October 2009 - launchd-dev - lists.macosforge.org

A few pointers at a launchd script
by Panagiotis Atmatzidis 13 Nov '09

13 Nov '09

I'm forwarding a message that I posted a few minutes ago at users- macports ML because I just found this mailing list and I think that it's more apropriate... (and a good one to keep an eye to avoid launchd adventures..) -- Greetings, I've created my first launchd script. It's for OpenVPN2. Here are the files I've created so far: devo:/opt/local/etc/LaunchDaemons root# ls -l org.macports.OpenVPN2/ total 16 -rwxr-xr-x 1 root admin 957 Oct 30 23:06 OpenVPN2.wrapper -rw-r--r-- 1 root admin 1026 Oct 30 23:39 org.macports.OpenVPN2.plist The Wrapper ----- #!/bin/sh . /etc/rc.common load() { if [ -d /System/Library/Extensions/tun.kext ]; then kextload -q /System/Library/Extensions/tun.kext; else echo "tun.kext not found in /System/Library/ Extensions/" fi } StartService() { load; # first load the module if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then /opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/ server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2 /usr/bin/logger "OpenVPN is loaded" else /usr/bin/logger "tun extensions is not loaded." fi } StopService() { if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then kextunload /System/Library/Extensions/tun.kext # first unload the module fi pid=`cat /opt/local/etc/ovpn/ovpn.pid` # get the pid number if [ $? -eq 0 ]; then kill $pid fi } RestartService() { StopService "$@" StartService "$@" } RunService "$1" the .plist which is an: ln -sf /opt/local/etc/LaunchDaemons/ org.macports.OpenVPN2/org.macports.OpenVPN2.plist /Library/ LaunchDaemons/.... ------------------------ <?xml version='1.0' encoding='UTF-8'?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd" > <plist version='1.0'> <dict> <key>Label</key><string>org.macports.OpenVPN2</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/daemondo</string> <string>--label=OpenVPN2</string> <string>--start-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>start</string> <string>;</string> <string>--stop-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>stop</string> <string>;</string> <string>--restart-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>restart</string> <string>;</string> <string>--pid=none</string> </array> <key>Debug</key><false/> <key>Disabled</key><false/> <key>OnDemand</key><false/> <key>RunAtLoad</key><true/> <key>NetworkState</key><true/> </dict> </plist> However, there are two issues that I can't seem to be able to manage right now. The first is that OpenVPN does not start at boot while the module is loaded succesfully. When I login to the system and kill daemondo, it relaunches itself and ovpn works fine. I suspect that the problem is en0. Launchd tries to launchd openvpn before en0 comes up. That's why I put the NetworkState keyword, but it does not seem to effect *any* startup script. I had issues with dnsmasq also in the recent past. The second problem with this script is that when I unload it via launchd it does not kill the process. Launchd unloads the script and (probably) will not be launchd (if -w is added) in the next boot but daemondo keeps running the process nevertheless. Is this a normal behaviour? I'm not *that* worried about the second. I'd prefer to have a solution about the first one, which is the most important for me. Best regards & thanks in advance Panagiotis (atmosx) Atmatzidis email: atma(a)convalesco.org URL: http://www.convalesco.org GnuPG key id: 0xFC4E8BB4 -- The wise man said: "Never argue with an idiot. They bring you down to their level and beat you with experience."

2 2

Setting environment variables under Snow Leopard advice.
by Benjamin Donnachie 07 Nov '09

07 Nov '09

I currently use a patched version of gpg-agent under launchd control, which previously set the necessary environment variables so that they were accessible system-wide using IPC and SetUserEnvironment. The plist looks like this: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>com.sourceforge.macgpg2.gpg-agent</string> <key>ProgramArguments</key> <array> <string>/usr/local/bin/gpg-agent</string> <string>--launchd</string> <string>--use-standard-socket</string> <string>--write-env-file</string> </array> <key>LimitLoadToSessionType</key> <string>Aqua</string> <key>ServiceIPC</key> <true/> </dict> </plist> This worked fine under Leopard but under Snow Leopard the environment variables are not being set. I have had a look through the launchd source, and ServiceIPC and SetUserEnvironment are still present and the developer docs do not seem to cover this case. As gpg-agent caches passphrases it is not suitable for running on demand. I could modify the patch to accept paths from launchd but I would prefer to leave gpg-agent with its default behaviour and just pass the necessary environment variables back to Snow Leopard. Consequently, I should be grateful for any advice regarding the correct implementation under 10.6. Below is an extract of Stéphane Corthésy's gpg-agent launchd patch showing the IPC behaviour. Many thanks, Ben Extract from the gpg-agent launchd patch: // Pass environment variables back to launchd. launch_data_t resp, tmp, tmpv, msg; msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmpv = launch_data_new_string(strchr(infostr, '=') + 1); // Skip variable name and equal sign launch_data_dict_insert(tmp, tmpv, "GPG_AGENT_INFO"); launch_data_dict_insert(msg, tmp, "SetUserEnvironment"); resp = launch_msg(msg); launch_data_free(msg); // Do NOT launch_data_free() on tmp, nor tmpv if (resp) { launch_data_free(resp); } else { log_error ("failed to pass environment variable GPG_AGENT_INFO to launchd: %s\n", strerror (errno)); kill (pid, SIGTERM); exit (1); } if (opt.ssh_support) { msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmpv = launch_data_new_string(strchr(infostr_ssh_sock, '=') + 1); // Skip variable name and equal sign launch_data_dict_insert(tmp, tmpv, "SSH_AUTH_SOCK"); launch_data_dict_insert(msg, tmp, "SetUserEnvironment"); resp = launch_msg(msg); launch_data_free(msg); // Do NOT launch_data_free() on tmp, nor tmpv if (resp) { launch_data_free(resp); } else { log_error ("failed to pass environment variable SSH_AUTH_SOCK to launchd: %s\n", strerror (errno)); kill (pid, SIGTERM); exit (1); }

