Ability to change Network Location without admin rights?

There should be no "Apply" to click. I was referring to the menu, i.e. In the menubar, top left corner of the screen, there should be a black icon shaped like an apple with a bite out of it. Click on it once, and move the mouse pointer down to where it says "Location" (assuming English), and a sub-menu should appear listing any pre-configured locations. Continue to move the pointer over to the sub-menu and select a location that does not have a "checkmark" beside it (this denotes the currently active location) - once a location is highlighted, click the mouse again to change to the new location.

That menu works through ' /usr/sbin/scselect' which is owned by "root" and setuid so it doesn't surprise me that non-admins can use it to change the network configuration, which would normally be expected to require "admin" privileges. And the setuid status isn't a quirk of my system - it is supposed to be setuid eg. <pre>
pkgutil --file-info /usr/sbin/scselect</pre>

So if the menu doesn't work, does invoking ' scselect' directly work on your system?

I'm not sure if that is possible using any configuration options.

Removing the ' setuid' permissions from ' /usr/sbin/scselect' does seem to disable the "Location" menu while retaining the ability to switch locations from the popup menu in the "Network" pref pane (authentication required for non-admin accounts). However, making such changes to system files isn't generally recommended, and restricting functions using permissions changes is generally a high-maintenance strategy from the point of view of the admin.

For example, note that the change will be reversed should "repair permissions" be run. Mind you, currently, an "admin" should probably avoid running "repair permissions" on a machine used by a person not trusted enough to be told an "admin" password since a standard user may be able to rig a machine (depending on the configuration) so that running "repair permissions" will give that user super-user privileges. Any given Apple security or OS update could also replace the file, re-enabling the "Location" menu.

Modify the /private/etc/authorization file with a tool such as TextWrangler so that their accounts have that right, and don't give them the password to the administrator account. To find out the correct right, push the Details triangle on the screen which asks for the password.

(38439)

..." We would like the ability for a user, or group of users (or potentially everyone), to be able to change System Preferences | Network | Location option from Automatic to a pre-defined location (called Home) we created."...

Your users should already be able to do this. The key in your situation is that the locations are pre-defined.

Once configured by an "admin" user, any standard users may switch between pre-configured locations via the "" > "Location" menu.

Interesting timing:

FWIW I agree that the "location" submenu of teh Apple menu allows any user to switch among predefined locations. They can't, however, create new locations without the admin passsword (assuming the network pref pane has been left locked!).

But - help me - I'd like to do the opposite, to prevent ordinary users from switching. I've been using openID to provide basic filtering. It can be defeated by adding a local DNS lookup to Network prefs. We DO want at least one location profile with alternative DNS to that we can burrow around openDNS from time to time without using the Network pane.

Thank you for such a thoughtful reply.

What I need is not so much control over location switching as preventing anyone from using another (non-openDNS) DNS at the Network pane -- while also providing admin users a workaround that can even be done in front of the user without their catching on. The openDNS DNS's are entered into the router but apparently can be overridden at each machine. Now, if they see us type in a DNS (ick) or, duh, pick a different Location it's all over.

(This arrangement is not intended to be high security, just to limit kids from stumbling into **** and to keep them out of youTube cartoons, plus some other benefits. I've found Parental Controls too heavy-handed and don't want to invest in censorware that I dislike politically.... Just keep them away from innocently-named girls.com etc.)

I think you can change Location at the Network pane even w/o admin privileges. The popup menu stays live, you just can't make new locations or alter existing ones.

I wasn't aware that repair permissions presented a security hazard. Now, I could just have a login script chmod the relevant files every time -- I'm fiddling with Sleepwatcher currently to try to suspend on sleep (switch to the login screen) -- though as you note mucking with system files is an unattractive option.