in the system contract, what is required for require_auth(_self)

Question

In the system contract (eosio_system.cpp) there are some functions which require

require_auth( _self );

How is this auth level achieved by the 21 producers?

Answer 1

The _self auth, shown here

require_auth( _self );

requires the authority of the owner of the contract, in this case eosio. If we inspect that account with get account we see this

 owner     1:    1 eosio.prods@active

Which means eosio has given his authority to eosio.prods. And if we inspect that account we see this.

active    15:    1 argentinaeos@active, 1 bitfinexeos1@active, 1 cypherglasss@active, 1 eos42freedom@active, 1 eosauthority@active, 1 eosbeijingbp@active, 1 eoscafeblock@active, 1 eoscanadacom@active, 1 eoscannonchn@active, 1 eosdacserver@active, 1 eosgenblockp@active, 1 eoshuobipool@active, 1 eosisgravity@active, 1 eosliquideos@active, 1 eosnewyorkio@active, 1 eosriobrazil@active, 1 eosstorebest@active, 1 eosswedenorg@active, 1 jedaaaaaaaaa@active, 1 teamgreymass@active, 1 zbeosbp11111@active,

Which means that the 21 BPs can do a multi-sig to sign for eosio.prods, which has delegated authority for eosio.

Answer 2

The require_auth() directive asserts that the transaction has been signed by the specified account. In the case of require_auth(_self), the assertion is that the transaction has been signed by the account that deployed the contract. In other words, if you have deployed the contract to the eosio account, then the transaction has to be signed by the eosio account.