- launchd-dev - lists.macosforge.org

Book on using launchd?
by J.B. Nicholson-Owens 05 May '09

05 May '09

Is there a good book or article on using launchd and its future for replacing other program-launching programs? Preferably something with examples to illustrate running launchd in the context of a program? Specifically, I manage multiple labs of Macs all running MacOS X 10.5.6 and I'd like to kick off some processes, some as root, some as the user: - add a link icon to the dock so the user has one-click access to a shared SMB volume. I have been using a Python script to add this dock icon but knowing when to run the Python script is tricky; on some machines this works perfectly every time, on other machines running MacOS X 10.5.6, the dock icon script doesn't run. I'm guessing I want to run this Python script in the dock context but I'm not sure if that's correct. - will launchd replace login/logout scripts run as root? I'd like to clear the print queues on the machine (using CUPS' "cancel -a" run as root) when the user logs out. I'd like to do this without prompting the user for admin credentials (which our users don't have); print jobs left at logout time should simply be cancelled/deleted. - some programs don't take preference settings via MCX (Adobe CS3's Acrobat, for instance) and I'll need to set certain preferences for the user every time they login via a script (turning off Adobe Acrobat's Javascript, for example). I'm trying to limit running scripts as the user to functions our users would like to have done for them, rather than enforcing policy or attempting any security setting by running scripts as the user. It's my hope that by doing this the user won't have any incentive to want to disable running those scripts. Thanks for your help.

3 2

Securing Launch Agents
by Dave Keck 01 May '09

01 May '09

Hey list, I've been writing some security software, part of which is a system-wide agent (stored in /Library/LaunchAgents). I've almost got it working to the point that I'm satisfied for a 1.0 release. That was, until I realized two show-stopping facts. With a short trip to the terminal, any user is able to: 1. Kill the agent 2. Unload the agent using launchctl Well, duh, you might say. When I started out, I assumed that since the write privileges of /Library/LaunchAgents are root:whell, the agents loaded from that directory could only be affected by a user with administrator credentials. Unfortunately for me, that simply ain't so. (Granted, a non-privileged user can only temporarily disable the agent, as it will be reloaded when they logout and back in. But for my purposes, this is still unacceptable.) (Also I should mention that I can't write a daemon because the software must display a UI, and the UI itself is part of what shouldn't be killed without admin credentials.) To me, what I'm trying to do seems reasonable. It'd be nice if the UserName key was respected for agents installed in the system-wide LaunchAgents directory, so the agent would run in the GUI context of a certain user, but would be out-of-reach (to unprivileged users) as far as unloading or killing the process. On the other hand, I suppose respecting the UserName key conflicts with the whole notion of LaunchAgents running on behalf of the current user. Is my request reasonable or am I missing something? I'll also say that I've found a way to do what I need, but it directly violates the 10 Commandments of Launchd Agents. I would be eternally grateful if someone could suggest semi-rule-abiding way to secure a LaunchAgent from being controlled without authorization. Thanks! David

3 3

Re: [launchd-dev] launchd-dev Digest, Vol 21, Issue 6
by Nehemiah Dacres 07 Apr '09

