- launchd-dev - lists.macosforge.org

EnableGlobbing no longer supported on OS X 10.10?
by Adam Nohejl 06 Oct '14

06 Oct '14

Dear Launchd list, I use EnableGlobbing in my launchd.plist in order to launch a tool located in a user's directory (this way I can use ~ and I do not need to hard-wire the user's directory path, which can of course change any time, even in OS X[^1]). On OS X 10.10 GM candidate, the key is still documented in the man page and I can even see a new LAUNCH_JOBKEY_ENABLEGLOBBING in the XPC API diffs. But in reality, I see this: com.apple.xpc.launchd[1]: (my.bundle.id) The EnableGlobbing key is no longer respected. Please remove it. Why is the key being removed? Is there going to be any replacement for referring to paths in user's home directory? [^1]: http://support.apple.com/kb/HT1428?viewlocale=en_US&locale=en_US -- Adam Nohejl, Lokiware http://lokiware.info twitter: @lokiware

5 5

Replacing the env variable set by SecureSocketWithKey.
by Mihai Moldovan 06 Jul '14

06 Jul '14

Hi, I hope this list is still active. I haven't seen any posts on 2014 yet. I'm currently trying to make gpg-agent launchd-compatible. The plist for my LaunchAgent specifies SecureSocketWithKey for "GPG_AGENT_INFO". This is, correctly, setting GPG_AGENT_INFO to the socket path created by launchd. However, things are getting complicated here. I need GPG_AGENT_INFO to be "sockpath:PID:1". As far as I understood, I can pass environment values to launchd via launch_msg(), passing them as dict entries (launch_data_dict_insert()). This doesn't seem to work for GPG_AGENT_INFO, though, most likely because SecureSocketWithKey is taking control of that env var. I can remove the Socket part from the agent's plist and get a "correct" value in GPG_AGENT_INFO, alas, the UNIX socket is not within launchd's control but created by the gpg-agent daemon. What I'd ultimately like to have is the following: letting launchd handle UNIX socket creation and management (like SecureSocketWithKey, but not have any environment variable set by launchd "yet"), fetch/query the generated sockpath from launchd within gpg-agent and then pass back GPG_AGENT_INFO with a "sane" value gpg-agent expects to launchd, so that it is available session-wide. Defining an empty "<string/>" for SecureSocketWithKey so that launchd creates no env var seems to work fine. I'm having problems retrieving the sockpath, though. Reading launchd's source code, I've gathered from support/launchctl.c that LAUNCH_JOBSOCKETKEY_SECUREWITHKEY is just a wrapper and actually adds a LAUNCH_JOBSOCKETKEY_PATHNAME dict with the secure socket path to the data array. However, I have been unable to query a LAUNCH_JOBSOCKETKEY_PATHNAME from a socket dict returned by launch_data_dict_lookup(checkin_response, LAUNCH_JOBKEY_SOCKETS); Any idea how I can get this data? Any help is appreciated. :) Best regards, Mihai

1 1

Can a launchd job get any access to its invoking plist?
by Norman Gray 23 Dec '13

23 Dec '13

Greetings. Can a launchd job get any access to its invoking plist? I'm writing a small application intended to be invoked, almost exclusively, from launchd. Its interface would be simpler if it could read the contents of the dictionary/plist which controls the job which launchd starts. It could potentially be invoked by more than one plist, and I'd like to preserve state keyed on (say) the job Label; it's invoked based on the WatchPaths element, and if it could see that key in the dictionary, then these paths wouldn't have to be duplicated in the ProgramArguments. I can work round the problem, but it feels like I'm missing a trick. Is there any way to get access to this dictionary; or (since I know about SMJobCopyDictionary) is there any way to get access to the job's Label? The existence of SMJobCopyDictionary indicates that this information is available in principle. I can't think of anything to google that gives me more than tutorials on using launchd. I've tried asking on StackOverflow <http://stackoverflow.com/questions/20338636/>, but without success (the answer there is sensible, but somewhat tangential to the question). Thanks for any pointers. Best wishes, Norman -- Norman Gray : http://nxg.me.uk SUPA School of Physics and Astronomy, University of Glasgow, UK

