Why Awake's helper is a LaunchDaemon and not a sudoers rule
awake1 min read
The whole point of the app is asking for a password once instead of every time. Only one of the two options survives a reboot, and that decides it.
Stopping a Mac from sleeping means calling pmset, and pmset needs root.
The goal was to ask for a password once, not on every toggle.
The alternative
A sudoers rule scoped to the two pmset invocations. It is the common
answer, it is one file, and it works.
It also has to be installed with a password prompt anyway, and — the part that settles it — it grants the capability to any invocation of that command, from anywhere, forever, with no process of our own in the middle.
What it is instead
A LaunchDaemon. It is installed once while already root (sudo make install,
so no extra prompt), it survives reboots, and it is the only thing in the app
that ever calls pmset — with fixed arguments and no payload from the caller.
The limitation I will state rather than hide
The app talks to the helper over notify(3), and those channels are global
and unauthenticated: any process on the machine can post com.awake.on. What
that grants is exactly one thing — toggling disablesleep — because the events
carry no arguments and the helper's command line is fixed.
That is the same capability surface as the password-less sudoers rule I just argued against. The difference is not the surface; it is that this version survives a reboot, which is the feature.