Well, this is a very trivial "exploit" of XPC. The real problem is that such an API even exists at all. I mean, a method to create an arbitrary file in an arbit

Well, this is a very trivial "exploit" of XPC. The real problem is that such an API even exists at all. I mean, a method to create an arbitrary file in an arbitrary location with arbitrary attributes? That is completely braindead. That is clearly equivalent to root privileges, and therefore such an API shouldn't exist - sudo should be used instead, or other OS X methods of explicitly gaining root privileges. This method wouldn't pass the most cursory of security checks. It's clear that it was never actually reviewed, and that the original programmer was relying on the proprietary nature of the OS X system for security. Something like this would never happen with Linux IPC - reviewing the methods published on dbus by services running as root by default is a basic check that any sane distro will do. Something as straightforwardly exploitable as this (literally just call the method while running as an admin user!) would never go in to Debian.