Skip to main content
Answer

Allow non admins to change Network preferences.

  • December 6, 2011
  • 7 replies
  • 47 views
A
Forum|alt.badge.img+5

I have a script that has been working for 10.6 that unlocks Network for non admins, but it doesn't seem to work with 10.7. Anyone have any ideas what it takes to make it work in 10.7? Below is my current script I am using for this.

Thanks!
Alan

#!/usr/bin/perl

$plbud = "/usr/libexec/PlistBuddy";
$auth = "/private/etc/authorization";

$sysprefso = `$plbud -c "print :rights:system.preferences:session-owner" $auth`;
if ($sysprefso !~ /true/) {
print"Needs authorization file modified
";
# Set system.preferences settings here
system"$plbud -c "add :rights:system.preferences:session-owner bool true" $auth";
system"$plbud -c "set :rights:system.preferences:session-owner true" $auth";
system"$plbud -c "set :rights:system.preferences:allow-root true" $auth";
system"$plbud -c "set :rights:system.preferences:comment Authenticate either as the owner or as an administrator." $auth";
print"Modified authorization file to allow non-admins to modify network settings
";
}
else {
print"authorization file already modified
";
}

Best answer by mattsmacblog

10.7's authorization file has much more granular control.

The keys that need changing in /etc/authorization are

<key>system.preferences</key>

&

<key>system.preferences.network</key>

Your script probably still works for the top key, but you'll need to extend it to unlock the second.

I wrote some info up here - http://mattsmacblog.wordpress.com/

It's not at the scripting level and I haven't gone into <key> vs <group> based unlocking. You can change <key>system.preferences.network</key> from the <user> class to <rule> to apply the session-owner rule if you want.

Matt

    7 replies

    M
    Forum|alt.badge.img+2
    • mattsmacblog
    • New Contributor
    • Answer
    • December 6, 2011

    10.7's authorization file has much more granular control.

    The keys that need changing in /etc/authorization are

    <key>system.preferences</key>

    &

    <key>system.preferences.network</key>

    Your script probably still works for the top key, but you'll need to extend it to unlock the second.

    I wrote some info up here - http://mattsmacblog.wordpress.com/

    It's not at the scripting level and I haven't gone into <key> vs <group> based unlocking. You can change <key>system.preferences.network</key> from the <user> class to <rule> to apply the session-owner rule if you want.

    Matt

    A
    Forum|alt.badge.img+5
    • abenedict
    • Author
    • Contributor
    • December 6, 2011

    Thanks! Here is what I came up with for editing my authorization file.
    I add the .plist to the file when copying because I have a couple of defaults write commands that run on the file as well.

    #!/bin/bash
#Copy file to tmp location
/bin/cp -pr /etc/authorization /private/tmp/authorization.plist
# Unlock System Preferences for non admins.
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences:group staff' /private/tmp/authorization.plist
# Unlock Network Settings preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.network:group staff' /private/tmp/authorization.plist
# Unlock Printer Preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.printing:group staff' /private/tmp/authorization.plist
# Unlock time machine preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.timemachine:group staff' /private/tmp/authorization.plist
# Unlock energy saver preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.energysaver:group staff' /private/tmp/authorization.plist
# Move file back to original location   
/bin/mv /private/tmp/authorization.plist /etc/authorization
    Q
    Forum|alt.badge.img+6
    • quedayone
    • Contributor
    • March 22, 2012

    Thanks for this!

    J
    Forum|alt.badge.img
    • jsimmons
    • New Contributor
    • September 11, 2012

    Imm newbie can you tell me where to put this script to get it to work.

    Thank you

    M
    Forum|alt.badge.img+20
    • Matt11
    • Valued Contributor
    • September 11, 2012

    Login script would work.

    J
    Forum|alt.badge.img+3
    • jamf_admin11
    • New Contributor
    • October 18, 2012

    Will this still work in 10.8 or has the authorization file changed?

    C
    Forum|alt.badge.img+13
    • Chris
    • Valued Contributor
    • October 18, 2012

    It's pretty much the same, although i found that for unlocking network prefs in ML you have to modify the

    system.services.systemconfiguration.network

    in addition to what's mentioned above.

    E.g.

    /usr/libexec/PlistBuddy -c 'Set :rights:system.services.systemconfiguration.network:rule allow' /etc/authorization
    Terms & ConditionsCookie settingsAccessibility statement