07 Apr '09

I thought this was an open source project? Patches accepted. On Tue, Mar 31, 2009 at 9:31 AM, <launchd-dev-request(a)lists.macosforge.org>wrote: > Send launchd-dev mailing list submissions to > launchd-dev(a)lists.macosforge.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev > or, via email, send a message with subject or body 'help' to > launchd-dev-request(a)lists.macosforge.org > > You can reach the person managing the list at > launchd-dev-owner(a)lists.macosforge.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of launchd-dev digest..." > > > Today's Topics: > > 1. Re: USB on demand (Quinn) > 2. Re: USB on demand (Chris Cleeland) > 3. Re: USB on demand (Damien Sorresso) > 4. Re: USB on demand (Chris Cleeland) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 30 Mar 2009 10:30:52 -0500 > From: Quinn <eskimo1(a)apple.com> > Subject: Re: [launchd-dev] USB on demand > To: launchd-dev(a)lists.macosforge.org > Message-ID: <p06240804c5f695a6466f(a)[192.168.2.18]> > Content-Type: text/plain; charset="us-ascii" ; format="flowed" > > At 02:14 -0400 30/3/09, Chris Hiszpanski wrote: > >What is the status of <rdar://problem/4551362> [...] > > There's been no progress on this, alas. > > S+E > -- > Quinn "The Eskimo!" <http://www.apple.com/developer/> > Apple Developer Relations, Developer Technical Support, Core OS/Hardware > > > ------------------------------ > > Message: 2 > Date: Mon, 30 Mar 2009 10:42:23 -0500 > From: Chris Cleeland <chris.cleeland+launchd(a)gmail.com<chris.cleeland%2Blaunchd(a)gmail.com> > > > Subject: Re: [launchd-dev] USB on demand > To: Quinn <eskimo1(a)apple.com> > Cc: launchd-dev(a)lists.macosforge.org > Message-ID: > <5a4d1dc0903300842g5fdc9064q16a3c19f0ec21532(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > On Mon, Mar 30, 2009 at 10:30 AM, Quinn <eskimo1(a)apple.com> wrote: > > > At 02:14 -0400 30/3/09, Chris Hiszpanski wrote: > > > >> What is the status of <rdar://problem/4551362> [...] > >> > > > > There's been no progress on this, alas. > > > Is there anything anyone outside of Apple can do to push this issue along? >

1 0

Re: [launchd-dev] USB on demand
by Chris Cleeland 30 Mar '09

30 Mar '09

On Mon, Mar 30, 2009 at 10:30 AM, Quinn <eskimo1(a)apple.com> wrote: > At 02:14 -0400 30/3/09, Chris Hiszpanski wrote: > >> What is the status of <rdar://problem/4551362> [...] >> > > There's been no progress on this, alas. Is there anything anyone outside of Apple can do to push this issue along?

2 2

USB on demand
by Chris Hiszpanski 30 Mar '09

30 Mar '09

Hi all, What is the status of <rdar://problem/4551362>, the request to support the launching of a specified program upon detection of a USB device with a specific vendor and product ID (or even any USB device, leaving it to the launched program to determine whether the vendor and product IDs match)? Chris

2 1

KeepAlive / NetworkState
by Keith Mountin 30 Mar '09

30 Mar '09

I am working on a launchd script to keep VNC alive. We are having difficulty using the KeepAlive key with NetworkState. According to the man pages: KeepAlive <boolean or dictionary of stuff> This optional key is used to control whether your job is to be kept continuously running or to let demand and conditions control the invocation. The default is false and therefore only demand will start the job. The value may be set to true to unconditionally keep the job alive. Alternatively, a dictionary of conditions may be specified to selectively control whether launchd keeps a job alive or not. If multiple keys are provided, launchd ORs them, thus providing maximum flexibil- ity to the job to refine the logic and stall if necessary. If launchd finds no reason to restart the job, it falls back on demand based invocation. Jobs that exit quickly and frequently when configured to be kept alive will be throttled to con- verve system resources. SuccessfulExit <boolean> If true, the job will be restarted as long as the program exits and with an exit status of zero. If false, the job will be restarted in the inverse condition. This key implies that "RunAtLoad" is set to true, since the job needs to run at least once before we can get an exit status. NetworkState <boolean> If true, the job will be kept alive as long as the network is up, where up is defined as at least one non-loopback interface being up and having IPv4 or IPv6 addresses assigned to them. If false, the job will be kept alive in the inverse condition. But if I use <key>KeepAlive</key> <dict> <key>NetworkState</key> <true/> </dict> I get "Unknown key for boolean: NetworkState" Does launchd actually support <key>KeepAlive</key> <dict> <key>NetworkState</key> <true/> </dict> Thank you, Keith

