fixed: Bug #3927 - Mavericks accessibility exception not working (when upgrading from 1.4.15 to 1.4.16)

ext/toolchain/commands1.py

@@ -41,7 +41,7 @@ class Toolchain:
 	cmd_opt_dict = {
 		'about'     : ['', []],
 		'setup'     : ['g:', ['generator=']],
-		'configure' : ['g:dr', ['generator=', 'debug', 'release', 'mac-sdk=']],
+		'configure' : ['g:dr', ['generator=', 'debug', 'release', 'mac-sdk=', 'mac-identity=']],
 		'build'     : ['dr', ['debug', 'release']],
 		'clean'     : ['dr', ['debug', 'release']],
 		'update'    : ['', []],
@@ -57,7 +57,7 @@ class Toolchain:
 		'genlist'   : ['', []],
 		'reset'	    : ['', []],
 		'signwin'	: ['', ['pfx=', 'pwd=', 'dist']],
-		'signmac'	: ['', ['identity=']]
+		'signmac'	: ['', []]
 	}
 
 	# aliases to valid commands
@@ -244,6 +244,9 @@ class InternalCommands:
 	# by default, unknown
 	macSdk = None
 	
+	# by default, unknown
+	macIdentity = None
+	
 	# cryptoPP dir with version number
 	cryptoPPDir = 'cryptopp562'
 	
@@ -384,14 +387,31 @@ class InternalCommands:
 		self.ensure_setup_latest()
 		
 		if sys.platform == "darwin":
+			config = self.getConfig()
+		
 			if self.macSdk:
+				config.set('hm', 'macSdk', self.macSdk)
+			elif config.has_option("hm", "macSdk"):
+				self.macSdk = config.get('hm', 'macSdk')
+		
+			if self.macIdentity:
+				config.set('hm', 'macIdentity', self.macIdentity)
+			elif config.has_option("hm", "macIdentity"):
+				self.macIdentity = config.get('hm', 'macIdentity')
+		
+			self.write_config(config)
+		
+			if not self.macSdk:
+				raise Exception("Arg missing: --mac-sdk <version>");
+				
+			if not self.macIdentity:
+				raise Exception("Arg missing: --mac-identity <name>");
+			
 			sdkDir = self.getMacSdkDir()
 			if not os.path.exists(sdkDir):
 				raise Exception("Mac SDK not found at: " + sdkDir)
 			
 			os.environ["MACOSX_DEPLOYMENT_TARGET"] = self.macSdk
-			else:
-				raise Exception("Arg missing: --mac-sdk <version>");
 		
 		# default is release
 		if target == '':
@@ -435,11 +455,6 @@ class InternalCommands:
 			cmake_args += " -DCMAKE_OSX_SYSROOT=" + sdkDir
 			cmake_args += " -DCMAKE_OSX_DEPLOYMENT_TARGET=" + self.macSdk
 		
-			# store the sdk version for the build command
-			config = self.getConfig()
-			config.set('cmake', 'mac_sdk', self.macSdk)
-			self.write_config(config)
-		
 		# if not visual studio, use parent dir
 		sourceDir = generator.getSourceDir()
 
@@ -464,6 +479,11 @@ class InternalCommands:
 		if generator.cmakeName.find('Eclipse') != -1:
 			self.fixCmakeEclipseBug()
 
+		# manually change .xcodeproj to add code sign for
+		# synmacph project and specify its info.plist
+		if generator.cmakeName.find('Xcode') != -1:
+			self.fixXcodeProject(target)
+			
 		if err != 0:
 			raise Exception('CMake encountered error: ' + str(err))
 
@@ -538,6 +558,59 @@ class InternalCommands:
 		file.truncate()
 		file.close()
 
