- launchd-dev - lists.macosforge.org

Agent sometimes just stops working until unloaded/reloaded
by Jerry Krinock 05 May '11

05 May '11

It's been almost a year, with no reply, and I still see the problem, so I thought I'd ask again if anyone has ever seen a randomly-occuring bad state in launchd wherein a LaunchAgent with a WatchedPath will fail silently; i.e. not run its program when the WatchedPath changes, even though the ThrottleInterval since the last run has expired. Unloading and reloading the agent immediately knocks it out of this bad state. It's still pretty much the same as I posted last year: http://lists.macosforge.org/pipermail/launchd-dev/2010-June/000774.html Additional information is that it always seems to trigger correctly at least once after loading the job. The second and third times seem to be critical; if it can make it through these, it will continue working for a long time. Also, I think maybe the job is more likely to die if the WatchedPath is changed several times during my 300-second ThrottleInterval. Any clues or suggestions to debug this would be appreciated. P.S. I sure wish there was an API whereby you could find out more about the current status of a job; i.e. information like "was triggered but is currently throttled", etc. Or if it would make a peep when triggered during the throttle interval. Sincerely, Jerry Krinock

1 0

Re: [launchd-dev] Launch shell script when volume is mounted
by Matt Calthrop 20 Apr '11

20 Apr '11

Thanks Michael. I can get it to trap the mount event and execute a script no problem. But what I couldn't do was to pass the name of the volume just mounted in to the shell script being executed. However: I found a hack that works - for now! By observation, running the mount command to show the mounted filesystems lists the filesystems in the order in which they were mounted - so the most recently mounted FS is at the end of the list. An example from my system, just after I mounted an SD card from my camera: /dev/disk0s2 on / (hfs, local, journaled) devfs on /dev (devfs, local, nobrowse) map -hosts on /net (autofs, nosuid, automounted, nobrowse) map auto_home on /home (autofs, automounted, nobrowse) /dev/disk1s1 on /Volumes/NO NAME (msdos, local, nodev, nosuid, noowners) So in my shell script that runs whenever a filesystem is mounted, it should have just been a matter of getting the last line of the output from the mount command, and extracting the 3rd parameter on the line... except that I've got an SD card that has been given the name "NO NAME", with a space in it (as you can see above). Grmbl. A bit of interwebs research revealed that bash actually has regex capabilities built in. So here's what I ended up with to extract the name of the volume: LAST_MOUNTED=$(mount | tail -1) REGEX="(/Volumes/)(.*)( \()" [[ $LAST_MOUNTED =~ $REGEX ]] && { NEW_VOLUME=${BASH_REMATCH[2]} } || { exit } # followed by code to do my stuff with the volume just mounted So it's not entirely robust, but it works. BTW, you mentioned that you had tried duplicating the com.apple.backupd-attach.plist file, and modifying it to suit your needs, but that it didn't work - I assume you used launchctl to load the new plist file? Matt On 19 April 2011 09:20, Michael_google gmail_Gersten <keybounce(a)gmail.com> wrote: >> I want to run a shell script whenever a volume is mounted – and the >> shell script needs to somehow know what the name of the volume is that >> has just been mounted. > > The only trick I've found so far for volume mounts is catching the > call to backupd-helper. > > cat /System/Library/LaunchDaemons/com.apple.backupd-attach.plist > <?xml version="1.0" encoding="UTF-8"?> > <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" > "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> > <plist version="1.0"> > <dict> > <key>Label</key> > <string>com.apple.backupd-attach</string> > <key>ProgramArguments</key> > <array> > <string>/System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper</string> > <string>-attach</string> > </array> > <key>StartOnMount</key> > <true/> > <key>RunAtLoad</key> > <false/> > <key>KeepAlive</key> > <false/> > </dict> > </plist> > > Basically, there's a program that already runs on every attach. You > can replace it with a shell script. > > I have NOT been able to duplicate this behavior with anything else -- > even trying to make a copy of that plist with a different name calling > my script did not work. > > A bit of a warning: It will trigger on every .dmg mount. Every time > you run a program off a compressed image (if you are trying to save > space), etc. > > And no, I can't figure out how to get the name of the mounted drive. > Equally, this setup does not have backup actually run and make a > backup when you connect a drive. >

