Required privileges for developers

[jimmy-swings]

Can anyone provide their experience with the required privilege a user might need for development activities, specially mobile development with Xcode, Xamarin and Android Studio?

I have a requirement that some users should have a fully managed machine and not have local administrator rights...

[calumhunter]

ask your users? if they say admin rights, ask them to justify their reasoning, ie application x needs admin rights because blah blah

[pblake]

I've gone as far as adding developers to the sudoers list but not making them a local admin.

[rhysforrester]

/usr/sbin/DevToolsSecurity -enable
/usr/bin/dscl . append /Groups/_developer GroupMembership $username

This allows students to compile code and run Simulator without the need for admin privs. I run the above code as part of a login trigger on any machine that has Xcode installed. It's worked for 3+ years now in my Xcode lab without incident.

[jimmy-swings]

Thanks all for your comment.

How are you deploying Xcode? Do you package and distribute through Self Service or allow local users to download & install through the app store? If the latter, how does a standard user launch Xcode for the first time? In my testing, I'm being prompted for an admin authorisation as Xcode wants to make changes.

[rhysforrester]

Use the copy of Xcode and the command-line tools that come from the Apple developer portal. It's a .app in a .dmg and the command-line tools are a .pkg.

I believe the admin credentials being requested will be due to a couple of .pkgs that are installed on first launch. These can be dismissed with a run-after script in your policy (be it a triggered or Self Service policy).

/usr/sbin/installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/MobileDevice.pkg -tgt /
/usr/sbin/installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/MobileDeviceDevelopment.pkg -tgt /
/Applications/Xcode.app/Contents/Developer/usr/bin/xcodebuild -license accept

[jimmy-swings]

Thanks @rhysforrester. I'll package and test.