Nabble - Launchd

Re: multiple commands in one launchd item

2009-12-15T05:38:55Z

Hi Scott,

It should be:

/bin/bash
-c
code; code; code

on separate item lines.

The file redirection should be:

bin/echo "this is a test" >> /tmp/filename

in at least bash. The man page of echo utility does say that
the command line should be similar or identical to the shell
command.

A.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: multiple commands in one launchd item

2009-12-14T23:26:13Z

Thanks Damien, comments, below. I am working with an already
installed app to add value to it, so there is a limited amount of
stuff I can install before the user may feel I a installing too much.
If I can get away with one plist I would love it.

The general goal is
1) Run installed
2) install launchd item in /Library/LaunchDaemons/
3) Run on schedule of load, and 300 seconds
a) chown 0:0 a specific file in the logded in users dir
b) set the executable bit to that file.

Yes, I can put that in a shell script, I am trying to keep it as
simple as possible. Having two commands in a plist does not seem like
a lot.

My tests below were bad, but I did not want to give too much of my
idea away, so I worked out some basic tests that ended up on my
desktop. Sorry about that. I do always use full paths, I always
assume ENV and PATH are going to be non known.

More below...

On Dec 13, 2009, at 3:07 PM, Damien Sorresso wrote:

> On Dec 12, 2009, at 6:46 PM, Scott Haneda wrote:
>> If I can run a command in the terminal, should it also be possible
>> to put that entire command into a launchhd plist?
>>
>> For example, this will work in a shell, as a one liner:
>> cd /Users/me/Desktop; mkdir zzzzzzzz; cd zzzzzzzz; touch test;
>> chown 0:0 test; rm -rf /Users/me/Desktop/zzzzzzzz;
>>
>> Putting that into a plist, I get errors to syslog:
>> Dec 12 18:37:23 macbook com.test.me.test.foo[1596]: /usr/bin/cd:
>> line 4: cd: /Users/me/Desktop;: No such file or directory
>> Dec 12 18:37:23 macbook com.apple.launchd[1]
>> (com.test.me.test.foo[1596]): Exited with exit code: 1
>>
>> Here is how I have tried it:
>> <?xml version="1.0" encoding="UTF-8"?>
>> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd
>> ">
>> <plist version="1.0">
>> <dict>
>> <key>Label</key>
>> <string>com.test.me.test.foo</string>
>> <key>ProgramArguments</key>
>> <array>
>> <string>cd</string>
>> <string>/Users/me/Desktop;</string>
>> <string>mkdir</string>
>> <string>zzzzzzzz;</string>
>> <string>cd</string>
>> <string>zzzzzzzz;</string>
>> <string>touch</string>
>> <string>test;</string>
>> <string>chown</string>
>> <string>0:0</string>
>> <string>test;</string>
>> <string>rm</string>
>> <string>-rf</string>
>> <string>/Users/me/Desktop/zzzzzzzz;</string>
>> </array>
>> <key>RunAtLoad</key>
>> <true/>
>> <key>StartInterval</key>
>> <integer>10</integer>
>> </dict>
>> </plist>
>>
>> I have also tried removing the ";" terminator, and reloading, that
>> does not seem to work either. I am resoting to shoving these
>> commands into a shell script, which launchd will then call. This
>> works, but is one more file I need to manage, and wold love to be
>> able to manage this in one launchd file.
>>
>> My goal, it to have a schedule, once every 5 minutes, it will chown
>> 0:0 a file, and set the executable bit on it. So something like
>> cd /Users/me/.hidden; chown 0:0 .runner; chmod +x .runner;
>
> Several things. Firstly, launchd is not a shell interpreter, so
> please don't assume that it acts like one or makes the same
> guarantees. launchd jobs consist of a plist describing the job and
> an executable file that will be run. This is our model, and your
> deployment scenario clearly allows for you being able to install a
> plist into /Library/LaunchDaemons, so there's no reason you couldn't
> also deploy a shell script to, say, /usr/local/bin.

Trying to not deploy a file a file is I need not too, that is the goal
at least. Setting 0:0 on a file and +x on it is all I want to do. I
have to find out the users login name so I know where the file is I
want to act on, but that should not be too hard.

Suggestions welcome.

