November 2009 - launchd-dev - lists.macosforge.org

feature request - determine if a port/socket has been created/opened.
by dev.admin＠ntlworld.com 27 Nov '09

27 Nov '09

Dev, Impressive as launchd is, I would like to suggest a feature request. Recently, I was looking into the possibilities of writing a LaunchDaemon that would essentially be a first line of defense against trojans, with minimal disruption and maximum effectiveness. In essence a launchd firewall. The idea was to monitor if a list of ports were opened and if they were, then to ideally close the port, or alternatively, down the network connection. Originally, I tried using the Sockets -> Listeners properties but that just created sockets which then forced a network down state. In this particular example, I would require launchd to be able to monitor whether a port or list of ports were opened and then to initiate a response. Keeping with current syntax, an extension to the Sockets property with 'Monitors' or something similar. I can appreciate that this request is diluting the original intention of launchd, but I've communicated with other users and it seems to be that others are finding uses for launchd beyond it's original purpose. Andrew.

1 0

A few pointers at a launchd script
by Panagiotis Atmatzidis 13 Nov '09

13 Nov '09

I'm forwarding a message that I posted a few minutes ago at users- macports ML because I just found this mailing list and I think that it's more apropriate... (and a good one to keep an eye to avoid launchd adventures..) -- Greetings, I've created my first launchd script. It's for OpenVPN2. Here are the files I've created so far: devo:/opt/local/etc/LaunchDaemons root# ls -l org.macports.OpenVPN2/ total 16 -rwxr-xr-x 1 root admin 957 Oct 30 23:06 OpenVPN2.wrapper -rw-r--r-- 1 root admin 1026 Oct 30 23:39 org.macports.OpenVPN2.plist The Wrapper ----- #!/bin/sh . /etc/rc.common load() { if [ -d /System/Library/Extensions/tun.kext ]; then kextload -q /System/Library/Extensions/tun.kext; else echo "tun.kext not found in /System/Library/ Extensions/" fi } StartService() { load; # first load the module if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then /opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/ server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2 /usr/bin/logger "OpenVPN is loaded" else /usr/bin/logger "tun extensions is not loaded." fi } StopService() { if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then kextunload /System/Library/Extensions/tun.kext # first unload the module fi pid=`cat /opt/local/etc/ovpn/ovpn.pid` # get the pid number if [ $? -eq 0 ]; then kill $pid fi } RestartService() { StopService "$@" StartService "$@" } RunService "$1" the .plist which is an: ln -sf /opt/local/etc/LaunchDaemons/ org.macports.OpenVPN2/org.macports.OpenVPN2.plist /Library/ LaunchDaemons/.... ------------------------ <?xml version='1.0' encoding='UTF-8'?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd" > <plist version='1.0'> <dict> <key>Label</key><string>org.macports.OpenVPN2</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/daemondo</string> <string>--label=OpenVPN2</string> <string>--start-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>start</string> <string>;</string> <string>--stop-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>stop</string> <string>;</string> <string>--restart-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>restart</string> <string>;</string> <string>--pid=none</string> </array> <key>Debug</key><false/> <key>Disabled</key><false/> <key>OnDemand</key><false/> <key>RunAtLoad</key><true/> <key>NetworkState</key><true/> </dict> </plist> However, there are two issues that I can't seem to be able to manage right now. The first is that OpenVPN does not start at boot while the module is loaded succesfully. When I login to the system and kill daemondo, it relaunches itself and ovpn works fine. I suspect that the problem is en0. Launchd tries to launchd openvpn before en0 comes up. That's why I put the NetworkState keyword, but it does not seem to effect *any* startup script. I had issues with dnsmasq also in the recent past. The second problem with this script is that when I unload it via launchd it does not kill the process. Launchd unloads the script and (probably) will not be launchd (if -w is added) in the next boot but daemondo keeps running the process nevertheless. Is this a normal behaviour? I'm not *that* worried about the second. I'd prefer to have a solution about the first one, which is the most important for me. Best regards & thanks in advance Panagiotis (atmosx) Atmatzidis email: atma(a)convalesco.org URL: http://www.convalesco.org GnuPG key id: 0xFC4E8BB4 -- The wise man said: "Never argue with an idiot. They bring you down to their level and beat you with experience."

2 2

Setting environment variables under Snow Leopard advice.
by Benjamin Donnachie 07 Nov '09

07 Nov '09

I currently use a patched version of gpg-agent under launchd control, which previously set the necessary environment variables so that they were accessible system-wide using IPC and SetUserEnvironment. The plist looks like this: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>com.sourceforge.macgpg2.gpg-agent</string> <key>ProgramArguments</key> <array> <string>/usr/local/bin/gpg-agent</string> <string>--launchd</string> <string>--use-standard-socket</string> <string>--write-env-file</string> </array> <key>LimitLoadToSessionType</key> <string>Aqua</string> <key>ServiceIPC</key> <true/> </dict> </plist> This worked fine under Leopard but under Snow Leopard the environment variables are not being set. I have had a look through the launchd source, and ServiceIPC and SetUserEnvironment are still present and the developer docs do not seem to cover this case. As gpg-agent caches passphrases it is not suitable for running on demand. I could modify the patch to accept paths from launchd but I would prefer to leave gpg-agent with its default behaviour and just pass the necessary environment variables back to Snow Leopard. Consequently, I should be grateful for any advice regarding the correct implementation under 10.6. Below is an extract of Stéphane Corthésy's gpg-agent launchd patch showing the IPC behaviour. Many thanks, Ben Extract from the gpg-agent launchd patch: // Pass environment variables back to launchd. launch_data_t resp, tmp, tmpv, msg; msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmpv = launch_data_new_string(strchr(infostr, '=') + 1); // Skip variable name and equal sign launch_data_dict_insert(tmp, tmpv, "GPG_AGENT_INFO"); launch_data_dict_insert(msg, tmp, "SetUserEnvironment"); resp = launch_msg(msg); launch_data_free(msg); // Do NOT launch_data_free() on tmp, nor tmpv if (resp) { launch_data_free(resp); } else { log_error ("failed to pass environment variable GPG_AGENT_INFO to launchd: %s\n", strerror (errno)); kill (pid, SIGTERM); exit (1); } if (opt.ssh_support) { msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmpv = launch_data_new_string(strchr(infostr_ssh_sock, '=') + 1); // Skip variable name and equal sign launch_data_dict_insert(tmp, tmpv, "SSH_AUTH_SOCK"); launch_data_dict_insert(msg, tmp, "SetUserEnvironment"); resp = launch_msg(msg); launch_data_free(msg); // Do NOT launch_data_free() on tmp, nor tmpv if (resp) { launch_data_free(resp); } else { log_error ("failed to pass environment variable SSH_AUTH_SOCK to launchd: %s\n", strerror (errno)); kill (pid, SIGTERM); exit (1); }

1 3