1 3

Re: [launchd-dev] A few pointers about launchd and daemondo
by Panagiotis Atmatzidis 31 Oct '09

31 Oct '09

Hello, I solved both issues adjusting the wrapper accordingly. Should I throw a ticket for this wrapper for this to be added on macports? I don't know how to edit the port though... # openvpn configuration file #!/bin/sh . /etc/rc.common load() { if [ -d /System/Library/Extensions/tun.kext ]; then kextload -q /System/Library/Extensions/tun.kext; else echo "tun.kext not found in /System/Library/Extensions/" fi } StartService() { # # Use the "ipconfig waitall" command to wait for all the # interfaces to come up: # ipconfig waitall load; # first load the module if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then /opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/ server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2 /usr/bin/logger "OpenVPN is loaded" else /usr/bin/logger "tun extensions is not loaded." fi } StopService() { pid=`cat /opt/local/etc/ovpn/ovpn.pid` if [ $? -eq 0 ]; then kill $pid fi if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then kextunload /System/Library/Extensions/tun.kext if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then /usr/bin/logger "The tun module is unloaded successfully" else /usr/bin/logger "There was a problem. I was not able to unload tun module!!!" fi fi } RestartService() { StopService "$@" StartService "$@" } RunService "$1" Panagiotis (atmosx) Atmatzidis email: atma(a)convalesco.org URL: http://www.convalesco.org GnuPG key id: 0xFC4E8BB4 -- The wise man said: "Never argue with an idiot. They bring you down to their level and beat you with experience."

1 0

Preventing killing of child processes?
by Sidney San Martín 12 Oct '09

12 Oct '09

TN2083 explains that launchd kills child processes when the parent exits, and suggests using setsid() as a workaround when a child needs to stay alive. I'm in that situation, (see http://lists.macosforge.org/pipermail/launchd-dev/2009-September/000664.html for details, I want to change the StartInterval of my job and use a helper tool to un/reload myself from launchd), but I can't get my helper tool into a state where it's not killed. Calling setsid() from either the daemon (before launching the helper) or from the helper tool itself returns -1 and it's killed off by launchd as soon as the job is unloaded. What's the right way to use setsid() (or another approach) here?

2 4

Re: [launchd-dev] launchd & launchctl Aqua session type on OSX Tiger
by Grant Erickson 12 Oct '09

12 Oct '09

On 10/9/09 7:00 AM, launchd-dev-request(a)lists.macosforge.org wrote: > I have a script which I can successfully schedule using on OSX Leopard > as follows :- > > launchctl load -w -S Aqua com.floehopper.script > Apparently I need the Aqua session type because the script accesses the > keychain using the SecKeychainFindGenericPassword function. If I don't > set the session type to Aqua, I get a errSecInteractionNotAllowed > "Interaction with the Security Server is not allowed" error (-25308). > > However, I also want to schedule the script on OSX Tiger, but the > session type -S option is not available for launchctl. > > I've tried calling the SecKeychainSetUserInteractionAllowed function > with the state parameter set to false, but then I end up with a > errSecAuthFailed "Authorization/Authentication failed" error (-25293). > > Does anyone have any ideas how I might get this working on OSX Tiger? James: I'd recommend you read: http://developer.apple.com/mac/library/technotes/tn2005/tn2083.html LaunchAgents are, unfortunately, DOA (dead on arrival) in Tiger. Regards, Grant

3 2

launchd & launchctl Aqua session type on OSX Tiger
by James Mead 09 Oct '09

09 Oct '09

I have a script which I can successfully schedule using on OSX Leopard as follows :- launchctl load -w -S Aqua com.floehopper.script Apparently I need the Aqua session type because the script accesses the keychain using the SecKeychainFindGenericPassword function. If I don't set the session type to Aqua, I get a errSecInteractionNotAllowed "Interaction with the Security Server is not allowed" error (-25308). However, I also want to schedule the script on OSX Tiger, but the session type -S option is not available for launchctl. I've tried calling the SecKeychainSetUserInteractionAllowed function with the state parameter set to false, but then I end up with a errSecAuthFailed "Authorization/Authentication failed" error (-25293). Does anyone have any ideas how I might get this working on OSX Tiger?

1 0

Privilege separation and crash resistance
by Thomas Clement 07 Oct '09

07 Oct '09

Hello, I think the following architecture is recommended when a daemon needs to talk to an agent: - daemon listens on privileged port - agent is set to run at load time and checks in with the daemon to vends its mach port - daemon uses the vended mach port to launch the agent on demand However if the daemon crashes, it loses the vended mach port and is unable to launch the agent. What is the recommended solution to this situation? Regards, Thomas

3 5