+	def fixXcodeProject(self, target):
+		print "Fixing Xcode project..."
+		
+		insertContent = (
+			"CODE_SIGN_IDENTITY = '%s';\n"
+			"INFOPLIST_FILE = %s/src/cmd/synmacph/Info.plist;\n") % (
+			self.macIdentity,
+			os.getcwd()
+		)
+		
+		dir = self.getBuildDir(target)
+		file = open(dir + '/synergy.xcodeproj/project.pbxproj', 'r+')
+		contents = file.readlines()
+		
+		buildConfigurationsFound = None
+		releaseConfigRefFound = None
+		releaseBuildSettingsFound = None
+		fixed = None
+		releaseConfigRef = "";
+		
+		for line in contents:
+			if buildConfigurationsFound:
+				matchObj = re.search(r'\s*(.*)\s*\/\*\s*Release\s*\*\/,', line, re.I)
+				if matchObj:
+					releaseConfigRef = matchObj.group(1)
+					releaseConfigRefFound = True
+					break
+			elif buildConfigurationsFound == None:
+				if 'PBXNativeTarget "synmacph" */ = {' in line:
+					buildConfigurationsFound = True
+		
+		if not releaseConfigRefFound:
+			raise Exception("Release config ref not found.")
+		
+		for n, line in enumerate(contents):
+			if releaseBuildSettingsFound == None:
+				if releaseConfigRef + '/* Release */ = {' in line:
+					releaseBuildSettingsFound = True
+			elif fixed == None:
+				if 'buildSettings = {' in line:
+					contents[n] = line + insertContent
+					fixed = True
+		
+		if not fixed:
+			raise Exception("Xcode project was not fixed.")
+		
+		file.seek(0)
+		for line in contents:
+			file.write(line)
+		file.truncate()
+		file.close()
+		return
+				
 	def persist_cmake(self):
 		# even though we're running `cmake --version`, we're only doing this for the 0 return
 		# code; we don't care about the version, since CMakeLists worrys about this for us.
@@ -610,6 +683,8 @@ class InternalCommands:
 	
 		self.ensure_setup_latest()
 		
+		self.loadConfig()
+
 		# allow user to skip core compile
 		if self.enableMakeCore:
 			self.makeCore(targets)
@@ -618,13 +693,20 @@ class InternalCommands:
 		if self.enableMakeGui:
 			self.makeGui(targets)
 	
+	def loadConfig(self):
+		config = self.getConfig()
+		
+		if config.has_option("hm", "macSdk"):
+			self.macSdk = config.get("hm", "macSdk")
+		
+		if config.has_option("hm", "macIdentity"):
+			self.macIdentity = config.get("hm", "macIdentity")
+	
 	def makeCore(self, targets):
 	
 		generator = self.getGeneratorFromConfig().cmakeName
 		
-		config = self.getConfig()
+		if self.macSdk:
-		if config.has_option("cmake", "mac_sdk"):
-			self.macSdk = config.get("cmake", "mac_sdk")
 			os.environ["MACOSX_DEPLOYMENT_TARGET"] = self.macSdk
 
 		if generator.find('Unix Makefiles') != -1:
@@ -687,6 +769,11 @@ class InternalCommands:
 			shutil.copy(targetDir + "/synergys", bundleBinDir)
 			shutil.copy(targetDir + "/syntool", bundleBinDir)
 			
+			launchServicesDir = dir + "/Synergy.app/Contents/Library/LaunchServices/"
+			if not os.path.exists(launchServicesDir):
+				os.makedirs(launchServicesDir)
+			shutil.copy(targetDir + "/synmacph", launchServicesDir)
+
 		if self.enableMakeGui:
 			# use qt to copy libs to bundle so no dependencies are needed. do not create a
 			# dmg at this point, since we need to sign it first, and then create our own
@@ -715,10 +802,14 @@ class InternalCommands:
 							frameworkRootDir + "/" + dir + "/Contents/Info.plist",
 							target + "/" + dir + "/Resources/")
 	
-	def signmac(self, identity):
+	def signmac(self):
+		self.loadConfig()
+		if not self.macIdentity:
+			raise Exception("run config with --mac-identity")
+		
 		self.try_chdir("bin")
 		err = os.system(
-			'codesign --deep -fs "' + identity + '" Synergy.app')
+			'codesign --deep -fs "' + self.macIdentity + '" Synergy.app')
 		self.restore_chdir()
 
 		if err != 0:
@@ -1623,6 +1714,8 @@ class CommandHandler:
 				self.qtDir = a
 			elif o == '--mac-sdk':
 				self.ic.macSdk = a
+			elif o == '--mac-identity':
+				self.ic.macIdentity = a
 	
 	def about(self):
 		self.ic.about()
@@ -1721,9 +1814,4 @@ class CommandHandler:
 		self.ic.signwin(pfx, pwd, dist)
 
 	def signmac(self):
-		idenity = None
+		self.ic.signmac()
-		for o, a in self.opts:
-			if o == '--identity':
-				identity = a
-		
-		self.ic.signmac(identity)

