如何检测用户是否取消Helper SM Job Bless密码对话框？错误码排查

调用SMJobBless安装Helper工具时，用户取消密码对话框后，预期返回错误码kSMErrorLaunchDeniedByUser(11)，但实际得到kSMErrorInternalFailure(2)，需要识别正确的用户取消错误码以展示对应错误界面。

现有代码 #

var authorization: AuthorizationRef?
let status: OSStatus = AuthorizationCreate(nil, nil, [], &authorization)

guard status == errAuthorizationSuccess else {
    return .failure(authFailed)
}

var error: Unmanaged<CFError>?
let blessStatus = SMJobBless(kSMDomainSystemLaunchd, label as CFString, authorization, &error)
guard blessStatus else {

    //*** CHECK FOR CFERROR TO SEE WHETHER THE FAILURE IS DUE TO USER CANCELLING
    // THE PASSWORD REQUEST**
    print(error)

    return .failure(blessfailed)
}
return .success(())

错误信息 #

Error Domain=CFErrorDomainLaunchd Code=2

LLDB调试结果 #

(lldb) p kSMErrorLaunchDeniedByUser
(Int) $R0 = 11
(lldb) p kSMErrorInternalFailure
(Int) $R1 = 2

问题原因与解决方案 #

错误的核心是创建AuthorizationRef时未指定SMJobBless所需的特权权限，导致系统无法正确传递用户取消操作的错误码，转而返回内部错误。

修改后的代码 #

var authorization: AuthorizationRef?
// 指定SMJobBless所需的特权权限
let authItem = AuthorizationItem(name: kSMRightBlessPrivilegedHelper, valueLength: 0, value: nil, flags: 0)
let authRights = AuthorizationRights(count: 1, items: &authItem)
// 设置允许交互、扩展权限等必要标志
let authFlags: AuthorizationFlags = [.interactionAllowed, .extendRights, .preAuthorize]

let status: OSStatus = AuthorizationCreate(&authRights, nil, authFlags, &authorization)

guard status == errAuthorizationSuccess else {
    return .failure(authFailed)
}

var error: Unmanaged<CFError>?
let blessStatus = SMJobBless(kSMDomainSystemLaunchd, label as CFString, authorization, &error)
guard blessStatus else {
    guard let cfError = error?.takeRetainedValue() else {
        return .failure(blessfailed)
    }
    let errorCode = CFErrorGetCode(cfError)
    if errorCode == kSMErrorLaunchDeniedByUser {
        // 用户取消操作，触发对应错误界面逻辑
        return .failure(userCancelled)
    } else {
        // 处理其他错误
        return .failure(blessfailed)
    }
}
return .success(())

关键说明 #

• 必须请求kSMRightBlessPrivilegedHelper权限：这是SMJobBless执行特权操作的必要权限，缺失会导致错误码传递异常。
• 配置正确的AuthorizationFlags：确保系统可以弹出密码对话框（.interactionAllowed），并正确扩展权限以完成Helper安装。
• 处理CFError：用户取消密码框时，CFError的code会正确返回kSMErrorLaunchDeniedByUser(11)，可据此分支处理错误界面。

内容的提问来源于stack exchange，提问作者Titus