Passwordless Root helper

Passwordless Root helper

Passwordless Root is an optional helper that lets SDTally measure as root without asking for the administrator password every time. This page explains what it is, what it can and cannot do, and its known limits. To report a problem, see SECURITY.md.

What it is

Executable	SDTally.app/Contents/MacOS/SDTallyHelper
Type	LaunchDaemon registered by the app with SMAppService
Launchd label and Mach service	io.github.guiselig.sdtally.helper
Plist	SDTally.app/Contents/Library/LaunchDaemons/io.github.guiselig.sdtally.helper.plist
Started	On demand, when the app connects. Exits about 10 seconds after the last connection closes and nothing is running
Source	app/Sources/SDTallyHelper/main.swift, contract in app/Sources/SDTallyXPC/HelperXPC.swift

Install, approve, remove

1. Settings > Passwordless Root > Install…, then confirm.
2. macOS requires approval: click Open Login Items and allow SDTally.
3. The state becomes Active.

Remove it at any time with Settings > Remove or Measurement > Remove Passwordless Root. Remove it before deleting the app.

It only works when the app is signed with an Apple-issued certificate that has a Team ID (for example Apple Development). An ad hoc signed build cannot register it, and if the helper finds itself without a Team ID it serves no one and exits.

What it can do

The XPC interface has exactly four calls, none of which take arguments from the app:

Call	Effect
medir	Runs sdtally --json once and returns its JSON
parar	Stops the running measurement (SIGINT; sdtally returns a partial report)
iniciarAuto	Starts sdtally --auto and hands the app the read end of its output
pararAuto	Stops Automatic (closes its stdin; SIGTERM after 5 seconds if it has not exited)

That is all. It cannot run any other program, any other arguments, or any shell command. It never deletes or modifies user data. Its only deletion is the temporary folder it created for its own copy of sdtally.

How it decides whom to trust

Who may connect:

• The listener has a code signing requirement: the client must be io.github.guiselig.sdtally, signed with a certificate issued by Apple (anchor apple generic), with the same Team ID as the helper (certificate leaf[subject.OU]).
• The connecting user must be in the admin group. Other users are refused. This matches the password path, which already required an administrator.
• The Team ID is read from the helper's own running code, after checking it against the file on disk, so a helper executable replaced after launch is not trusted.

Which binary runs:

The sdtally inside the app bundle lives in a folder the user can write to. So the helper never runs it in place. Each time it:

1. creates a new folder with permissions 0700 owned by root,
2. copies Contents/Helpers/sdtally into it,
3. refuses the copy if it is not a regular file (for example a symlink),
4. makes it 0500,
5. verifies the copy's signature: identifier io.github.guiselig.sdtally.cli, Apple-issued certificate, same Team ID, all architectures, strict validation,
6. executes that verified copy, so nothing can swap it between the check and the execution,
7. deletes the temporary folder afterwards.

For whom it measures:

The user comes from the XPC connection's audit token, not from anything the app sends. The helper sets SUDO_USER and SUDO_UID to that user, as sudo would, so sdtally measures that person's home folder. PATH is fixed to /usr/bin:/bin:/usr/sbin:/sbin.

Concurrency and lifetime:

• One full measurement at a time, from any client. A stop that arrives before the process starts is remembered.
• One Automatic process at a time; a new request closes the previous one.
• If the app's connection drops, its measurement and its Automatic process are stopped. Nothing is left running orphaned.

Known limitations

These are stated in the helper's own source and are not fixed yet:

• The trust anchor is "signed by the owner's team". If the Apple Development certificate is in the user's own keychain, a program running as that user that can use the private key could sign a fake sdtally and get root through the helper.
• The bundle may be writable by the user. The copy-and-verify step closes the window between checking and running, but it does not change who can produce a validly signed binary.
• What proper distribution would need: Developer ID signing, the app in a root-owned location (/Applications), and a check that the bundle is not writable by the user.
• Automatic with root (Settings > Advanced) keeps a root process running while the app is open, and anyone using that login session can see the sizes of other users' folders.

Should I install it?

• If you run a full measurement once in a while, typing the password is enough. You do not need the helper.
• If you want frequent full measurements, the ability to stop one midway, or Automatic with root, install it on a Mac and account that are only yours.
• If other people or untrusted software run under your account, do not install it.

Without the helper, a full measurement uses osascript with with administrator privileges: macOS asks for the password and runs one sdtally --json as root.