4 8

Permissions/ownership for a per-user launch agent
by Mitchell J Laurren-Ring 03 Dec '13

03 Dec '13

I have a per-user agent that needs to be able to access the default printer for the current user. I'm having problems figuring out how to load it in the current user context from my installer postflight script. If I use "launchctl load" without sudo from Terminal, my agent loads correctly in the current user context and is able to access the user's default printer. If I load using sudo from Terminal, my agent cannot get the user's default printer. I have the following at the end of my postflight script: > chmod 755 /Library/Application\ Support/MyFolder/myd > chmod 644 /Library/LaunchAgents/com.mycompany.myd.plist > launchctl load -w /Library/LaunchAgents/com.mycompany.myd.plist The problem is that my postflight script is running as root which results in the launchctl command being executed as root, leading to the problem with not being able to access the default printer. There seem to be a few options I could use to fix this issue but most of them are poorly documented. Among these are: * The ProcessType, UserName and GroupName keys in the launchd.list * The -s sessiontype option for launchctl load * This note from the launchctl man page: "Note that per-user configuration files (LaunchAgents) must be owned by the user loading them." In case it helps, here is the plist that I install into /Library/LaunchAgents: <dict> <key>Label</key> <string>com.mycompany.myd</string> <key>Debug</key> <true/> <key>ProgramArguments</key> <array> <string>/Library/Application Support/MyFolder/myd</string> <string>launchd</string> </array> <key>Sockets</key> <dict> <key>PrimaryListeningSocket</key> <dict> <key>SockServiceName</key> <string>2687</string> <key>SockNodeName</key> <string>localhost</string> <key>SockFamily</key> <string>IPv4</string> </dict> </dict> </dict> /Mick

2 1

launchd keeps re-launching my binary in /Library/PrivilegedHelperTools
by Anshul Kothari 01 Nov '13

01 Nov '13

Hi, I am installing a privileged helper tool binary using *SMJobBless*<https://developer.apple.com/library/mac/samplecode/SMJobBless/Listings/Read…>that will be used to update my application in background without asking for password. Now, the problem is, once the helper tool is installed, it keeps getting launched again and again even if it completes its job successfully. I have tried various things to stop it from launching again like making it sleep for at least 15 seconds before quitting; toggling RunAtLoad, KeepAlive/SuccessfulExit keys in its plist but in vain. I have got a way by which it works i.e. setting KeepAlive with PathState<https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManP…>key in the plist (see below); the launcher program can create a file at pre-determined path so that launchd launches helper tool and helper tool can remove that file before quitting so that launchd doesn’t launch it again. But I am not happy with it as it looks little hacky to me. I would rather call an [NSConnection connectionWithRegisteredName: host:] to launch it but with that the above problem of launching again and again starts occurring. My binary always returns 0. The launchd .plist is as below: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" " http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <key>Label</key> <string>com.ak.SMJobBlessHelper</string> <key>MachServices</key> <dict> <key>com.ak.SMJobBlessHelper.mach</key> <true/> </dict> <key>ProgramArguments</key> <array> <string>/Library/PrivilegedHelperTools/com.ak.SMJobBlessHelper</string> </array> <key>RunAtLoad</key> <true/> </plist> I further tried the below but in vain: 1. Tried to add KeepAlive to false in the plist. 2. Tried to add KeepAlive as a dictionary with the key SuccessfulExit to false. 3. Tried to make my app sleep for occult times before quitting like sleeping for 5 minutes, 10 minutes etc. but it still gets launched again. The one way I have got it to work is by adding “KeepAlive with PathState”: <dict> <key>PathState</key> <dict> <key>/tmp/*helper.txt*</key> <true/> </dict> </dict> So, whenever my launcher creates the “helper.txt” file, launchd launches my binary (com.ak.SMJobBlessHelper) and then my binary deletes “helper.txt” before quitting so that launchd doesn’t launch it again. But I am not sure if it is a good way to do this. More info: This is OSX and it is a LaunchDaemon. I have not tried by removing Mach Services as I use them to launch it on demand. Actually this is a binary used by the updater and not the updater itself. I don’t care about the RunAtLoad value as I want to call it on demand using the mach services – I had put it there initially so that the thing launches right after installation. However, I have tried by removing RunAtLoad but it still does not work and it keeps re-launching. The approaches of StartInterval/StartCalendarInterval are good (that binary automatically starts after some time) but neither of the approaches works for me as I want to launch it on demand (I will have to change my design quite a bit if I want to start using this approach). It would be great if some could tell why it may be happening and if it could be launched on demand and doesn’t keep re-launching. Thanks, Anshul