> Secondly, you're doing yourself a disservice by putting the commands
> in the launchd.plist directly, because you are forcing yourself to
> reload the plist every time you make a change to the embedded
> script. If you just point to an executable file on-disk, you can
> change it to your heart's content without ever having to reload the
> launchd job.

This plist acts as an emergency item, the idea is it should never be
used, in the event it is used, it may save your life, otherwise, it
should just run, every 5 minutes, and do nothing other than keep those
permissions and +x set.

> Thirdly, you should be specifying the full paths to these commands
> in your shell script or guaranteeing that your PATH is sanitized,
> just as a matter of best practices.

Yeah, my bad, I always do, I was just being sloppy in my testing as I
have been down the road so many times before, I sort of knew it did
not matter in that case.

> This kind of sanitation is much easier to accomplish in a single
> shell script file. (Remember, launchd doesn't make any guarantees
> about what its PATH is or what PATH its jobs will inherit.)

Noted, thanks.

> Fourthly, you're clearly working with your own user account here, so
> this job should be an agent, not a daemon, so that the files you
> create are created with the proper ownership and permissions.

Just in testing, as I need the ability to set chown 0:0, I will need
to be in /Library/LaunchDaemons/ when all is said and done. I will
make a nice OS X installer for it as well.

> Lastly, if you're absolutely dead-set on doing things this way,

For this one, yes, in every other case, no, I have 20's of shell
sccipts in ~/bin/whatever that do things, and each is called by a
launchd items, I like it that was, as I can test it and not play the
unlod/load game all the time.

> you have to again remember that launchd is not a shell interpreter,
> so those commands have no syntactical meaning to it. It just sees "/
> Users/me/Desktop;" and copies *that entire string* as the argument.
> Since it's not a shell interpreter, the ending semi-colon doesn't
> carry any meaning. It's just the second argument you want passed
> into an execve(3) call with "cd" as its first argument.
>
> What you should be doing is specifying a Program pointing to the
> shell of your choice (i.e. "/bin/bash"), followed by the appropriate
> flag to ask the shell to interpret the argument following as a
> script ("-c" for bash).

So for example, just to be sure I have this right:

<key>ProgramArguments</key>
<array>
<string>/bin/bash -c cd /Users/useranme/.hidden/commander; \
/usr/sbin/chown0:0 /Users/useranme/.hidden/commander; \
/bin/chmod +x /Users/useranme/.hidden/commander;
</string>

* Probably have to do that all on one line and nick the \ but is that
the general idea?

Or is it:
<key>ProgramArguments</key>
<array>
<string>/bin/bash -c /usr/bin/cd /Users/useranme/.hidden/commander; \
/bin/bash -c /usr/sbin/chown0:0 /Users/useranme/.hidden/commander; \
/bin/bash -c /bin/chmod +x /Users/useranme/.hidden/commander;
</string>

I will probably hand write the plist pre-install to hard code the
username into it, so there is no chance at all dfor confusion.

Thanks for your pointers.

Just out of curiosity, why does this not work in launchd?
<string>/bin/echo "test" >> "/tmp/this is a test"</string>

--
Scott * If you contact me off list replace talklists@ with scott@ *

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: [clamav] launchdaemon executes clamdscan several times when scanning

2009-12-14T08:45:10Z

Thanks.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: [clamav] launchdaemon executes clamdscan several times when scanning

2009-12-14T03:48:41Z

Hi,

Missing arguments are considered to be wildcard.
You should add the "Minute" key and set it to "0" (or whatever you like).

Regards,
Thomas

On Dec 14, 2009, at 12:20 PM, dev.admin@... wrote:

