$ show SAP/macOS-enterprise-privileges
SAP Privileges is a native macOS enterprise utility that grants standard users temporary administrator rights on demand, with automatic expiration and policy-driven revocation. The application is implemented in Objective-C and is composed of multiple cooperating processes: a main GUI app, a menu bar agent, a privileged launch daemon, an XPC service, a helper tool for system extension management, an Endpoint Security system extension for self-protection, a CLI tool, and a Dock tile plugin. The actual privilege change is performed by the daemon using Collaboration Services to add or remove the current console user from the admin group, while the system extension protects the app's files and launchd jobs from tampering. Configuration is driven by NSUserDefaults and can be forced via MDM configuration profiles, supporting expiration intervals, authentication requirements (biometric, password, smartcard), renewal, revocation on login/lock/time change, and remote logging via RFC 5424 syslog or JSON webhooks.
The LLM identified 5 files worth highlighting for reuse:
Builds RFC 5424-compliant syslog messages with structured data elements and proper framing. This is a self-contained, standards-based logging component that can be extracted into any macOS or Unix project needing interoperable syslog emission.
Sends JSON events to a configurable webhook endpoint with optional client certificate authentication. The class is isolated and demonstrates a clean pattern for authenticated outbound HTTP callbacks, reusable for audit or notification pipelines.
Constructs and validates code signing requirements using SecTaskValidateForRequirement. This is a critical security primitive for verifying the identity of connecting processes in XPC/IPC boundaries, and it is generic enough to be reused in any macOS privileged helper or daemon design.
A generic NSXPCConnection wrapper that handles endpoint discovery, sandbox-aware connection setup, and invalidation/interruption callbacks. It encapsulates a recurring macOS multi-process pattern and can be adapted for other XPC-based architectures with minimal changes.
Validates process ancestry and code-signing identity to authorize Endpoint Security events. This demonstrates a robust pattern for tamper-proofing macOS system extensions and is reusable for any security tool that needs to verify the legitimacy of processes before acting on system events.