isThisThing0n?

I wanted to provide an option for standard macOS users to request local admin access on demand. The process needed to be robust and efficient. No reboots etc. My preference was to not use /usr/sbin/dseditgroup or /usr/bin/dscl as these tools may not produce the efficient workflow I am looking for.

I had experimented with SAP’s Privileges app in the past and found it was a very clean way for end users to flop over to admin-land then back to standard-user-town with the click of a button. I now however needed a way to kick them out of admin-land after a set time period had passed.

Privileges does offer a ‘DockToggleTimeout‘ feature which revokes admin access after a set time. But this key is only honored by the ‘Toggle Privileges’ function which is enabled by right clicking Privileges from the Dock – so this is not really of use to us, it’s not efficient and users will not adhere to using that method. More on that here https://derflounder.wordpress.com/2022/07/22/privileges-app-and-time-limited-admin/

The approach I settled on – and have been using in production for over a year – is to simply use the Privileges CLI triggered from a Jamf Pro Self Service policy. There are similar projects out there, however my concept was to have the tool clean up after itself, and I did not want the entire Privileges app bundle to be available to the user at any point. We also use an automated admin access request PowerApp which logs all the relevant details and then, once approved, triggers the addition of the computer to a Jamf Pro static computer group via the Jamf Pro API. This then makes the MakeMeAdmin policy available in Self Service.

This similar project uses WatchPaths and a signal file to demote a user’s access https://github.com/sgmills/PrivilegesDemoter

Workflow

After isolating just the Privileges CLI tool, and installing it to /usr/local/bin, we then load the Privileges helper tool daemon prior to calling /usr/local/bin/PrivilegesCLI. Privileges CLI cannot be run as root, so calling it from a Jamf Pro script requires us to call it in the context of the logged in user.

# elevate privs now
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )
userID=$(id -u "$loggedInUser")
/bin/launchctl bootstrap system /Library/LaunchDaemons/corp.sap.privileges.helper.plist
launchctl asuser $userID sudo -u $loggedInUser /usr/local/bin/PrivilegesCLI --add

The LaunchDaemon , which is created by the initial Self Service script run, revokes admin access after a predefined time has elapsed. The StartInterval key has a value in seconds. This ensures the removeAdminRights.sh script is called after exactly N seconds of run time, regardless of if the machine reboots or is offline etc.

{
    Label = "com.company.removeAdmin";
    ProgramArguments =     (
        "/bin/sh",
        "/Library/Application Support/JAMF/bin/removeAdminRights.sh"
    );
    RunAtLoad = 1;
    StandardErrorPath = "/private/var/userToRemove/err.err";
    StandardOutPath = "/private/var/userToRemove/out.out";
    StartInterval = 300;
}

The removeAdminRights.sh script is called by my LaunchDaemon. We previously captured the logged in user as $userToRemove and stored the value locally. This script also removes the computer from the initial static computer group, ensuring the user cannot run the tool again from Self Service, and also removes all components of the Privileges app.

# revoke privs now
userToRemove=$(cat /private/var/userToRemove/user)
sudo -u $userToRemove /usr/local/bin/PrivilegesCLI --remove
/bin/sleep 2
/bin/launchctl bootout system /Library/LaunchDaemons/corp.sap.privileges.helper.plist
# initiating self destruct sequence
/bin/rm -f /private/var/userToRemove/user
/bin/rm -f /Library/LaunchDaemons/com.rga.removeAdmin.plist
# remove all sap stuff
/bin/rm -rf /usr/local/bin/PrivilegesCLI
/bin/rm -f /Library/LaunchDaemons/corp.sap.privileges.helper.plist
/bin/rm -f /Library/PrivilegedHelperTools/corp.sap.privileges.helper
# recon to update user admin status is jamf pro
/usr/local/bin/jamf recon &
# remove this script
/bin/rm -f "$0"
# we cannot unload the daemon as the path no longer exists - just remove it from launchd
/bin/launchctl remove com.rga.removeAdmin

End Result

After running the Self Service MakeMeAdmin policy the end user is alerted once admin privileges are elevated and revoked. This also includes a JamfHelper countdown which (roughly) corresponds to the LaunchDaemon StartInterval. I will soon abandon JamfHelper in favor of a more reliable dialog tool as I have done with other projects – https://github.com/bartreardon/swiftDialog.

Git repo – https://github.com/1sth1sth1ng0n/jamfpro_makemeadmin