I thought that all of ServiceManagement.framework was deprecated in 10.10, but it looks like that’s not the case. One call, SMJobBless() survived the chopping block.

I’ve had some trouble with ServiceManagement.framework as rewritten for the new XPC-based launchd in 10.10, so I’ll caution you to test any change in this area distinctly on 10.9 and 10.10/10.11.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bd736b069b320a18476b30aea47639fb25f50110

commit bd736b069b320a18476b30aea47639fb25f50110
Author: erikchen <erikchen@chromium.org>
Date: Tue Mar 08 23:47:39 2016

Prepare base/ for compilation with OS X 10.7 deployment target.

Disable deprecation warnings for AuthorizationExecuteWithPrivileges, which has
been deprecated since OS X 10.7.

Update the forward declaration of -[NSEvent stage] to have the appropriate
semantics. It was introduced in OS X 10.10.3.

BUG= 592663 ,  593133 

Review URL: https://codereview.chromium.org/1773303002

Cr-Commit-Position: refs/heads/master@{#379969}

[modify] https://crrev.com/bd736b069b320a18476b30aea47639fb25f50110/base/mac/authorization_util.mm
[modify] https://crrev.com/bd736b069b320a18476b30aea47639fb25f50110/base/mac/sdk_forward_declarations.h

I don’t believe that SMJobBless is remotely what we want. We most recently looked at this for the installer.

[16/2773] OBJCXX obj/base/base/authorization_util.o
../../base/mac/authorization_util.mm:116:21: warning: 'AuthorizationExecuteWithPrivileges' is deprecated: first deprecated in macOS 10.7 [-Wdeprecated-declarations]
  OSStatus status = AuthorizationExecuteWithPrivileges(authorization,
                    ^
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.10.sdk/System/Library/Frameworks/Security.framework/Headers/Authorization.h:435:10: note: 'AuthorizationExecuteWithPrivileges' has been explicitly marked deprecated here
OSStatus AuthorizationExecuteWithPrivileges(AuthorizationRef authorization,
         ^
1 warning generated.

Note that this deprecated code is also present [and should be fixed] in chrome/installer/mac/app/AuthorizedInstall.m

https://cs.chromium.org/chromium/src/chrome/installer/mac/app/AuthorizedInstall.m?q=%22%23pragma+clang+diagnostic+ignored+%5C%22-Wdeprecated-declarations%5C%22%22&sq=package:chromium&dr=C&l=40

Like I said, I don’t think we can not use AuthorizatonExecuteWithPrivileges. SMJobBless is very different.

I meant to include Sidney above, too. Oops.

Can you describe why SMJobBless won't work? Or are you saying it would take too much work to migrate without a tangible benefit?

SMJobBless installs tools to the system LaunchDaemons domain. Not exactly what we need for our uses of AuthorizationExecuteWithPrivileges.

So this is a WontFix then?

Unless anyone has any other ideas. That’s why I added Sidney and Boris.

A few months ago I did investigation for the Keystone's ksdiagnostics  and unfortunately, I came to the same conclusion. SMJobBless is an overkill for such one-time, short-lived elevated tasks. 

SMJobSubmit() isn't deprecated until 10.10:

https://developer.apple.com/reference/servicemanagement/1431084-smjobsubmit
https://www.stairways.com/blog/2012-08-06-smjobsubmit

This is horrible, but what about: osascript -e 'do shell script "whatever" with administrator privileges'?

That’s far less good. It doesn’t let us customize the icon or message in the authentication dialog, and doesn’t let us talk with the helper via stdio.

I'm also giving in to the conclusion that we should stick with AuthorizationExecuteWithPrivileges() for now.

For what it's worth, the OS X installers seem to have moved to SMJobBless(), based on the telltale "…is trying to install a new helper tool" prompt.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1a2f872a1bcaa864308372fd94c502c309fdfc53

commit 1a2f872a1bcaa864308372fd94c502c309fdfc53
Author: erikchen <erikchen@chromium.org>
Date: Wed Oct 05 16:12:51 2016

Update comments for AuthorizationExecuteWithPrivileges.

As per discussion on crbug, no good replacement exists. Update the comments to
indicate this.

BUG= 593133 

Review-Url: https://codereview.chromium.org/2394683002
Cr-Commit-Position: refs/heads/master@{#423176}

[modify] https://crrev.com/1a2f872a1bcaa864308372fd94c502c309fdfc53/base/mac/authorization_util.mm
[modify] https://crrev.com/1a2f872a1bcaa864308372fd94c502c309fdfc53/chrome/installer/mac/app/AuthorizedInstall.m

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1a2f872a1bcaa864308372fd94c502c309fdfc53

commit 1a2f872a1bcaa864308372fd94c502c309fdfc53
Author: erikchen <erikchen@chromium.org>
Date: Wed Oct 05 16:12:51 2016

Update comments for AuthorizationExecuteWithPrivileges.

As per discussion on crbug, no good replacement exists. Update the comments to
indicate this.

BUG= 593133 

Review-Url: https://codereview.chromium.org/2394683002
Cr-Commit-Position: refs/heads/master@{#423176}

[modify] https://crrev.com/1a2f872a1bcaa864308372fd94c502c309fdfc53/base/mac/authorization_util.mm
[modify] https://crrev.com/1a2f872a1bcaa864308372fd94c502c309fdfc53/chrome/installer/mac/app/AuthorizedInstall.m

[Automated comment] removing mislabelled merge-merged-2840

 Issue 707471  has been merged into this issue.