如何在Rust中预授权authopen以访问macOS SD卡？

我正在Rust中开发一款OS镜像烧录器，为获取SD卡的访问权限，尝试使用authopen工具实现预授权打开。

复现代码 #

use std::{
    io::{Write, IoSliceMut},
    process::{Command, Stdio},
};

use security_framework::authorization::{Authorization, AuthorizationItemSetBuilder, Flags};
use nix::sys::socket::{socketpair, SockFlag, SockType, AddressFamily, recvmsg, MsgFlags, UnixAddr, RecvMsg};
use nix::unistd::{close, pipe};
use nix::cmsg_space;


const DISK: &str = "/dev/rdisk2";

fn main() {
    open_auth(DISK);
}

fn open_auth(path: &str) {
    let rights = AuthorizationItemSetBuilder::new()
        .add_right(format!("sys.openfile.readwrite.{}", path))
        .unwrap()
        .build();

    let auth = Authorization::new(
        Some(rights),
        None,
        Flags::INTERACTION_ALLOWED | Flags::EXTEND_RIGHTS | Flags::PREAUTHORIZE,
    )
    .unwrap();

    let form = auth.make_external_form().unwrap();
    let form_bytes: Vec<u8> = form.bytes.into_iter().map(|x| x as u8).collect();

    let (srx, stx) = socketpair(
        AddressFamily::Unix,
        SockType::Stream,
        None,
        SockFlag::empty(),
    )
    .unwrap();
    let (prx, ptx) = pipe().unwrap();

    let mut cmd = Command::new("/usr/libexec/authopen")
        .args(["-stdoutpipe", "-extauth", "-o", "02", path])
        .stdin(Stdio::piped())
        .stdout(stx)
        .spawn()
        .unwrap();

    let mut stdin = cmd.stdin.take().unwrap();
    stdin.write_all(&form_bytes).unwrap();
    drop(stdin);

    let mut buf = [0u8; 4];
    let mut io_vec = [IoSliceMut::new(&mut buf)];
    let mut cmsg = cmsg_space!(RawFd);
    println!("Size: {}", cmsg.capacity());
    let msg: RecvMsg<'_, '_, UnixAddr> = recvmsg(
        srx.as_raw_fd(),
        &mut io_vec,
        Some(&mut cmsg),
        MsgFlags::empty(),
    )
    .unwrap();
    println!("RMSG: {:?}", msg);
    println!("Something: {:?}", msg.cmsgs().unwrap().collect::<Vec<_>>());

    println!("CMSG: {:?}", cmsg);
    println!("IOVEC: {:?}", io_vec);

    let output = cmd.wait().unwrap();
    println!("Raw output: {output:#?}");
}

运行输出 #

Finished dev profile [unoptimized + debuginfo] target(s) in 1.78s
     Running target/debug/temp
Size: 16
RMSG: RecvMsg { bytes: 2, cmsghdr: None, address: Some(UnixAddr { sun: sockaddr_un { sun_len: 0, sun_family: 0 } }), flags: MsgFlags(0x0), iobufs: PhantomData<&()>, mhdr: msghdr { msg_name: 0x7ff7b7f34166, msg_namelen: 0, msg_iov: 0x7ff7b7f34b68, msg_iovlen: 1, msg_control: 0x60000231c050, msg_controllen: 0, msg_flags: 0 } }
Something: []
CMSG: []
IOVEC: [[0, 16, 0, 0]]
Raw output: ExitStatus(
    unix_wait_status(
        256,
    ),
)

问题说明 #

运行代码后返回结果不符合预期：原本应该收到ScmRights控制消息，但仅得到2字节响应，程序退出状态码为256（表示执行失败）。我没有macOS开发经验，可能存在操作失误，希望得到相关帮助。

内容的提问来源于stack exchange，提问作者Ayush Singh