2 2

Launch shell script when volume is mounted
by Matt Calthrop 19 Apr '11

19 Apr '11

Hi all. I'm new to this list, and have a question about a task I'm trying to accomplish that seems to me pretty straightforward. I want to run a shell script whenever a volume is mounted – and the shell script needs to somehow know what the name of the volume is that has just been mounted. I know it can be done (HardwareGrowler does it), but I just haven't found out how yet. Initially, I thought I could do it using Peter Borg's lingon app (http://www.peterborgapps.com/lingon/) this *almost* did the job, but I have checked with the developer, and he told me that although his app can detect when a volume is mounted, it can't pass the name of the mounted volume in to the shell script that is run. He then directed me to this list. So: any help would be most appreciated! kind regards, Matt

2 2

Starting/Stoping Apache HTTPD outside System Preferences
by Luke Scott 30 Mar '11

30 Mar '11

The plist file for the included version of Apache HTTPD contains a key called SHAuthorizationRight which is set to system.preferences. Because of this key System Preferences can start/stop the service without being root. I cannot find any documentation on this key. Is there any way to do this with my own plist and application? Basically I want to role my own version of httpd and create a launchd plist and be able to start/stop the service from a menu driven application. It needs to be able to do this without escalating it's privileges or entering a password. If there isn't a way, what are my (secure) alternatives, without entering a password, if any? Anyone know? Thanks, Luke

2 2

Re: [launchd-dev] Appropriate LaunchDaemon filesystem locations
by Quinn "The Eskimo!" 07 Mar '11

07 Mar '11

On 6 Mar 2011, at 23:11, Michael_google gmail_Gersten wrote: > So why not /Library/AdditionalHelperTools? > > Or, better: > > /Library/HelperTools/{Privileged,Additional} > > Or > > /Library/ProtectedAppFiles/{AppName} It's not that it's hard to come up with good approaches, but that there's no comprehensive guidance from Apple on this issue. S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware

1 0

Appropriate LaunchDaemon filesystem locations
by Jeremy Reichman 01 Mar '11

01 Mar '11

TN2083 states: > When you install your daemon, make sure that you set the file system > permissions correctly. Apple recommends that daemons be owned by root, have an > owning group of wheel, and use permissions 755 (rwxr-xr-x) for executables and > directories, and 644 (rw-r--r--) for files. In addition, every directory from > your daemon up to the root directory must be owned by root and only writable > by the owner (or owned by root and sticky). If you don't do this correctly, a > non-admin user might be able to escalate their privileges by modifying your > daemon (or shuffling it aside). The technote isn't specific about which existing filesystem locations are appropriate for storing launchdaemons' executables. Does "writable by owner" mean both the individual owner and group owner? I interpret the recommendation above to mean the individual owner and not the group owner, but that may not be what is intended. What standard locations are considered appropriate for launchdaemons? Files in application bundles in /Applications probably won't meet the recommendations above, because /Applications is owned by root:admin and writable by both as a default. Applications are often installed by drag and drop, and so individual apps won't even have the stricter ownership that the parent /Applications folder will have. Subfolders in /Library/Application Support in the local domain are also unable to meet these recommendations. The /Library folder is owned and writable by admin, even though it is also owned by root and sticky. /Library/Applications Support is itself owned by root and admin, and is again writable by both. As long as I'm asking, is there any functional or security difference between a launchdaemon plist with 755 or 644 permissions. I almost exclusively see them with 644 permissions (and root:wheel ownership) but occasionally come across one that is 755. Thanks! -- Jeremy

