Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.
CCA Badge
7

Allow non admins to change Network preferences.

Posted: 12/5/11 at 6:27 PM by abenedict

I have a script that has been working for 10.6 that unlocks Network for non admins, but it doesn't seem to work with 10.7. Anyone have any ideas what it takes to make it work in 10.7? Below is my current script I am using for this.

Thanks!
Alan

#!/usr/bin/perl

$plbud = "/usr/libexec/PlistBuddy";
$auth = "/private/etc/authorization";

$sysprefso = `$plbud -c \"print :rights:system.preferences:session-owner\" $auth`;
if ($sysprefso !~ /true/) {
print"Needs authorization file modified\n";
# Set system.preferences settings here
system"$plbud -c \"add :rights:system.preferences:session-owner bool true\" $auth";
system"$plbud -c \"set :rights:system.preferences:session-owner true\" $auth";
system"$plbud -c \"set :rights:system.preferences:allow-root true\" $auth";
system"$plbud -c \"set :rights:system.preferences:comment Authenticate either as the owner or as an administrator.\" $auth";
print"Modified authorization file to allow non-admins to modify network settings\n";
}
else {
print"authorization file already modified\n";
}
7

SOLVED Posted: 12/6/11 at 1:52 PM by mattsmacblog

10.7's authorization file has much more granular control.

The keys that need changing in /etc/authorization are

<key>system.preferences</key>

&

<key>system.preferences.network</key>

Your script probably still works for the top key, but you'll need to extend it to unlock the second.

I wrote some info up here \- http://mattsmacblog.wordpress.com/

It's not at the scripting level and I haven't gone into <key> vs <group> based unlocking. You can change <key>system.preferences.network</key> from the <user> class to <rule> to apply the session-owner rule if you want.

Matt

CCA Badge

Posted: 12/6/11 at 1:58 PM by abenedict

Thanks! Here is what I came up with for editing my authorization file.
I add the .plist to the file when copying because I have a couple of defaults write commands that run on the file as well.

#!/bin/bash
#Copy file to tmp location
/bin/cp -pr /etc/authorization /private/tmp/authorization.plist
# Unlock System Preferences for non admins.
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences:group staff' /private/tmp/authorization.plist
# Unlock Network Settings preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.network:group staff' /private/tmp/authorization.plist
# Unlock Printer Preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.printing:group staff' /private/tmp/authorization.plist
# Unlock time machine preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.timemachine:group staff' /private/tmp/authorization.plist
# Unlock energy saver preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.energysaver:group staff' /private/tmp/authorization.plist
# Move file back to original location   
/bin/mv /private/tmp/authorization.plist /etc/authorization
CCA Badge CJA Badge

Posted: 3/22/12 at 2:22 PM by quedayone

Thanks for this!

Posted: 9/11/12 at 4:49 PM by jsimmons

Imm newbie can you tell me where to put this script to get it to work.

Thank you

Posted: 9/11/12 at 4:50 PM by Matt

Login script would work.

Posted: 10/18/12 at 10:47 AM by jamf.admin

Will this still work in 10.8 or has the authorization file changed?

CCA Badge

Posted: 10/18/12 at 12:27 PM by Chris

It's pretty much the same, although i found that for unlocking network prefs in ML you have to modify the

system.services.systemconfiguration.network

in addition to what's mentioned above.

E.g.

/usr/libexec/PlistBuddy -c 'Set :rights:system.services.systemconfiguration.network:rule allow' /etc/authorization