2 1

The entitlement of build-in SSL VPN
by 朱立韬 21 Oct '13

21 Oct '13

Hello, we are looking for a solution that allow people to access to our internal network securely through a SSL VPN channel.Because we've customize the SSL protocl,so the traditional VPN and the VPN On-Demand can't meet our requirments.The issue is that we need entitlement to build a system wide SSL VPN.As I know Apple has some list of people who are interested and you invite some of these people(on your descretion),like Cisco AnyConnect,OpenVPN Connect.How can we get permission to use the SSL VPN private interface？Looking forward to your reply.Thank you. -- Best Regards, Slin

1 0

The entitlement of build-in SSL VPN
by 朱立韬 21 Oct '13

21 Oct '13

Hello, we are looking for a solution that allow people to access to our internal network securely through a SSL VPN channel.Because we've customize the SSL protocl,so the traditional VPN and the VPN On-Demand can't meet our requirments.The issue is that we need entitlement to build a system wide SSL VPN.As I know Apple has some list of people who are interested and you invite some of these people(on your descretion),like Cisco AnyConnect,OpenVPN Connect.How can we get permission to use the SSL VPN private interface？Looking forward to your reply.Thank you. -- Best Regards, Slin

1 0

Specify network interface?
by Todd Heberlein 14 Oct '13

14 Oct '13

I have a network service I launch via launchd. Is it possible to configure the launchd plist to have it only respond to connection requests on a certain network interface? In particular, I want to only allow connection requests from localhost. Thanks, Todd

2 2

Re: [launchd-dev] Starting Agents in specific GUI sessions
by NuSkooler 21 Aug '13

21 Aug '13

Thank you again for all of your replies! My current plan for OS X is to register my Agent with launchd to start at user login (e.g. once per session) and use the clean exit code members of the plist to keep it alive unless explicitly shut down cleanly (In other words, keep it alive in case it crashes; else let it exit) As I mentioned, on Windows we do spawn some "Agent" processes on demand in user(s) session spaces. I may be able to modify this slightly, but if not, from what I understand this is the appropriate approach: daemon (launchd spawned as daemon) -> {IPC} -> agent_shim (launchd spawned as login agent) -> execute real_agent (will be in users context) This seems like a fair approach, if needed. As far as questions about "asuser": In 10.8 at least, this will create a process as the user, but in the context of the launchd that launchctl talked to. The rules for this can be seen in the launchctl code, but basically if EUID or UID are root, use the root/system launchd, else use the current users's launchd. TL;DR, it doesn't allow you to change the session the process is launched in, only the user it's run as. Bryan

1 0

Re: [launchd-dev] Starting Agents in specific GUI sessions
by NuSkooler 21 Aug '13

21 Aug '13

Thanks for the reply -- Our product is a Parental Controls product. The kernel module is responsible for traffic capture that, if it's interesting is then proxied to/from the user space (running as root on *nix, system on Windows, etc.) daemon. The daemon in turn occasionally needs to display UI to users. A user may be in any graphical session on the box (e.g. Windows or OS X Fast User Switching, Screen Sharing, ...). The UI itself is more than just notifications. We allow decisions to be made by the user, prompt to login to our product in some situations, etc. The "backup plan" on OS X is to use the /Library/LaunchAgents plist system so start agents at user login. This works for most of the cases, but there are times such as in our update process that we need to stop all agents -> update them -> restart them. Hope that helps clarify, Bryan On Thu, Aug 15, 2013 at 6:35 PM, Jerry Krinock <jerry(a)ieee.org> wrote: > Hello, Bryan. Processes launched by agents can spawn other processes, and > these other processes may be GUI processes. Processes may also install and > load additional launch agents. Non-GUI processes (processes without a > connection to the window server) can show rudimentary alerts using the > CFUserNotification API. > > Maybe we need to know a little more about what you're trying to do. > >

4 6