- launchd-dev - lists.macosforge.org

multiple commands in one launchd item
by dev.admin＠ntlworld.com 14 Dec '09

14 Dec '09

Hi, Just spent *hours* experimenting with this and although it is possible to add several commands into a LaunchDaemon using the previously mention ProgramArguments from Damien i.e. /bin/bash -c *code* as separate items, you can only use one item line for the entire script. It's not long before it becomes unreadable. All-in all, as Nehemiah mentioned, if it can go into a script, it probably should go into a script. However, all LaunchDaemon external scripts should have the same level of permissions as a LaunchDaemon plist file. Otherwise it's a potential security threat. The contents of the external file could be changed to whatever. The owner/group should be root/wheel and the mode 0755. A.

2 1

multiple commands in one launchd item
by Nehemiah Dacres 14 Dec '09

14 Dec '09

> > > For example, this will work in a shell, as a one liner: > cd /Users/me/Desktop; mkdir zzzzzzzz; cd zzzzzzzz; touch test; chown > 0:0 test; rm -rf /Users/me/Desktop/zzzzzzzz; > > if it works in the shell, try putting it in a shell script. I dont think that's how Launchd is supposed to work -- "lalalalala! it's not broken because I can use it" http://linux.slashdot.org/comments.pl?sid=194281&threshold=1&commentsort=0&…

1 0

Re: [launchd-dev] multiple command lines in launchd.
by dev.admin＠ntlworld.com 13 Dec '09

13 Dec '09

Hi Scott, I stumbled across a book (in google) that gives you can example of just this. Haven't tried it, but I'm having the same problem with something else. The link to the book is: http://books.google.com/books? id=OoTAWXH6z48C&pg=PT468&dq=launchd&cd=8#v=onepage&q=launchd&f=false If that doesn't work then search for 'launchd' and the book called Enterprise Mac Administrators Guide page 452 to 453, Self-destructing scripts. Although I can't confirm this yet, I *think* you can put an entire line on each item terminated with a semi-colon. If you do get it to work, confirmation on this list would be appreciated. A.

3 2

launchd and hdiutils
by dev.admin＠ntlworld.com 11 Dec '09

11 Dec '09

Hi Tomasz, Have you considered adding the dmg file to the Preferences -> Accounts -> Login Items It should launch the decompression application and request a password all in the gui. Alternatively you may want to consider using the built in File Vault facility specifically design for Home directory security. As far as launchd is concerned, you maybe pushing it's capabilities. The /tmp directory, I believe, only contains temporary items that are removed at the end of the session. A.

1 0

launchd stdin
by Nehemiah Dacres 10 Dec '09

10 Dec '09

> > Would it be possible to direct stdin to the keyboard to enable interactive > daemons, e.g. for entering the password of an encryption tool. > > This would allow to use truecrypt to encrypt the home folder, swap, /tmp, > .... > im not sure if that's possible, launchd programs are launched before your GUI launches. > > Best regards > > Thomas > > > > ------------------------------ > > _______________________________________________ > launchd-dev mailing list > launchd-dev(a)lists.macosforge.org > http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev > > > End of launchd-dev Digest, Vol 30, Issue 1 > ****************************************** > -- "lalalalala! it's not broken because I can use it" http://linux.slashdot.org/comments.pl?sid=194281&threshold=1&commentsort=0&…

1 0

Loginwindow Hook alternatives?
by Mike Fischer 09 Dec '09

09 Dec '09

Hi! In an enterprise setting I need to run an shell script after a (any) user logs in. This shell script needs to know the user name and it needs to be able to do certain root/admin-only tasks, e.g. chown(8), even for non-priveledged users. Loginwindow Hooks are described here and apart from some minor typos in the KB seem to fit the bill: <http://support.apple.com/kb/HT2420> <http://developer.apple.com/mac/library/documentation/MacOSX/ Conceptual/BPSystemStartup/Articles/CustomLogin.html> The only alternative I can think of would be a launchd agent calling a setuid script. While the security would not really be worse than that of a Loginwindow Hook script, I don't like the combination of setuid and shell script. OTOH Loginwindow Hooks are kind of fragile because there can be only one of then. What would be the preferred way to handle something like this for 10.5 + as well as 10.6+? Thanks! Mike -- Mike Fischer Softwareentwicklung, EDV-Beratung Schulung, Vertrieb Web: <http://homepage.mac.com/mike_fischer/index.html> Note: I read this list in digest mode! Send me a private copy for faster responses.