3 2

_vprocmgr_move_subset_to_user()
by Stuart Crook 17 Mar '09

17 Mar '09

Hi. Could someone help me understand _vprocmgr_move_subset_to_user() and the environmental conditions which cause a call to it to fail. To explain the context: I'm working with the PureDarwin (www.puredarwin.org ) team, and we've almost got an mutil-user environment up and running. The system is running in standard (ie. not single-user) mode, with the user as root (uid=0, gid=0). A number of daemons including launchd, securityd and DirectoryService are active. "login" will run but fails with the message "Cannot make/remove an entry for the specified session". I've traced the failure down to the pam_launchd module (part of the pam_modules project in Darwin), and specifically to a call to _vprocmgr_move_subset_to_user() (no other failure in this module will produce the exact error code I'm seeing). The following error messages are printed to the system error log: Mar 17 16:50:57 VMDarwin com.apple.launchd[1] (com.apple.launchd.peruser.1000[95]): Root Mach bootstrap cannot be transferred. Mar 17 16:50:57 VMDarwin login[94]: USER_PROCESS: 94 ttys000 Mar 17 16:50:57 VMDarwin com.apple.launchd[95] (0x1010b0.login[94]): Bug: launchd_core_logic.c:6292 (23646):1100: kr == 0 _vprocmgr_move_subset_to_user() is being called with arguments uid=1000 and session_type="StandardIO" (the default, I believe). I've tried following the source (from 258.19) but become lost when I can't find vproc_mig_swap_integer(). So, bearing in mind that this is a version of Darwin assembled from pieces rather than OS X, can anyone suggest why creating a user session like this may fail? What steps do we need to take to assemble an environment which will allow user session creations? Any and all help will be appreciated. (And if you'd like to assemble your own test environment, grab the VMWare image from http://sites.google.com/a/puredarwin.org/puredarwin/downloads/xmas and then follow the instructions here: http://sites.google.com/a/puredarwin.org/puredarwin/developers/network ). Thanks Stuart Crook

2 2

launchd - is my job already loaded?
by Jim Correia 05 Mar '09

05 Mar '09

I have a need for a periodic (in this case, twice per day) per user task. I have written a job file and all works great from the command line using launchctl, but I want to set up this task programatically. Is there an API for launchd/launchctl, or should I just fork+exec launchctl to setup my job? Is there a prettier way to determine if my job is already loaded than to exec `launchctl list` and grep the output? Jim

2 2

10.4 & 10.5 LaunchAgent compatibility
by Steffan A. Cline 05 Mar '09

05 Mar '09

I've been working on a solution to some issues with getting OpenOffice.org.app to work in a headless state but there is some issue with the build that prevents this. So, as a work around I am trying to come up with a LaunchAgent that will load OpenOffice.org on boot and run consistently. It seems I have no choice to use LoginWindow and Aqua to keep it up regardless of whether or not a user is logged in. On 10.4.11 no matter what I do, it does not load at boot. I have to manually load it with launchctl load /Library/LaunchAgents/net.execuchoice.doc-converter.plist Obviously this is not practical. On 10.5.x it loads as expected on boot. My questions are: 1) Am I doing something wrong in the following file? 2) Is there something I can do to get this to work universally for both platforms? (10.4 & 10.5) 3) Is there a way to have this launch regardless of the LoginWindow or Aqua session type rather than have an instance close and relaunch? <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>KeepAlive</key> <true/> <key>OnDemand</key> <false/> <key>RunAtLoad</key> <true/> <key>Label</key> <string>net.execuchoice.doc-converter</string> <key>LimitLoadToSessionType</key> <array> <string>LoginWindow</string> <string>Aqua</string> </array> <key>ProgramArguments</key> <array> <string>/Applications/OpenOffice.org.app/Contents/MacOS/soffice.bin</string> <string>-headless</string> <string>-nologo</string> <string>-nofirststartwizard</string> <string>-invisible</string> <string>-accept="socket,host=127.0.0.1,port=8100;urp;"</string> </array> <key>StandardErrorPath</key> <string>/Library/Logs/OpenOfficeDaemon.log</string> <key>StandardOutPath</key> <string>/Library/Logs/OpenOfficeDaemon.log</string> </dict> </plist> Thanks Steffan --------------------------------------------------------------- T E L 6 0 2 . 7 9 3 . 0 0 1 4 | F A X 6 0 2 . 9 7 1 . 1 6 9 4 Steffan A. Cline Steffan(a)ExecuChoice.net Phoenix, Az http://www.ExecuChoice.net USA AIM : SteffanC ICQ : 57234309 YAHOO : Steffan_Cline MSN : steffan(a)hldns.com GOOGLE: Steffan.Cline Lasso Partner Alliance Member ---------------------------------------------------------------

2 6

What is kicker.xml for Leopard then?
by Robert Nicholson 05 Mar '09

05 Mar '09

So if/when you want to run a script when network state changes what do you do? Other than use NetworkLocation which is a commercial (albeit reasonably priced) piece of software.

2 1