AuthorizationMBS pmset error

Extras
1

I try to wake up a sleeping Mac on a certain time.
I does not, and when manually awaken it says access denied with error code -60005.
What should I do differently?
Here is the code:

var a as new AuthorizationMBS
var d,t,s(2) as string
var e as integer

s(0) = “schedule”
s(1) = “wake”
d = right(zeros+str(dt.Month),2)+“/”+right(zeros+str(dt.Day),2)+“/”+right(str(dt.Year),4)
t = right(zeros+str(pHour),2)+“:”+right(zeros+str(pMinute),2)+“:”+right(zeros+str(pSecond),2)
s(2) = gf+d+" "+t+gf

if a.SimpleNewAuthorization then ’ create

a.Execute(“/usr/bin/pmset”,s,true) ’ and run it

if a.LastError <> 0 then
MsgBox "Lasterror on Execute: "+str(a.LastError)
else
e = a.Wait ’ wait for process to terminate. Returns PID
if a.LastError <> 0 then
MsgBox "Lasterror on Wait: "+str(a.LastError)
end
end
msgbox a.ReadStream(1024)
end

2

So I start with a basic snippet to run

dim s() as String
dim p,t as String
dim a as AuthorizationMBS
dim e as integer

p = "/usr/bin/whoami"

a=new AuthorizationMBS

if a.SimpleNewAuthorization then // create
  System.DebugLog "SimpleNewAuthorization "+a.LastError.ToString
  
  a.Execute(p,s,true) // and run it
  System.DebugLog "Execute "+a.LastError.ToString
  
  if a.LastError<>0 then
    MsgBox "Lasterror on Execute: "+str(a.LastError)
  else
    e=a.Wait // wait for process to terminate. Returns PID
    System.DebugLog "Wait "+a.LastError.ToString
    
  end if
  EditField3.text=a.ReadStream(1024)
end if

and I modify it to run pmset:

dim s() as String
dim p,t as String
dim a as AuthorizationMBS
dim e as integer

p = "/usr/bin/pmset"
s.Append "schedule"
s.Append "wake"
s.Append "06/12/2025 09:00:00"

a=new AuthorizationMBS

if a.SimpleNewAuthorization then // create
  System.DebugLog "SimpleNewAuthorization "+a.LastError.ToString
  
  a.Execute(p,s,true) // and run it
  System.DebugLog "Execute "+a.LastError.ToString
  
  if a.LastError<>0 then
    MsgBox "Lasterror on Execute: "+str(a.LastError)
  else
    e=a.Wait // wait for process to terminate. Returns PID
    System.DebugLog "Wait "+a.LastError.ToString
    
  end if
  EditField3.text=a.ReadStream(1024)
end if

Seems to work as “pmset -g sched” lists it on the Terminal now.

Maybe it’s just the gf you add for extra quotes, which prevents it from working?

3

I tried with gf = “” (hence no Gänsefüsschen) as in the example I read somewhere.
Nevertheless, same problem occurs: it does not trigger, and when manually awaken it presents error code -60005… And a.readstream is empty.

4

If I try it in Terminal:
sudo pmset schedule wake “06/12/25 17:01:00”
it works.
Under Xojo there is still this password? problem…

5

Christian, can you tell me what error code -60005 means in this plug-in?

6

Sorry, Christian, found out it is a MacOs problem. In Console I see this below. Any suggestion?

error 11:23:53.121488+0100 iAlarmClock parent received status=-60005

error 11:24:00.663640+0100 iAlarmClock AddInstanceForFactory: No factory registered for id <CFUUID 0x600002614540> F8BB1C28-BAE8-11D6-9C31-00039315CD46
error 11:24:00.728372+0100 iAlarmClock MEMixerChannel.cpp:1636 client <AudioQueueObject@0x7fd3f61a5800; [0]; play> got error 2003332927 while sending format information

7 
	errAuthorizationDenied                  = -60005, /* The authorization was denied. */

so just denied.

8

OK, thanks, I know. But why? Running from Terminal it works, from my App it doesn’t.

Do I need authoirze my app in Privacy somewhere??

9

Depending on what you’re attempting to do, I’m wondering if you may need entitlements in your Desktop app?

1 Like
10

You mean something in App Wrapper, or just in the IDE?

11

Some progress…

The error -60005 appears because when trying to send the pmset schedule wake command during the sleepdemand of authorizationMBS, there is no time to answer this security dialog anymore, so I get this error present after (manual) wake-up.

So I placed a ‘fake’ wake and cancel command at the start of my app, so this issue is solved along as it runs (the mac runs).

But, the wake, although issued with a lasterror of 0, does not trigger the Mac to wake up at that time. Further, othis -60005 error still appears occasionally…

I’m at the moment clueless…

12

More info:

There is a .keeprights boolean I noticed that can be set so that one only has to interact with the macOS dialog once, so the '-60005 error is not returning.

When I execute the wake command, I get a lasterror of zero, but the authorized flag remains false…

Looking at the authorized 7 items, they are: uid, ap-token, username, ap-pam-service-name, pam_result, gid, and ap-user-name. No idea if they are what it needs for issuing a pmset.

So the wake is still not triggered during sleep. Any suggestion?

13

Well, I prefer to use AppWrapper for distribution, but for debug mode you’ll need to have the IDE do the settings correctly.

I’m not sure about wake from sleep. I don’t think that should need administrator permissions. I could be wrong on that.

However, I would not be surprised if you do need some kind of entitlement and maybe even System Settings permission.

14

Thanks Tim, I’ll keep trying…

15

Well, first AuthorizationMBS is not the current way Apple likes to do it. Still works, but not preferred.

From AI:

On modern macOS, the “current” way to do root‑level work from a GUI app is to install a privileged helper tool and talk to it over XPC, typically using SMAppService / SMJobBless and Authorization Services.​

Recommended approach

The usual pattern for a non–Mac App Store GUI app that needs to run things like pmset or call IOPMSchedulePowerEvent as root is:

  • Use Authorization Services to get user consent once (the system shows an authentication dialog).​
  • Install a privileged helper tool using the Service Management APIs (historically SMJobBless, more recently wrapped via higher‑level APIs such as SMAppService). The helper is placed under /Library/PrivilegedHelperTools and launched as a daemon.​
  • Communicate with that helper via XPC from your GUI app. The helper runs as root and performs the limited, vetted operations you support (e.g., calling IOPMSchedulePowerEventinstead of shelling out to pmset).​

Important details

  • The helper should be as small and locked‑down as possible, because it runs with full privileges; never expose generic “run arbitrary shell” functionality.​
  • This pattern is not allowed in the Mac App Store sandbox; store builds typically cannot schedule system wake or change system‑wide power settings because they cannot install such helpers.​
  • Using the underlying IOKit power management API (IOPMSchedulePowerEvent) directly in the helper is preferred over invoking pmset, which is only a user‑facing CLI wrapper.​

Instead of XPC you may just use a Socket in Xojo.
I added the ServiceManagementModuleMBS years ago to do the JobBless part. Haven’t used it for a long time, but this used to work.

16

In Terminal you need to put a double quotation mark around date and time, as well for the cancel “wake”.

But with AuthoizationMBS, this is not needed, maybe it does it internally when passing the command via the CF plugin.

Unfortunately, there is now error warning for that, the pmset does just not happen (but a spin dump is generated).

Solution: no double quotation marks (Gänsfüsschen, above the variable ‘gf’), plus a test pmset command to trigger the macOS authorization prompt when launching the app, because later, when falling asleep, this prompt has no time to appear, and the error code -60005 will occur.

1 Like