> Hi,
>
> Back to the original purpose of launchd...
>
> I've installed clamav, 64bit, and wrote a LaunchDaemon to
> execute once a day at a certain time on a certain volume.
>
> However, when the LaunchDaemon executes, it seems to scan
> the volume several times. At first I though it was clamav
> but I then wrote a bash script that adds an entry to the
> log file, executes clamdscan and then adds another log
> entry.
>
> Any ideas would be appreciated.
>
> A.
>
>
> LaunchDaemon
> ------------
> <?xml version="1.0" encoding="UTF-8"?>
> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
> <plist version="1.0">
> <dict>
> <key>Disabled</key>
> <false/>
> <key>Label</key>
> <string>net.clamav.clamdscan.app</string>
> <key>Program</key>
> <string>/Volumes/usr/arc_sys/scripts.bash/net.localhost.clamd.app.sh</string>
> <key>StartCalendarInterval</key>
> <dict>
> <key>Hour</key>
> <integer>9</integer>
> </dict>
> </dict>
> </plist>
>
> Bash script (net.localhost.clamd.app.sh)
> ----------------------------------------
> #!/bin/bash
> LOG=/Volumes/gnu/sec/var/log/clamav/clamd.log
> APP=/Volumes/gnu/sec/usr/bin/clamdscan
> OBJ=/Volumes/app
> # append start timestamp to log
> echo $(date "+%a %b %d %T %Y") "-> *** Started scanning: $OBJ" >> $LOG
> # start scan
> /Volumes/gnu/sec/usr/clamav/bin/clamdscan $OBJ
> # append finish timestamp to log
> echo $(date "+%a %b %d %T %Y") "-> *** Finished scanning: $OBJ" >> $LOG
>
> Log file (clamd.log)
> --------------------
> Mon Dec 14 09:00:00 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 09:13:53 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 09:13:54 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 09:28:06 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 09:28:06 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 09:41:27 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 09:41:27 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 09:54:55 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 09:54:55 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 10:00:00 2009 -> *** Started scanning: /Volumes/app
> Mon Dec 14 10:06:38 2009 -> *** Finished scanning: /Volumes/app
> Mon Dec 14 10:06:38 2009 -> *** Started scanning: /Volumes/app
> Mon Dec 14 10:11:51 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 10:11:51 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 10:12:45 2009 -> *** Finished scanning: /Volumes/app
> Mon Dec 14 10:12:45 2009 -> *** Started scanning: /Volumes/app
> Mon Dec 14 10:17:53 2009 -> *** Finished scanning: /Volumes/app
> Mon Dec 14 10:17:53 2009 -> *** Started scanning: /Volumes/app
> Mon Dec 14 10:24:26 2009 -> *** Finished scanning: /Volumes/app
> Mon Dec 14 10:24:26 2009 -> *** Started scanning: /Volumes/app
> Mon Dec 14 10:30:31 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 10:30:31 2009 -> *** Finished scanning: /Volumes/app
> Mon Dec 14 10:30:31 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 10:44:22 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 10:44:22 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 11:02:02 2009 -> *** Finished scanning: /Volumes/usr
> Mon Dec 14 11:02:02 2009 -> *** Started scanning: /Volumes/usr
> Mon Dec 14 11:15:38 2009 -> *** Finished scanning: /Volumes/usr
>
> _______________________________________________
> launchd-dev mailing list
> launchd-dev@...
> http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev
>

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

[clamav] launchdaemon executes clamdscan several times when scanning

2009-12-14T03:20:00Z

Hi,

Back to the original purpose of launchd...

I've installed clamav, 64bit, and wrote a LaunchDaemon to
execute once a day at a certain time on a certain volume.

However, when the LaunchDaemon executes, it seems to scan
the volume several times. At first I though it was clamav
but I then wrote a bash script that adds an entry to the
log file, executes clamdscan and then adds another log
entry.

Any ideas would be appreciated.

A.

LaunchDaemon
------------
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd
">
<plist version="1.0">
<dict>
<key>Disabled</key>
<false/>
<key>Label</key>
<string>net.clamav.clamdscan.app</string>
<key>Program</key>
<string>/Volumes/usr/arc_sys/scripts.bash/net.localhost.clamd.app.sh</
string>
<key>StartCalendarInterval</key>
<dict>
<key>Hour</key>
<integer>9</integer>
</dict>
</dict>
</plist>

Bash script (net.localhost.clamd.app.sh)
----------------------------------------
#!/bin/bash
LOG=/Volumes/gnu/sec/var/log/clamav/clamd.log
APP=/Volumes/gnu/sec/usr/bin/clamdscan
OBJ=/Volumes/app
# append start timestamp to log
echo $(date "+%a %b %d %T %Y") "-> *** Started scanning: $OBJ" >> $LOG
# start scan
/Volumes/gnu/sec/usr/clamav/bin/clamdscan $OBJ
# append finish timestamp to log
echo $(date "+%a %b %d %T %Y") "-> *** Finished scanning: $OBJ" >> $LOG

