[Mac] Add option to reauthenticate the OS user before revealing passwords.

base/mac/authorization_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef BASE_MAC_AUTHORIZATION_UTIL_H_
 #define BASE_MAC_AUTHORIZATION_UTIL_H_
 
 // AuthorizationExecuteWithPrivileges fork()s and exec()s the tool, but it
 // does not wait() for it.  It also doesn't provide the caller with access to
 // the forked pid.  If used irresponsibly, zombie processes will accumulate.
@@ skipping 15 matching lines @@
 #include <CoreFoundation/CoreFoundation.h>
 #include <Security/Authorization.h>
 #include <stdio.h>
 #include <sys/types.h>
 
 #include "base/base_export.h"
 
 namespace base {
 namespace mac {
 
-// Obtains an AuthorizationRef that can be used to run commands as root.  If
-// necessary, prompts the user for authentication.  If the user is prompted,
+// Obtains an AuthorizationRef for the rights indicated by |rights|.  If
+// necessary, prompts the user for authentication. If the user is prompted,
 // |prompt| will be used as the prompt string and an icon appropriate for the
-// application will be displayed in a prompt dialog.  Note that the system
-// appends its own text to the prompt string.  Returns NULL on failure.
+// application will be displayed in a prompt dialog. Note that the system
+// appends its own text to the prompt string. |extraFlags| will be ORed
+// together with the default flags. Returns NULL on failure.
+BASE_EXPORT
+AuthorizationRef GetAuthorizationRightsWithPrompt(
+    AuthorizationRights* rights,
+    CFStringRef prompt,
+    AuthorizationFlags extraFlags);
+
+// Obtains an AuthorizationRef (using |GetAuthorizationRightsWithPrompt|) that
+// can be used to run commands as root.
 BASE_EXPORT
 AuthorizationRef AuthorizationCreateToRunAsRoot(CFStringRef prompt);
 
 // Calls straight through to AuthorizationExecuteWithPrivileges.  If that
 // call succeeds, |pid| will be set to the pid of the executed tool.  If the
 // pid can't be determined, |pid| will be set to -1.  |pid| must not be NULL.
 // |pipe| may be NULL, but the tool will always be executed with a pipe in
 // order to read the pid from its stdout.
 BASE_EXPORT
 OSStatus ExecuteWithPrivilegesAndGetPID(AuthorizationRef authorization,
@@ skipping 13 matching lines @@
                                       const char* tool_path,
                                       AuthorizationFlags options,
                                       const char** arguments,
                                       FILE** pipe,
                                       int* exit_status);
 
 }  // namespace mac
 }  // namespace base
 
 #endif  // BASE_MAC_AUTHORIZATION_UTIL_H_