This document is a Mac OS X manual page. Manual pages are a command-line technology for providing documentation. You can view these manual pages locally using the man(1) command. These manual pages come from many different sources, and thus, have a variety of writing styles.

For more information about the manual page format, see the manual page for manpages(5).

AUTHOPEN(1)               BSD General Commands Manual              AUTHOPEN(1)

NAME
     authopen -- open file with authorization

SYNOPSIS
     authopen [-stdoutpipe] filename
     authopen [-stdoutpipe] -w [-a] filename
     authopen [-stdoutpipe] -c [-x -m mode -w] filename
     authopen [-stdoutpipe] -o flags filename
     authopen -h

DESCRIPTION
     authopen provides authorization-based file opening services.  In its simplest form, authopen verifies
     that it is allowed to open filename (using an appropriate sys.openfile.* authorization right) and then
     writes the file to stdout.  If -w is specified, authopen will read from stdin and write to the file.

     authopen is designed to be used both from the command line and programmatically.  The -stdoutpipe flag
     allows a parent process to receive an open file descriptor pointing to the file in question.

     Before opening filename, authopen will make an authorization request for a right of the form:

     sys.openfile.[readonly|readwrite|readwritecreate]./fully/qualified/path. `.readonly' rights only allow
     for read-only file descriptors.  `.readwrite' rights allow for read/write file descriptors.
     `.readwritecreate' rights allow for read/write descriptors and the creation of new files.

OPTIONS
      -stdoutpipe specifies that STDOUT_FILENO has been dup2()'d onto a pipe to a parent process and that an
              open file descriptor to filename (with the appropriate access mode) should be sent back across
              it using the SCM_RIGHTS extension to sendmsg(2) rather than having the file itself written to
              or read from stdin / stdout.

      -w      instructs authopen to open filename read/write and truncate it.  If -stdoutpipe has not been
              specified, authopen will then copy stdin to filename until stdin is closed.

      -a      append to filename rather than truncating it (truncating is the default).

      -c      create the file if it doesn't exist.  -m requires -c.

      -m mode specify the mode bits if a file is created.

      -o flags numerically specify the flags that should be passed to open(2).

      -x      require that the file being created not exist.

EXAMPLES
     To replace /etc/hostconfig (assuming sys.openfile.readwrite./etc/hostconfig or better can be obtained):

           $ cat tmpdata | authopen -w /etc/hostconfig

ERRORS
     authopen will fail if an appropriate sys.openfile.readonly.*, sys.openfile.readwrite.*, or
     sys.openfile.readwritecreate.* right cannot be obtained or if the named path does not exist.

BUGS
     authopen should should support prefix path authentication such that the right sys.openfile.*./dev/
     could give access to all /dev entries and sys.openfile.*./dev/disk1 could give access to all
     disk1-related /dev entries.

     authopen should use getopt(3).

SEE ALSO
     open(2), realpath(3), recvmsg(2).

HISTORY
     authopen appeared in Mac OS X 10.1 to enable the manipulation of disk devices at the /dev-entry level.

Darwin                           28 March 2007                          Darwin