When you need root.
Captain’s Deck doesn’t want elevated privileges by default — and that’s a feature. When you do need them, admin mode is explicit, scoped, and noisy in all the right ways.
Enabling admin mode
Admin mode is off by default and must be explicitly enabled in Settings → General — tick “Allow admin operations on this Mac”. Once enabled, the option to elevate appears as a contextual action when you try to write to a protected location.
The same section offers “Always use Admin for this session” — turn it on when you have a batch of privileged work to do and you’d rather not confirm each operation. It stays on until you turn it off, quit the app, or the Drop Admin after time passes with no admin work (see Safety nets).
You enter your administrator password once, when the helper is installed. The helper then stays installed as a small background service that macOS starts whenever Captain’s Deck needs it, so later admin operations, even after a restart, don’t ask for the password again.
How auth works
Captain’s Deck uses the standard macOS Authorization Services framework. The first time you elevate, macOS asks for your administrator password and installs a small privileged helper. The helper:
- Is signed and notarised by the same team certificate as the main app
- Only accepts requests from Captain’s Deck: macOS checks the signature of every program that talks to it, and turns away anything that isn’t Captain’s Deck from our team
- Stays installed in the background, ready for the next admin operation
- Carries out the operations Captain’s Deck asks for with full administrator rights, so only install it on a Mac you trust
- Logs every call to a tamper-evident audit log
Helpers from versions before 1.5.5.1 accepted requests from other programs too. When you start 1.5.5.1 or later, an old helper is removed without asking for your password, and the new one is installed the next time you elevate.
What admin can do
- Read / write any file on the local volume (subject to SIP)
- Change ownership and permissions (chown, chmod)
- Set extended attributes & ACLs
- Work inside protected folders like
/etc,/usr/local,/Library
It cannot bypass System Integrity Protection.
Safety nets
- Destructive operations show an extra confirmation showing exactly which paths will be touched
- “Always use Admin for this session” switches itself off after a quiet spell with no admin work. Pick how long in Settings → General → Drop Admin after: 1, 5, 10 (the default) or 30 minutes, or Never
Audit log
Every admin operation appends a JSON line to ~/Library/Logs/CaptainsDeck/admin.log with timestamp, operation, args, and outcome. The log uses an HMAC chain — each record’s signature also covers the signature of the record before it, so editing or removing an entry breaks every entry that follows it.
Settings → General → Admin Mode has two buttons:
- Reveal Audit Log — opens the log file in Finder.
- Verify Chain — walks the file end-to-end and reports the first broken link, if any. A clean log shows “All N records match the HMAC chain.”
The signing key is generated on first use and stored in your Keychain, so the chain only verifies on the same Mac that wrote it.