Guidelines for Using Session IDs

Because session IDs are unique to a session, use them to identify resources that are session-specific, but which may still be shared by entities in same login session. For example, if your application creates a shared memory region, you could include the session ID in the name of that region. Other applications (including copies of the same application) would be able to access this memory region using the shared name and session information.

You can use session IDs in directory names to group temporary files together and make them easier to find. However, it is still recommended that you use the mktemp family of functions to generate random names for the files in that directory.

Using the Security Framework

The Security framework can be linked into any program, whether it resides in the root session or in a login session. This framework includes the function SessionGetInfo for getting basic information about the current session, including the session ID and some session attributes.

To get the session ID of the current session, pass the value callerSecuritySession as the first parameter to SessionGetInfo. If you happen to have the session ID of a different login session, you can use it to get information about the other session. The parameters returned by SessionGetInfo are mostly informational and cannot be modified; thus they have no consequences on the security of the login session.

The following example shows you how to call SessionGetInfo to get the session ID for the current root or login session.

#include <Security/Security.h>

OSStatus error;

SecuritySessionId mySession;

SessionAttributeBits sessionInfo;

error = SessionGetInfo(callerSecuritySession, &mySession, &sessionInfo);

The session ID itself is an integer value that persists for the duration of the login session; see Identifying Login Sessions for additional information. The attribute bits parameter is an integer bitmask value that provides additional information about the session, such as whether it is the root session and whether it has an available console. See the header files for a description of the available bit constants.

Using the Core Graphics Framework

The Core Graphics framework relies on the presence of the window server and thus is available only to applications running in a login session. This framework includes the CGSessionCopyCurrentDictionary function for getting information about the current login session, including the user ID and name.

The following example shows you how to get login session information using the CGSessionCopyCurrentDictionary function. This function returns a dictionary with several keys that you can read to get the information you need.

#include <CoreFoundation/CoreFoundation.h>

#include <ApplicationServices/ApplicationServices.h>

CFStringRef shortUserName;

CFNumberRef userUID;

CFBooleanRef userIsActive;

CFBooleanRef loginCompleted;

int MyCGGetSessionInfo

{

    CFDictionaryRef sessionInfoDict;

    sessionInfoDict = CGSessionCopyCurrentDictionary();

    if (sessionInfoDict == NULL)

    {

        printf(“Unable to get session dictionary.”);

        return(1);

    }

    shortUserName = CFDictionaryGetValue(sessionInfoDict,

                                        kCGSessionUserNameKey);

    userUID = CFDictionaryGetValue(sessionInfoDict,

                                        kCGSessionUserIDKey);

    userIsActive = CFDictionaryGetValue(sessionInfoDict,

                                        kCGSessionOnConsoleKey);

    loginCompleted = CFDictionaryGetValue(sessionInfoDict,

                                        kCGSessionLoginDoneKey);

}

Posting Notifications to All Sessions

If you need to send a distributed notification to other processes, you should generally do so only to processes in the current login session. However, there may be cases where you need to send a notification to all processes, regardless of their corresponding login session. For example, changes to system-global settings affect all applications that rely on those settings.

In Core Foundation, the CFNotificationCenterPostNotificationWithOptions function allows you to post notifications to all login sessions. To use this function for global notifications, pass the kCFNotificationPostToAllSessions constant to the options parameter.

In Cocoa, the postNotificationName:object:userInfo:options: method of the NSDistributedNotificationCenter object allows you to post notifications to all login sessions. To use this function for global notifications, pass the NSNotificationPostToAllSessions constant to the options parameter.

The use of global notifications should be minimized whenever possible. If you need to identify the login session that originated a notification, put its session ID into the user information dictionary of the notification. For more information on getting the session ID, see Getting Login Session Information.

Handling Distributed Notifications

The handler for a global notification must be prepared to handle that notification even when it comes from a different login session. If your handler assumes the notification originated in the same login session, your application could experience problems in a fast user switched environment. Fortunately, existing methods for distributing notifications limit the scope of delivery to the current login session. Applications that need to send global notifications must be modified to send those notifications explicitly with interfaces introduced in OS X version 10.3.

If you set up your application to receive a particular global notification, keep in mind that you may not need to handle all instances of that notification. For example, a daemon in the root session might use a global notification to communicate with a process in the active session. In this situation, use of a global notification is preferable because the daemon does not have any knowledge of programs in the login sessions. By broadcasting to all sessions, the notification is guaranteed to reach the active session. Applications in inactive sessions would simply ignore the notification.