[Mac] Add option to reauthenticate the OS user before revealing passwords.

base/mac/authorization_util.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/mac/authorization_util.h"
 
 #import <Foundation/Foundation.h>
 #include <sys/wait.h>
 
 #include <string>
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/mac/bundle_locations.h"
 #include "base/mac/mac_logging.h"
 #import "base/mac/mac_util.h"
 #include "base/mac/scoped_authorizationref.h"
 #include "base/posix/eintr_wrapper.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 
 namespace base {
 namespace mac {
 
-AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt) {
+AuthorizationRef GetAuthorizationRightsWithPrompt(
+    AuthorizationRights* rights,
+    CFStringRef prompt,
+    AuthorizationFlags extraFlags) {
   // Create an empty AuthorizationRef.
   ScopedAuthorizationRef authorization;
   OSStatus status = AuthorizationCreate(NULL,
                                         kAuthorizationEmptyEnvironment,
                                         kAuthorizationFlagDefaults,
                                         &authorization);
   if (status != errAuthorizationSuccess) {
     OSSTATUS_LOG(ERROR, status) << "AuthorizationCreate";
     return NULL;
   }
 
-  // Specify the "system.privilege.admin" right, which allows
-  // AuthorizationExecuteWithPrivileges to run commands as root.
-  AuthorizationItem right_items[] = {
-    {kAuthorizationRightExecute, 0, NULL, 0}
-  };
-  AuthorizationRights rights = {arraysize(right_items), right_items};
+  AuthorizationFlags flags = kAuthorizationFlagDefaults |
+                             kAuthorizationFlagInteractionAllowed |
+                             kAuthorizationFlagExtendRights |
+                             kAuthorizationFlagPreAuthorize |
+                             extraFlags;
 
   // product_logo_32.png is used instead of app.icns because Authorization
   // Services can't deal with .icns files.
   NSString* icon_path =
       [base::mac::FrameworkBundle() pathForResource:@"product_logo_32"
                                              ofType:@"png"];
   const char* icon_path_c = [icon_path fileSystemRepresentation];
   size_t icon_path_length = icon_path_c ? strlen(icon_path_c) : 0;
 
   // The OS will append " Type an administrator's name and password to allow
   // <CFBundleDisplayName> to make changes."
   NSString* prompt_ns = base::mac::CFToNSCast(prompt);
   const char* prompt_c = [prompt_ns UTF8String];
   size_t prompt_length = prompt_c ? strlen(prompt_c) : 0;
 
   AuthorizationItem environment_items[] = {
     {kAuthorizationEnvironmentIcon, icon_path_length, (void*)icon_path_c, 0},
     {kAuthorizationEnvironmentPrompt, prompt_length, (void*)prompt_c, 0}
   };
 
   AuthorizationEnvironment environment = {arraysize(environment_items),
                                           environment_items};
 
-  AuthorizationFlags flags = kAuthorizationFlagDefaults |
-                             kAuthorizationFlagInteractionAllowed |
-                             kAuthorizationFlagExtendRights |
-                             kAuthorizationFlagPreAuthorize;
-
   status = AuthorizationCopyRights(authorization,
-                                   &rights,
+                                   rights,
                                    &environment,
                                    flags,
                                    NULL);
+
   if (status != errAuthorizationSuccess) {
     if (status != errAuthorizationCanceled) {
       OSSTATUS_LOG(ERROR, status) << "AuthorizationCopyRights";
     }
     return NULL;
   }
 
   return authorization.release();
 }
 
+AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt) {
+  // Specify the "system.privilege.admin" right, which allows
+  // AuthorizationExecuteWithPrivileges to run commands as root.
+  AuthorizationItem right_items[] = {
+    {kAuthorizationRightExecute, 0, NULL, 0}
+  };
+  AuthorizationRights rights = {arraysize(right_items), right_items};
+
+  return GetAuthorizationRightsWithPrompt(&rights, prompt, 0);
+}
+
 OSStatus ExecuteWithPrivilegesAndGetPID(AuthorizationRef authorization,
                                         const char* tool_path,
                                         AuthorizationFlags options,
                                         const char** arguments,
                                         FILE** pipe,
                                         pid_t* pid) {
   // pipe may be NULL, but this function needs one.  In that case, use a local
   // pipe.
   FILE* local_pipe;
   FILE** pipe_pointer;
@@ skipping 82 matching lines @@
     }
   } else {
     *exit_status_pointer = -1;
   }
 
   return status;
 }
 
 }  // namespace mac
 }  // namespace base