3 2

upgrading a helper tool with SMJobBless
by Richard Brown 16 Feb '11

16 Feb '11

The SMobBless documentation specifies that '[t]he helper tool must have an embedded Info.plist containing an "SMAuthorizedClients" array of strings. Each string is a textual representation of a code signing requirement describing a client which is allowed to add and remove the tool.' Let's say I write an application MyApp with a privileged helper tool MyTool (com.mydomain.MyTool). MyApp 1.0 satisfies MyTool 1.0's codesigning requirement. Later, I release version 2.0, but I've had to change something about MyApp, and MyApp 2.0 no longer satisfies MyTool 1.0's requirement. What will happen when I try to upgrade MyTool using SMJobBless? Does an upgrade count as a remove+add, or will the upgrade succeed? If this will fail, what is a workaround? I will file an enhancement request based on the answer, either for clearer documentation (saying that upgrading in this manner is OK), or for very clear warnings about this case and to consider the SMAuthorizedClients requirements very carefully. Thanks, RB -- Richard Brown QuantumCheese Coding rabrown(a)quantumcheese.com

1 0

Understanding bootstrap idea in different versions of MacOS
by eveningnick eveningnick 27 Jan '11

27 Jan '11

Hello I understand that this is not an apple way to respond about obsolete versions of their software. But i am hoping some of launchd developers look through this list, and who are aware of pecularities of their child :) i am trying to launch an agent programmatically (not only automatically when the system is started), but in a certain moment. I mean, a user installs an application, and he is happy having an agent run as soon as an app is installed. as i've been told on this list some time ago, it can be done only by exec'ing "launchctl -w load [plist file path]", as long as OS X does not provide any explicit ways to communicate to per user launchd service and ask it to process a plist file. I assume that launchd "interface" could be retrieved by reading sources of launchctl (i've heard they are available), but my qualification doesnt allow me to do that so far. The problem i've run into was launchctl and launchd acting differently on different versions of OS X, partly because launchctl changed the way it searches for the right launchd instance (so i've been told on this list) from the per-bootstrap to per-user, In archives i found some ways of "talking" to the right instance of launchd - like, specifying "-S" parameter, or using "bslist" param. They seem to work differently not only on OS X 10.5 and 10.6, but even inside 10.5 builds (for example, while on 10.5.6 sudo launchctl load -w myagent.plist launches an agent, on 10.5.4 users get "Socket not connected"). Could you please explain, how to 'talk' to the right launchd and what is the difference in the way of 'talking' in different versions of OS X? Thanx

2 2

overrides.plist denied write access by ACLs
by Thomas Clément 17 Jan '11

17 Jan '11

Hello all, My product installs an agent in /Library/LaunchAgents/ and my application allows the user to enable/disable it. To do that, I'm calling "launchctl load/unload -w" which stores the disabled state in its per-user overrides.plist file. However I'm getting several reports from users for which it doesn't work. It turns out their overrides.plist is denied write access by ACLs. > # cd /var/db/launchd.db/com.apple.launchd.peruser.501 > # ls -ale@ > total 8 > drwx------@ 3 sparker wheel 102 Sep 5 2009 . > com.apple.metadata:_kTimeMachineNewestSnapshot 50 > com.apple.metadata:_kTimeMachineOldestSnapshot 50 > 0: group:everyone deny add_file,delete,add_subdirectory,delete_child,writeattr,writeextattr,chown > drwxr-xr-x 12 root wheel 408 Feb 25 2010 .. > -rw-------@ 1 sparker wheel 376 Feb 13 2010 overrides.plist > com.apple.metadata:_kTimeMachineNewestSnapshot 50 > com.apple.metadata:_kTimeMachineOldestSnapshot 50 > 0: group:everyone deny write,delete,append,writeattr,writeextattr,chown They are also Time Machine extended attributes which may be related to the whole thing. Have you guys seen this before? Any idea how these ACLs got here? Thanks, Thomas

2 2

Re: [launchd-dev] Stopping and unloading an agent from root-privileged application
by Quinn "The Eskimo!" 14 Jan '11

14 Jan '11

On 14 Jan 2011, at 04:00, Michael_google gmail_Gersten wrote: > So ... in 10.6, if I ssh to a system that I'm on a gui session, then > the ActivityMonitor example will work just fine? I would expect so, but give it a try and let me know (-: > How do I follow links like rdar://problem/5544764 found in that tech note? You can't see Radar bugs, except those that you filed. The technote includes bug numbers because that's the handle we use to refer to the issue and to track its fix. The links are there as a convenience for Apple folks (-: S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware

1 0