/etc/authorization Parental Controls

With an unmodified /etc/authorization, run Composer in filesystem monitoring mode while you make the changes with an admin-class user. That may point you in the right direction. It may be down to some sort of file permissions that the user who makes those changes needs (which a non-admin user may not have).

In some cases, just being able to unlock a System Preference Pane isn't enough. While you may have allowed unlock of Parental Controls in the /etc/authorization file, its possible when a user makes changes to some of the items located in it, they are in fact making changes to other areas of the system that aren;t accounted for in the authorization file. Make sense?

Back in Pre 10.6 OS X, it used to be easier to tell which actual process was requesting permissions in the authentication dialog box by turning down the little arrow for Details, but Apple removed that handy feedback, so its a little tougher now to know what is actually being called under the hood.

I don't use Parental Controls at all so I can't even really test anything here. Etc/authorization is not well documented so it can take some time, experimentation and patience to get it to all work right. At least that's been my experience in playing with it.

I ran fseventer to see where the changes were being made. I think it might have something to do with writing to the /Library/Managed Preferences folder. I guess I'll need to change the preferences on that folder? I tried that and it seems I can't really change the preferences on that folder. Does it sound like I'm on the right track?

did fseventer give you an indication as to what account made the change? (thought it listed that info as well)

I don't know if with parental controls if the account directly makes that change or if a system account does it on the admin-class account's behalf.

Hey Jamie,

Just a quick question for you. Is there a reason managed preferences or configuration profiles will not work for you? They can probably address all your needs and then there is no need for you to edit the /etc/authorization file. Which in my personal opinion has some down sides to it.

Thanks,
Tom

We'd like to allow our student's parents to be able to make changes to parental controls so they can limit their child's computer use while at home. Every parent probably has different websites they'd like to block and different computer usage time limits.

Jared,

I don't see where it shows the user but it does show the process that's using a file/folder. Activity Monitor will show me which user is using that process. It looks like the two processes I see are "opendirectoryd" and "parentalcontrolsd". The "root" user is linked to those processes.

Does that help?

- Jamie

Alright, I just tried monitoring file system changes with Composer and it looks like the only thing that's being changed is the contents of the /Library/Managed Preferences/ folder. The owner of this folder is root. The group of this folder is wheel. Root can read/write/execute. The wheel group can read/execute.

I'm guessing I need to add the "powerusers" group to this folder and give it read/write/execute permissions. I tried doing that but the changes weren't saved, I'm guessing the system doesn't want me to change the permissions on that folder.

Is there any way to make this happen?