2 1

launchd stdin
by Thomas Fritz 08 Dec '09

08 Dec '09

Hi everybody Would it be possible to direct stdin to the keyboard to enable interactive daemons, e.g. for entering the password of an encryption tool. This would allow to use truecrypt to encrypt the home folder, swap, /tmp, .... Best regards Thomas

1 0

feature request - determine if a port/socket has been created/opened.
by dev.admin＠ntlworld.com 27 Nov '09

27 Nov '09

Dev, Impressive as launchd is, I would like to suggest a feature request. Recently, I was looking into the possibilities of writing a LaunchDaemon that would essentially be a first line of defense against trojans, with minimal disruption and maximum effectiveness. In essence a launchd firewall. The idea was to monitor if a list of ports were opened and if they were, then to ideally close the port, or alternatively, down the network connection. Originally, I tried using the Sockets -> Listeners properties but that just created sockets which then forced a network down state. In this particular example, I would require launchd to be able to monitor whether a port or list of ports were opened and then to initiate a response. Keeping with current syntax, an extension to the Sockets property with 'Monitors' or something similar. I can appreciate that this request is diluting the original intention of launchd, but I've communicated with other users and it seems to be that others are finding uses for launchd beyond it's original purpose. Andrew.

1 0

A few pointers at a launchd script
by Panagiotis Atmatzidis 13 Nov '09

13 Nov '09

I'm forwarding a message that I posted a few minutes ago at users- macports ML because I just found this mailing list and I think that it's more apropriate... (and a good one to keep an eye to avoid launchd adventures..) -- Greetings, I've created my first launchd script. It's for OpenVPN2. Here are the files I've created so far: devo:/opt/local/etc/LaunchDaemons root# ls -l org.macports.OpenVPN2/ total 16 -rwxr-xr-x 1 root admin 957 Oct 30 23:06 OpenVPN2.wrapper -rw-r--r-- 1 root admin 1026 Oct 30 23:39 org.macports.OpenVPN2.plist The Wrapper ----- #!/bin/sh . /etc/rc.common load() { if [ -d /System/Library/Extensions/tun.kext ]; then kextload -q /System/Library/Extensions/tun.kext; else echo "tun.kext not found in /System/Library/ Extensions/" fi } StartService() { load; # first load the module if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then /opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/ server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2 /usr/bin/logger "OpenVPN is loaded" else /usr/bin/logger "tun extensions is not loaded." fi } StopService() { if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then kextunload /System/Library/Extensions/tun.kext # first unload the module fi pid=`cat /opt/local/etc/ovpn/ovpn.pid` # get the pid number if [ $? -eq 0 ]; then kill $pid fi } RestartService() { StopService "$@" StartService "$@" } RunService "$1" the .plist which is an: ln -sf /opt/local/etc/LaunchDaemons/ org.macports.OpenVPN2/org.macports.OpenVPN2.plist /Library/ LaunchDaemons/.... ------------------------ <?xml version='1.0' encoding='UTF-8'?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd" > <plist version='1.0'> <dict> <key>Label</key><string>org.macports.OpenVPN2</string> <key>ProgramArguments</key> <array> <string>/opt/local/bin/daemondo</string> <string>--label=OpenVPN2</string> <string>--start-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>start</string> <string>;</string> <string>--stop-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>stop</string> <string>;</string> <string>--restart-cmd</string> <string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/ OpenVPN2.wrapper</string> <string>restart</string> <string>;</string> <string>--pid=none</string> </array> <key>Debug</key><false/> <key>Disabled</key><false/> <key>OnDemand</key><false/> <key>RunAtLoad</key><true/> <key>NetworkState</key><true/> </dict> </plist> However, there are two issues that I can't seem to be able to manage right now. The first is that OpenVPN does not start at boot while the module is loaded succesfully. When I login to the system and kill daemondo, it relaunches itself and ovpn works fine. I suspect that the problem is en0. Launchd tries to launchd openvpn before en0 comes up. That's why I put the NetworkState keyword, but it does not seem to effect *any* startup script. I had issues with dnsmasq also in the recent past. The second problem with this script is that when I unload it via launchd it does not kill the process. Launchd unloads the script and (probably) will not be launchd (if -w is added) in the next boot but daemondo keeps running the process nevertheless. Is this a normal behaviour? I'm not *that* worried about the second. I'd prefer to have a solution about the first one, which is the most important for me. Best regards & thanks in advance Panagiotis (atmosx) Atmatzidis email: atma(a)convalesco.org URL: http://www.convalesco.org GnuPG key id: 0xFC4E8BB4 -- The wise man said: "Never argue with an idiot. They bring you down to their level and beat you with experience."

