Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.

Allow non admins to change Network preferences.

I have a script that has been working for 10.6 that unlocks Network for non admins, but it doesn't seem to work with 10.7. Anyone have any ideas what it takes to make it work in 10.7? Below is my current script I am using for this.

Thanks!
Alan

#!/usr/bin/perl

$plbud = "/usr/libexec/PlistBuddy";
$auth = "/private/etc/authorization";

$sysprefso = `$plbud -c \"print :rights:system.preferences:session-owner\" $auth`;
if ($sysprefso !~ /true/) {
print"Needs authorization file modified\n";
# Set system.preferences settings here
system"$plbud -c \"add :rights:system.preferences:session-owner bool true\" $auth";
system"$plbud -c \"set :rights:system.preferences:session-owner true\" $auth";
system"$plbud -c \"set :rights:system.preferences:allow-root true\" $auth";
system"$plbud -c \"set :rights:system.preferences:comment Authenticate either as the owner or as an administrator.\" $auth";
print"Modified authorization file to allow non-admins to modify network settings\n";
}
else {
print"authorization file already modified\n";
}
Like Comment
SOLVED Posted: 12/6/11 at 1:52 PM by mattsmacblog

10.7's authorization file has much more granular control.

The keys that need changing in /etc/authorization are

<key>system.preferences</key>

&

<key>system.preferences.network</key>

Your script probably still works for the top key, but you'll need to extend it to unlock the second.

I wrote some info up here \- http://mattsmacblog.wordpress.com/

It's not at the scripting level and I haven't gone into <key> vs <group> based unlocking. You can change <key>system.preferences.network</key> from the <user> class to <rule> to apply the session-owner rule if you want.

Matt

Like
SOLVED Posted: 12/6/11 at 1:58 PM by abenedict

Thanks! Here is what I came up with for editing my authorization file.
I add the .plist to the file when copying because I have a couple of defaults write commands that run on the file as well.

#!/bin/bash
#Copy file to tmp location
/bin/cp -pr /etc/authorization /private/tmp/authorization.plist
# Unlock System Preferences for non admins.
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences:group staff' /private/tmp/authorization.plist
# Unlock Network Settings preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.network:group staff' /private/tmp/authorization.plist
# Unlock Printer Preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.printing:group staff' /private/tmp/authorization.plist
# Unlock time machine preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.timemachine:group staff' /private/tmp/authorization.plist
# Unlock energy saver preference pane
/usr/libexec/PlistBuddy -c 'Set :rights:system.preferences.energysaver:group staff' /private/tmp/authorization.plist
# Move file back to original location   
/bin/mv /private/tmp/authorization.plist /etc/authorization
Like
SOLVED Posted: 3/22/12 at 2:22 PM by quedayone

Thanks for this!

Like
SOLVED Posted: 9/11/12 at 4:49 PM by jsimmons

Imm newbie can you tell me where to put this script to get it to work.

Thank you

Like
SOLVED Posted: 9/11/12 at 4:50 PM by Matt

Login script would work.

Like
SOLVED Posted: 10/18/12 at 10:47 AM by jamf.admin

Will this still work in 10.8 or has the authorization file changed?

Like
SOLVED Posted: 10/18/12 at 12:27 PM by Chris

It's pretty much the same, although i found that for unlocking network prefs in ML you have to modify the

system.services.systemconfiguration.network

in addition to what's mentioned above.

E.g.

/usr/libexec/PlistBuddy -c 'Set :rights:system.services.systemconfiguration.network:rule allow' /etc/authorization
Like