Log file (clamd.log)
--------------------
Mon Dec 14 09:00:00 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 09:13:53 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 09:13:54 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 09:28:06 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 09:28:06 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 09:41:27 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 09:41:27 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 09:54:55 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 09:54:55 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 10:00:00 2009 -> *** Started scanning: /Volumes/app
Mon Dec 14 10:06:38 2009 -> *** Finished scanning: /Volumes/app
Mon Dec 14 10:06:38 2009 -> *** Started scanning: /Volumes/app
Mon Dec 14 10:11:51 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 10:11:51 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 10:12:45 2009 -> *** Finished scanning: /Volumes/app
Mon Dec 14 10:12:45 2009 -> *** Started scanning: /Volumes/app
Mon Dec 14 10:17:53 2009 -> *** Finished scanning: /Volumes/app
Mon Dec 14 10:17:53 2009 -> *** Started scanning: /Volumes/app
Mon Dec 14 10:24:26 2009 -> *** Finished scanning: /Volumes/app
Mon Dec 14 10:24:26 2009 -> *** Started scanning: /Volumes/app
Mon Dec 14 10:30:31 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 10:30:31 2009 -> *** Finished scanning: /Volumes/app
Mon Dec 14 10:30:31 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 10:44:22 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 10:44:22 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 11:02:02 2009 -> *** Finished scanning: /Volumes/usr
Mon Dec 14 11:02:02 2009 -> *** Started scanning: /Volumes/usr
Mon Dec 14 11:15:38 2009 -> *** Finished scanning: /Volumes/usr

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: launchd and hdiutils

2009-12-14T01:43:21Z

At 14:10 +0100 11/12/09, Thomas Fritz wrote:
>I want to use launchd to mount an encrypted dmg image which contains
>my home directory (AES 256 - enterprise encryption guidelines ) and
>other directories i want to encrypt like /tmp, etc ...

You're not going to be able to do this reliably via launchd. The
problem, regardless of the hdiutil issues, is that system startup is
asynchronous, with implicit dependency tracking via service
provision. Thus, if you put your hdiutil stuff is a launchd daemon,
there's no guarantee that daemon will run /before/ the user has
logged in, because the login process does not use any of the services
provided by your daemon.

The best solution to this problem IMO would be to structure your code
as a login agent. This has a couple of benefits:

o It runs synchronously with respect to login.

o You can access the password that the user provided for login.

o You can access the GUI, if necessary, to request a password.

For more details on this, see TN2228 "Running At Login".

<http://developer.apple.com/mac/library/technotes/tn2008/tn2228.html>

S+E
--
Quinn "The Eskimo!" <http://www.apple.com/developer/>
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: multiple commands in one launchd item

2009-12-13T23:07:01Z

On Dec 13, 2009, at 8:05 PM, dev.admin@... wrote:

> Hi,
>
> Just spent *hours* experimenting with this and although it
> is possible to add several commands into a LaunchDaemon using
> the previously mention ProgramArguments from Damien
> i.e. /bin/bash -c *code* as separate items, you can only use
> one item line for the entire script. It's not long before it
> becomes unreadable.
>
> All-in all, as Nehemiah mentioned, if it can go into a script,
> it probably should go into a script.
>
> However, all LaunchDaemon external scripts should have the same
> level of permissions as a LaunchDaemon plist file. Otherwise
> it's a potential security threat. The contents of the external
> file could be changed to whatever.
>
> The owner/group should be root/wheel and the mode 0755.

launchd will enforce the required ownership.
--
Damien Sorresso
BSD Engineering
Apple Inc.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

multiple commands in one launchd item

2009-12-13T20:05:02Z

Hi,

Just spent *hours* experimenting with this and although it
is possible to add several commands into a LaunchDaemon using
the previously mention ProgramArguments from Damien
i.e. /bin/bash -c *code* as separate items, you can only use
one item line for the entire script. It's not long before it
becomes unreadable.

All-in all, as Nehemiah mentioned, if it can go into a script,
it probably should go into a script.

However, all LaunchDaemon external scripts should have the same
level of permissions as a LaunchDaemon plist file. Otherwise
it's a potential security threat. The contents of the external
file could be changed to whatever.

The owner/group should be root/wheel and the mode 0755.