2 2

Setting environment variables under Snow Leopard advice.
by Benjamin Donnachie 07 Nov '09

07 Nov '09

I currently use a patched version of gpg-agent under launchd control, which previously set the necessary environment variables so that they were accessible system-wide using IPC and SetUserEnvironment. The plist looks like this: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>Label</key> <string>com.sourceforge.macgpg2.gpg-agent</string> <key>ProgramArguments</key> <array> <string>/usr/local/bin/gpg-agent</string> <string>--launchd</string> <string>--use-standard-socket</string> <string>--write-env-file</string> </array> <key>LimitLoadToSessionType</key> <string>Aqua</string> <key>ServiceIPC</key> <true/> </dict> </plist> This worked fine under Leopard but under Snow Leopard the environment variables are not being set. I have had a look through the launchd source, and ServiceIPC and SetUserEnvironment are still present and the developer docs do not seem to cover this case. As gpg-agent caches passphrases it is not suitable for running on demand. I could modify the patch to accept paths from launchd but I would prefer to leave gpg-agent with its default behaviour and just pass the necessary environment variables back to Snow Leopard. Consequently, I should be grateful for any advice regarding the correct implementation under 10.6. Below is an extract of Stéphane Corthésy's gpg-agent launchd patch showing the IPC behaviour. Many thanks, Ben Extract from the gpg-agent launchd patch: // Pass environment variables back to launchd. launch_data_t resp, tmp, tmpv, msg; msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmpv = launch_data_new_string(strchr(infostr, '=') + 1); // Skip variable name and equal sign launch_data_dict_insert(tmp, tmpv, "GPG_AGENT_INFO"); launch_data_dict_insert(msg, tmp, "SetUserEnvironment"); resp = launch_msg(msg); launch_data_free(msg); // Do NOT launch_data_free() on tmp, nor tmpv if (resp) { launch_data_free(resp); } else { log_error ("failed to pass environment variable GPG_AGENT_INFO to launchd: %s\n", strerror (errno)); kill (pid, SIGTERM); exit (1); } if (opt.ssh_support) { msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY); tmpv = launch_data_new_string(strchr(infostr_ssh_sock, '=') + 1); // Skip variable name and equal sign launch_data_dict_insert(tmp, tmpv, "SSH_AUTH_SOCK"); launch_data_dict_insert(msg, tmp, "SetUserEnvironment"); resp = launch_msg(msg); launch_data_free(msg); // Do NOT launch_data_free() on tmp, nor tmpv if (resp) { launch_data_free(resp); } else { log_error ("failed to pass environment variable SSH_AUTH_SOCK to launchd: %s\n", strerror (errno)); kill (pid, SIGTERM); exit (1); }

1 3