src/cmd/CMakeLists.txt

@@ -23,3 +23,7 @@ add_subdirectory(syntool)
 if (WIN32)
   add_subdirectory(synergyp)
 endif()
+
+if (APPLE)
+	add_subdirectory(synmacph)
+endif()

src/cmd/synmacph/CMakeLists.txt

@@ -0,0 +1,39 @@
+# synergy -- mouse and keyboard sharing utility
+# Copyright (C) 2014 Bolton Software Ltd.
+# 
+# This package is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# found in the file COPYING that should have accompanied this file.
+# 
+# This package is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+file(GLOB sources "*.c" "*.plist")
+
+include_directories(
+	../
+)
+
+add_executable(synmacph ${sources})
+
+get_target_property(current_property synmacph LINK_FLAGS)
+
+set(OTHER_LINK_FLAGS "-sectcreate __TEXT __info_plist ${root_dir}/src/cmd/synmacph/Info.plist -sectcreate __TEXT __launchd_plist ${root_dir}/src/cmd/synmacph/Launchd.plist")
+
+if (NOT ${current_property})
+	set_target_properties(synmacph PROPERTIES LINK_FLAGS ${OTHER_LINK_FLAGS})
+endif()
+
+target_link_libraries(synmacph)
+
+if (CONF_CPACK)
+	install(TARGETS
+		synmacph
+		COMPONENT core
+		DESTINATION bin)
+endif()

src/cmd/synmacph/Info.plist

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleIdentifier</key>
+	<string>synmacph</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>synmacph</string>
+	<key>CFBundleVersion</key>
+	<string>1.5</string>
+	<key>SMAuthorizedClients</key>
+	<array>
+		<string>anchor apple generic and identifier &quot;synergy&quot; and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = SP58PFWX5L)</string>
+	</array>
+</dict>
+</plist>

src/cmd/synmacph/Launchd.plist

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>synmacph</string>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>LaunchOnlyOnce</key>
+	<true/>
+	<key>KeepAlive</key>
+	<false/>
+</dict>
+</plist>

src/cmd/synmacph/synmacph.c

@@ -0,0 +1,34 @@
+/*
+ * synergy -- mouse and keyboard sharing utility
+ * Copyright (C) 2014 Bolton Software Ltd.
+ *
+ * This package is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * found in the file COPYING that should have accompanied this file.
+ *
+ * This package is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <syslog.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main(int argc, const char * argv[])
+{
+    #pragma unused(argc)
+    #pragma unused(argv)
+
+	system("sudo sqlite3 /Library/Application\\ Support/com.apple.TCC/TCC.db 'delete from access where client like \"%Synergy.app%\"'");
+	
+	(void) sleep(10);
+	
+	return EXIT_SUCCESS;
+}
+

src/gui/gui.pro

@@ -73,13 +73,17 @@ HEADERS += src/MainWindow.h \
 RESOURCES += res/Synergy.qrc
 RC_FILE = res/win/Synergy.rc
 macx {
+	HEADERS += src/AXDatabaseCleaner.h
+	OBJECTIVE_SOURCES += src/AXDatabaseCleaner.mm
 	QMAKE_INFO_PLIST = res/mac/Info.plist
     TARGET = Synergy
     QSYNERGY_ICON.files = res/mac/Synergy.icns
     QSYNERGY_ICON.path = Contents/Resources
     QMAKE_BUNDLE_DATA += QSYNERGY_ICON
-    LIBS += -framework \
+    LIBS += -framework ApplicationServices \
-        ApplicationServices
+		-framework ServiceManagement \
+		-framework Security \
+		-framework cocoa
 }
 debug { 
     OBJECTS_DIR = tmp/debug

src/gui/res/mac/Info.plist

@@ -12,5 +12,10 @@
 	<string>Synergy</string>
 	<key>CFBundleIdentifier</key>
 	<string>synergy</string>
+	<key>SMPrivilegedExecutables</key>
+	<dict>
+		<key>synmacph</key>
+		<string>anchor apple generic and identifier &quot;synmacph&quot; and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = SP58PFWX5L)</string>
+	</dict>
 </dict>
 </plist>

src/gui/src/AXDatabaseCleaner.h

@@ -0,0 +1,30 @@
+/*
+ * synergy -- mouse and keyboard sharing utility
+ * Copyright (C) 2014 Bolton Software Ltd.
+ *
+ * This package is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * found in the file COPYING that should have accompanied this file.
+ *
+ * This package is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+class AXDatabaseCleaner {
+public:
+	AXDatabaseCleaner();
+	~AXDatabaseCleaner();
+
+	void loadPrivilegeHelper();
+
+private:
+	class Private;
+	Private* d;
+};

