已获取管理员权限仍无法向/usr/local/bin复制文件的问题排查

核心错误原因 #

你代码里的关键问题是获取了管理员授权的AuthorizationRef，但完全没在文件复制操作中使用它。FileManager.default的所有操作都是以当前应用的普通权限执行的，根本没用到你申请的管理员权限，所以依然会触发权限拒绝错误。

另外还有两个次要问题：

• 权限声明不符合macOS Authorization Services的要求：system.files.write是泛权限，实际需要针对具体目标路径申请写入权限；system.privilege.admin虽然能拿到管理员权限，但这种方式不够精细，也不符合权限最小化原则。
• 代码中创建/usr/local/bin的逻辑也有问题：这个目录通常已经存在，就算不存在，普通权限也创建不了，必须用授权后的上下文执行。

修正方案 #

方案1：使用AuthorizationExecuteWithPrivileges执行复制命令（兼容旧系统） #

虽然这个API已被标记为弃用，但在简单场景下依然可用，它能让你以授权后的权限执行系统命令：

func copyFiles() throws {
    let authorizationRef = try obtainAuthorization()
    defer { AuthorizationFree(authorizationRef, []) } // 记得释放授权对象

    let resourcePath = Bundle.main.resourcePath!
    let locBin = resourcePath + "/Tools"
    let destinationPath = "/usr/local/bin"

    // 构造cp命令：递归复制Tools目录下的所有文件到/usr/local/bin
    let cpPath = "/bin/cp"
    let arguments = ["-R", "\(locBin)/.", destinationPath]

    var pid: pid_t = 0
    let status = AuthorizationExecuteWithPrivileges(authorizationRef, cpPath, [], arguments, &pid)
    guard status == errAuthorizationSuccess else {
        throw CompilerError.fileCopyFailed
    }

    // 等待命令执行完成
    var waitStatus: Int32 = 0
    waitpid(pid, &waitStatus, 0)
    guard WIFEXITED(waitStatus) && WEXITSTATUS(waitStatus) == 0 else {
        throw CompilerError.fileCopyFailed
    }
}

方案2：使用posix_spawn执行命令（现代推荐方式） #

AuthorizationExecuteWithPrivileges弃用后，官方推荐用posix_spawn配合授权上下文，安全性更高：

func copyFiles() throws {
    let authorizationRef = try obtainAuthorization()
    defer { AuthorizationFree(authorizationRef, []) }

    let resourcePath = Bundle.main.resourcePath!
    let locBin = resourcePath + "/Tools"
    let destinationPath = "/usr/local/bin"

    let cpPath = "/bin/cp"
    let arguments = [cpPath, "-R", "\(locBin)/.", destinationPath]
    
    var fileActions: posix_spawn_file_actions_t?
    posix_spawn_file_actions_init(&fileActions)
    defer { if let actions = fileActions { posix_spawn_file_actions_destroy(&actions) } }

    var attr: posix_spawnattr_t?
    posix_spawnattr_init(&attr)
    defer { if let a = attr { posix_spawnattr_destroy(&a) } }

    // 应用授权上下文到spawn属性
    let status = AuthorizationApplyAuthorization(authorizationRef, attr)
    guard status == errAuthorizationSuccess else {
        throw obtainAuthorizationError.executionError("Failed to apply authorization")
    }

    var pid: pid_t = 0
    let spawnStatus = posix_spawn(&pid, cpPath, fileActions, attr, arguments.withUnsafeBufferPointer { $0.baseAddress }, environ)
    guard spawnStatus == 0 else {
        throw CompilerError.fileCopyFailed
    }

    var waitStatus: Int32 = 0
    waitpid(pid, &waitStatus, 0)
    guard WIFEXITED(waitStatus) && WEXITSTATUS(waitStatus) == 0 else {
        throw CompilerError.fileCopyFailed
    }
}

修正权限申请函数 #

另外，你需要调整obtainAuthorization函数，针对具体路径申请权限（更符合权限最小化）：

func obtainAuthorization() throws -> AuthorizationRef {
    var authorizationRef: AuthorizationRef?
    var status = AuthorizationCreate(nil, nil, [], &authorizationRef)
    guard status == errAuthorizationSuccess else {
        throw obtainAuthorizationError.executionError("Failed to obtain authorization reference")
    }

    // 针对/usr/local/bin路径申请写入权限
    let targetPath = "/usr/local/bin"
    let pathData = targetPath.data(using: .utf8)!
    let authItem = AuthorizationItem(
        name: "system.files.write",
        valueLength: UInt32(pathData.count),
        value: UnsafeMutableRawPointer(mutating: (pathData as NSData).bytes),
        flags: 0
    )

    var authRights = AuthorizationRights(count: 1, items: &authItem)
    let flags: AuthorizationFlags = [.interactionAllowed, .extendRights, .preAuthorize]
    
    status = AuthorizationCopyRights(authorizationRef!, &authRights, nil, flags, nil)
    guard status == errAuthorizationSuccess else {
        AuthorizationFree(authorizationRef!, [])
        throw obtainAuthorizationError.executionError("Failed to obtain authorization rights")
    }

    return authorizationRef!
}

额外注意事项 #

• 记得在使用完AuthorizationRef后调用AuthorizationFree释放资源，避免内存泄漏。
• 关闭App Sandbox是必须的，否则即使授权也无法访问系统目录。
• 测试时确保目标文件没有被其他进程锁定，否则也会复制失败。

内容的提问来源于stack exchange，提问作者TheOnlyOneHere