more granular control available in it. Which makes locking or unlocking individual Preference Panes possible.

Before you start make a copy of the authorization file. If you make a wrong edit your machine will get stuck and the spinning cog on boot. You can restore from your backup by booting into Single User mode (Command + S on boot) and trashing the messed file and renaming your backup. You can also edit the file from this mode, use sudo mount -auw then, cd etc, sudo pico authorization at the command line. Find the bit you messed up fix it and save and reboot.

So open up the /etc/authorization file (Finder, Go to Folder, /etc), I'd recommend using TextWrangler to edit it. In general you are going to be searching for a <key> key-name </key> and then editing the very end section of the key/dict entry. From this, to this:
	<string>__APPNAME__ 正在嘗試解鎖"安全性與隱私"偏好設定。</string>
</dict>
<key>group</key>
<string>admin</string> ** Change admin to another local group that your user is in. i.e. staff, everyone etc...
<key>shared</key>
<false/>
Standard Users when created are automatically put into the 'staff' group. 'Admin' users are in the 'staff' and 'admin' groups

Save the file and reboot your Mac.

To unlock the Systems Preferences in General so all changes below will actually work you first need to edit this top level key, system.preferences, and adjust it as above changing it to a local group, i.e. staff. Save and reboot.

I certainly don't recommend unlocking all the Prefs panes, as it may give users more access than you want or have unintended side effects. But I will document them all in case needed.

To Unlock the Security & Privacy Pane, search for the following key: system.preferences.security and adjust it as above, then save and reboot. This alone will unlock the pane, but you still won't be able to get into it. Try logging in as a Standard user and unlocking it, it will work the first time but you'll be prompted again at which point it won't accept your password. This is because it's actually trying to unlock the FileVault tab, if you cancel out of the second credential prompt and go back in you'll get this slightly different prompt second time round.

First time round it was 'is trying to unlock Sharing preferences', second time its 'modify an encrypted disk.' So go back to the etc/authorization file and search for this key: com.apple.DiskManagement.reserveKEK.
	<dict>
		<key>en</key>
		<string>__APPNAME__ is trying to modify an encrypted disk.</string>
	</dict>
	<key>group</key>
	<string>admin</string> *Change this to another local group: staff, everyone
	<key>shared</key>
Save and reboot. Login as your standard user, you can now get into the Security & Privacy pane.
  • Energy Saver -- Unlockable by editing system.preferences.energysaver (as above).
  • Print & Scan – Unlockable by editing system.preferences.printing. Note this unlocks the pane but you need to be in the lpadmin group to add a printer.
  • Network -- Unlockable by editing system.preferences.network.
  • Sharing -- Unlockable by editing system.preferences.sharing. This alone won't unlock sharing as the 'File Sharing' component is still blocking your access. You need to adjust system.sharepoints. as well.
Users & Groups -- Unlockable by editing system.preferences.accounts again this alone won't unlock the Pane, you will be prompted for credentials twice, it will fail on attempt two. you need to adjust system.services.directory.configure as well. This key is slightly different and uses a rule key, rather than a group key. edit it as follows to allow the current 'session user' access.
 </dict>
	<key>rule</key>
	<string>root-or-admin-or-authenticate-admin</string> *Change it to authenticate-session-
owner-or-admin
</dict>
  • Parental Controls -- Unlockable by editing system.preferences.parental-controls.
  • Date & Time – Unlockable by editing system.preferences.datetime.
  • Software Update – Unlockable by editing system.preferences.softwareupdate.
  • Time Machine – Unlockable by editing system.preferences.timemachine.
  • Startup Disk – Unlockable by editing system.preferences.startupdisk .
And then there's some new keys of interest in Lion:
  • system.install.app-store-software
  • com.apple.SoftwareUpdate.scan

Here is the link to the original article, including some illustrations.

[crarko adds: There's a lot to absorb here. I hope I didn't mess anything up in the editing process, but if there is any confusion please also cross-check with the original article (the link is provided above).]
    •    
  • Currently 3.83 / 5
  You rated: 2 / 5 (6 votes cast)
 
[13,615 views]  

10.7: A look at /etc/authorization usage | 3 comments | Create New Account
Click here to return to the '10.7: A look at /etc/authorization usage' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.7: A look at /etc/authorization usage
Authored by: osxpounder on Mar 05, '12 12:57:47PM

Thanks for taking the time to share these details with us.

I wish Apple would just make a checklist of all the pref panes, for each user, so an admin user could un/check the ones that we'd like standard users to access.

---
- iCal has gotten really awesome lately.



[ Reply to This | # ]
10.7 /etc/authorization problems
Authored by: mauser on Mar 20, '12 12:39:53PM

Hi,

I must be doing something wrong - I edited these as noted here, and the panes are still locked. I made sure the user and group were set back to root and wheel respectively, even logged in as root to make changes and save directly to the /etc folder. What could I be missing?



[ Reply to This | # ]
10.7: A look at /etc/authorization usage
Authored by: mycatsajerk on Jul 13, '12 07:29:03AM

I'm trying to hide most of the sharing services from the "sharing" system preferences pane, I think I'm on the right track with this thread.



[ Reply to This | # ]