src/gui/src/AXDatabaseCleaner.mm

@@ -0,0 +1,78 @@
+/*
+ * synergy -- mouse and keyboard sharing utility
+ * Copyright (C) 2014 Bolton Software Ltd.
+ *
+ * This package is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * found in the file COPYING that should have accompanied this file.
+ *
+ * This package is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#import "AXDatabaseCleaner.h"
+#import <Cocoa/Cocoa.h>
+#import <ServiceManagement/ServiceManagement.h>
+#import <Security/Authorization.h>
+
+const NSString* const label = @"synmacph";
+
+class AXDatabaseCleaner::Private {
+public:
+	NSAutoreleasePool*	autoReleasePool;
+	AuthorizationRef	authRef;
+};
+
+AXDatabaseCleaner::AXDatabaseCleaner()
+{
+	d = new Private;
+
+	d->autoReleasePool = [[NSAutoreleasePool alloc] init];
+}
+
+AXDatabaseCleaner::~AXDatabaseCleaner()
+{
+	[d->autoReleasePool release];
+	delete d;
+}
+
+void AXDatabaseCleaner::loadPrivilegeHelper()
+{
+	OSStatus status = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &d->authRef);
+	if (status != errAuthorizationSuccess) {
+		assert(NO);
+		d->authRef = NULL;
+	}
+
+	AuthorizationItem authItem = {kSMRightBlessPrivilegedHelper, 0, NULL, 0};
+	AuthorizationRights authRights = {1, &authItem};
+	AuthorizationFlags flags = kAuthorizationFlagDefaults
+		| kAuthorizationFlagInteractionAllowed
+		| kAuthorizationFlagPreAuthorize
+		| kAuthorizationFlagExtendRights;
+
+	BOOL result = NO;
+	NSError* error = nil;
+
+	status = AuthorizationCopyRights(d->authRef, &authRights, kAuthorizationEmptyEnvironment, flags, NULL);
+	if (status != errAuthorizationSuccess) {
+		error = [NSError errorWithDomain:NSOSStatusErrorDomain code:status userInfo:nil];
+	}
+	else {
+		CFErrorRef cfError;
+		result = (BOOL)SMJobBless(kSMDomainSystemLaunchd, (CFStringRef)label, d->authRef, &cfError);
+
+		if (!result) {
+			error = CFBridgingRelease(cfError);
+		}
+	}
+
+	if (!result) {
+		assert(error != nil);
+		NSLog(@"bless error: domain= %@ / code= %d", [error domain], (int) [error code]);
+	}
+}

src/gui/src/main.cpp

@@ -31,6 +31,7 @@
 
 #if defined(Q_OS_MAC)
 #include <Carbon/Carbon.h>
+#include "AXDatabaseCleaner.h"
 #endif
 
 class QThreadImpl : public QThread
@@ -136,11 +137,24 @@ bool checkMacAssistiveDevices()
 	// show up there automatically, but will be unchecked.
 
 	const void* keys[] = { kAXTrustedCheckOptionPrompt };
-	const void* values[] = { kCFBooleanTrue };
+	const void* falseValue[] = { kCFBooleanFalse };
+	const void* trueValue[] = { kCFBooleanTrue };
 
-	CFDictionaryRef options = CFDictionaryCreate(NULL, keys, values, 1, NULL, NULL);
+	CFDictionaryRef optionsWithoutPrompt = CFDictionaryCreate(NULL, keys, falseValue, 1, NULL, NULL);
-	bool result = AXIsProcessTrustedWithOptions(options);
+	CFDictionaryRef optionsWithPrompt = CFDictionaryCreate(NULL, keys, trueValue, 1, NULL, NULL);
-	CFRelease(options);
+	bool result;
+
+	result = AXIsProcessTrustedWithOptions(optionsWithoutPrompt);
+	if (!result) {
+		// call privilege help tool
+		AXDatabaseCleaner axdc;
+		axdc.loadPrivilegeHelper();
+
+		result = AXIsProcessTrustedWithOptions(optionsWithPrompt);
+	}
+
+	CFRelease(optionsWithoutPrompt);
+	CFRelease(optionsWithPrompt);
 
 	return result;