如何在macOS Swift应用中以管理员权限写入hosts文件？

嘿，这个问题我太熟了！/etc/hosts是系统级的受保护文件，普通用户权限根本碰不了，所以你直接用write(to:)肯定会报错。要搞定这个，得让你的App获得管理员权限，下面给你两种靠谱的实现方式：

方法一：用Security框架的AuthorizationServices（原生系统授权） #

这种方式更贴合macOS的权限模型，会弹出系统标准的权限请求对话框，体验更统一。首先你需要导入Security框架，然后用下面的代码：

import Security

func writeToHosts(with newEntry: String) {
    let hostsPath = "/etc/hosts"
    // 创建授权引用
    let authRefPtr = UnsafeMutablePointer<AuthorizationRef?>.allocate(capacity: 1)
    var authStatus = AuthorizationCreate(nil, nil, [], authRefPtr)
    
    guard authStatus == errAuthorizationSuccess, let authRef = authRefPtr.pointee else {
        print("Failed to initialize authorization reference")
        authRefPtr.deallocate()
        return
    }
    
    // 请求执行权限
    var authItem = AuthorizationItem(name: kAuthorizationRightExecute, valueLength: 0, value: nil, flags: 0)
    let authRights = AuthorizationRights(count: 1, items: &authItem)
    let authFlags: AuthorizationFlags = [.interactionAllowed, .extendRights, .preAuthorize]
    
    authStatus = AuthorizationCopyRights(authRef, &authRights, nil, authFlags, nil)
    
    if authStatus == errAuthorizationSuccess {
        do {
            // 先读取原有hosts内容，避免覆盖
            var currentContent = try String(contentsOfFile: hostsPath, encoding: .utf8)
            currentContent += "\n\(newEntry)"
            
            // 用授权后的权限打开并写入文件
            let hostsURL = URL(fileURLWithPath: hostsPath)
            guard let contentData = currentContent.data(using: .utf8) else {
                print("Failed to convert content to data")
                return
            }
            
            var fileDescriptor: Int32 = -1
            authStatus = AuthorizationOpenFile(authRef, hostsURL.path, O_WRONLY | O_TRUNC, &fileDescriptor)
            
            if authStatus == errAuthorizationSuccess {
                write(fileDescriptor, contentData.bytes, contentData.count)
                close(fileDescriptor)
                print("Successfully updated hosts file!")
            } else {
                print("Failed to open hosts file with elevated permissions")
            }
        } catch {
            print("Error reading existing hosts content: \(error.localizedDescription)")
        }
    } else {
        print("Authorization denied or failed (status code: \(authStatus))")
    }
    
    // 释放授权引用
    AuthorizationFree(authRef, [])
    authRefPtr.deallocate()
}

// 调用示例：添加一条新的hosts条目
writeToHosts(with: "127.0.0.1 facebook.com")

这个流程的核心是通过AuthorizationCopyRights向系统请求管理员权限，用户输入密码后，就能用AuthorizationOpenFile打开受保护的hosts文件并写入内容了。

方法二：用Process调用sudo命令（更简单快速） #

如果你想要快速实现，也可以直接调用系统的sudo命令，让用户输入密码后执行写入操作。这种方式会弹出终端风格的密码输入框，代码更简洁：

func appendToHosts(with entry: String) {
    let task = Process()
    let outputPipe = Pipe()
    
    // 配置要执行的sudo命令：追加内容到hosts文件
    task.executableURL = URL(fileURLWithPath: "/usr/bin/sudo")
    // 注意转义特殊字符，这里用sh -c来包裹命令确保格式正确
    task.arguments = ["/bin/sh", "-c", "echo '\(entry)' >> /etc/hosts"]
    task.standardOutput = outputPipe
    task.standardError = outputPipe
    
    do {
        try task.run()
        // 读取命令的输出和错误信息
        let outputData = outputPipe.fileHandleForReading.readDataToEndOfFile()
        if let outputStr = String(data: outputData, encoding: .utf8) {
            print("Command output: \(outputStr)")
        }
        task.waitUntilExit()
        
        if task.terminationStatus == 0 {
            print("Successfully added entry to hosts file!")
        } else {
            print("Failed to modify hosts file — check your password or try again.")
        }
    } catch {
        print("Error running sudo task: \(error.localizedDescription)")
    }
}

// 调用示例
appendToHosts(with: "127.0.0.1 facebook.com")

一些重要提醒 #

• 不管用哪种方法，都要优先读取原有hosts内容再追加，不要直接覆盖，避免丢失用户的原有配置。
• 如果你的App开启了沙箱，可能需要在Capabilities里配置相应的权限，或者暂时关闭沙箱进行测试（发布时要注意沙箱规则）。
• 一定要做好错误处理：比如用户拒绝授权、密码输入错误、文件读取失败等情况，都要给用户清晰的提示。

内容的提问来源于stack exchange，提问作者Guy