A.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

multiple commands in one launchd item

2009-12-13T16:00:54Z

For example, this will work in a shell, as a one liner:
cd /Users/me/Desktop; mkdir zzzzzzzz; cd zzzzzzzz; touch test; chown
0:0 test; rm -rf /Users/me/Desktop/zzzzzzzz;

if it works in the shell, try putting it in a shell script. I dont think that's how Launchd is supposed to work

--

"lalalalala! it's not broken because I can use it"

http://linux.slashdot.org/comments.pl?sid=194281&threshold=1&commentsort=0&mode=thread&cid=15927703

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: multiple command lines in launchd.

2009-12-13T15:33:00Z

On Dec 13, 2009, at 3:25 PM, Scott Haneda wrote:
> On Dec 13, 2009, at 2:46 PM, dev.admin@... wrote:
>> stumbled across a book (in google) that gives you
>> can example of just this. Haven't tried it, but I'm
>> having the same problem with something else.
>
> What are you getting stuck on specifically? One thing I've never gotten to work, even as a single command, is any form of redirection command.
>
> So 'echo "something" >> /tmp/testfile' has never worked at al. I just get an exit code in syslog.

launchd is not a shell intepreter. ">>" is just another string to it. If you want to redirect a job's stdout, you should use the StandardOutPath plist key. Were your job a typical launchd job (with a shell script on-disk that was executed), this wouldn't be a problem.

> If anyone has specific data on how to best debug these cases, and get more verbosity in the logs, I would love to know how.

`sudo launchctl log level debug`

Then edit your /etc/syslog.conf file, changing the first line from

> *.notice;authpriv,remoteauth,ftp,install,internal.none /var/log/system.log

to

> *.debug;authpriv,remoteauth,ftp,install,internal.none /var/log/system.log

Then `sudo killall -HUP syslogd`. Note that this will dump a *ton* of stuff into your syslog.

But in your case, extra logging won't help. There's no bug in launchd here.
--
Damien Sorresso
BSD Engineering
Apple Inc.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: multiple command lines in launchd.

2009-12-13T15:25:22Z

On Dec 13, 2009, at 2:46 PM, dev.admin@... wrote:

stumbled across a book (in google) that gives you
can example of just this. Haven't tried it, but I'm
having the same problem with something else.

What are you getting stuck on specifically? One thing I've never gotten to work, even as a single command, is any form of redirection command.

So 'echo "something" >> /tmp/testfile' has never worked at al. I just get an exit code in syslog.

If anyone has specific data on how to best debug these cases, and get more verbosity in the logs, I would love to know how.

I've resisted just using cron for as long as I can, what was easy and "just worked" in cron, can be a little hit or miss with launchd.

I do love to more granular control over time and other events that can act as the trigger for the work I am asking launchd to do. That's a huge win over cron. Triggers based on a file changing, that took a lot of duct tape to work with cron.

The link to the book is:
http://books.google.com/books?id=OoTAWXH6z48C&pg=PT468&dq=launchd&cd=8#v=onepage&q=launchd&f=false

If that doesn't work then search for 'launchd' and the
book called Enterprise Mac Administrators Guide page
452 to 453, Self-destructing scripts.

Thank you! I will take a look at those resources shortly and report back.

Although I can't confirm this yet, I *think* you can
put an entire line on each item terminated with a
semi-colon.

Duh, why did I never think about that method. I mostly use other plist files to learn. Since I've only seen multi-command statements as seoarate strings in the array, one for each command, I never thought to combine them.

If you do get it to work, confirmation on this list
would be appreciated.

For sure. Whatever I discover I will report back here.

Thank you for you research and suggestions.

Scott

Iphone says hello.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: multiple commands in one launchd item

2009-12-13T15:07:07Z

On Dec 12, 2009, at 6:46 PM, Scott Haneda wrote:

> If I can run a command in the terminal, should it also be possible to put that entire command into a launchhd plist?
>
> For example, this will work in a shell, as a one liner:
> cd /Users/me/Desktop; mkdir zzzzzzzz; cd zzzzzzzz; touch test; chown 0:0 test; rm -rf /Users/me/Desktop/zzzzzzzz;
>
> Putting that into a plist, I get errors to syslog:
> Dec 12 18:37:23 macbook com.test.me.test.foo[1596]: /usr/bin/cd: line 4: cd: /Users/me/Desktop;: No such file or directory
> Dec 12 18:37:23 macbook com.apple.launchd[1] (com.test.me.test.foo[1596]): Exited with exit code: 1
>
> Here is how I have tried it:
> <?xml version="1.0" encoding="UTF-8"?>
> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
> <plist version="1.0">
> <dict>
> <key>Label</key>
> <string>com.test.me.test.foo</string>
> <key>ProgramArguments</key>
> <array>
> <string>cd</string>
> <string>/Users/me/Desktop;</string>
> <string>mkdir</string>
> <string>zzzzzzzz;</string>
> <string>cd</string>
> <string>zzzzzzzz;</string>
> <string>touch</string>
> <string>test;</string>
> <string>chown</string>
> <string>0:0</string>
> <string>test;</string>
> <string>rm</string>
> <string>-rf</string>
> <string>/Users/me/Desktop/zzzzzzzz;</string>
> </array>
> <key>RunAtLoad</key>
> <true/>
> <key>StartInterval</key>
> <integer>10</integer>
> </dict>
> </plist>
>
> I have also tried removing the ";" terminator, and reloading, that does not seem to work either. I am resoting to shoving these commands into a shell script, which launchd will then call. This works, but is one more file I need to manage, and wold love to be able to manage this in one launchd file.
>
> My goal, it to have a schedule, once every 5 minutes, it will chown 0:0 a file, and set the executable bit on it. So something like cd /Users/me/.hidden; chown 0:0 .runner; chmod +x .runner;

Several things. Firstly, launchd is not a shell interpreter, so please don't assume that it acts like one or makes the same guarantees. launchd jobs consist of a plist describing the job and an executable file that will be run. This is our model, and your deployment scenario clearly allows for you being able to install a plist into /Library/LaunchDaemons, so there's no reason you couldn't also deploy a shell script to, say, /usr/local/bin.

Secondly, you're doing yourself a disservice by putting the commands in the launchd.plist directly, because you are forcing yourself to reload the plist every time you make a change to the embedded script. If you just point to an executable file on-disk, you can change it to your heart's content without ever having to reload the launchd job.

Thirdly, you should be specifying the full paths to these commands in your shell script or guaranteeing that your PATH is sanitized, just as a matter of best practices. This kind of sanitation is much easier to accomplish in a single shell script file. (Remember, launchd doesn't make any guarantees about what its PATH is or what PATH its jobs will inherit.)

Fourthly, you're clearly working with your own user account here, so this job should be an agent, not a daemon, so that the files you create are created with the proper ownership and permissions.

Lastly, if you're absolutely dead-set on doing things this way, you have to again remember that launchd is not a shell interpreter, so those commands have no syntactical meaning to it. It just sees "/Users/me/Desktop;" and copies *that entire string* as the argument. Since it's not a shell interpreter, the ending semi-colon doesn't carry any meaning. It's just the second argument you want passed into an execve(3) call with "cd" as its first argument.

What you should be doing is specifying a Program pointing to the shell of your choice (i.e. "/bin/bash"), followed by the appropriate flag to ask the shell to interpret the argument following as a script ("-c" for bash).
--
Damien Sorresso
BSD Engineering
Apple Inc.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: multiple command lines in launchd.

2009-12-13T14:46:46Z

Hi Scott,

I stumbled across a book (in google) that gives you
can example of just this. Haven't tried it, but I'm
having the same problem with something else.

The link to the book is:
http://books.google.com/books?
id=OoTAWXH6z48C&pg=PT468&dq=launchd&cd=8#v=onepage&q=launchd&f=false

If that doesn't work then search for 'launchd' and the
book called Enterprise Mac Administrators Guide page
452 to 453, Self-destructing scripts.

Although I can't confirm this yet, I *think* you can
put an entire line on each item terminated with a
semi-colon.

If you do get it to work, confirmation on this list
would be appreciated.

A.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

multiple commands in one launchd item

2009-12-12T18:46:55Z

If I can run a command in the terminal, should it also be possible to
put that entire command into a launchhd plist?

For example, this will work in a shell, as a one liner:
cd /Users/me/Desktop; mkdir zzzzzzzz; cd zzzzzzzz; touch test; chown
0:0 test; rm -rf /Users/me/Desktop/zzzzzzzz;

Putting that into a plist, I get errors to syslog:
Dec 12 18:37:23 macbook com.test.me.test.foo[1596]: /usr/bin/cd: line
4: cd: /Users/me/Desktop;: No such file or directory
Dec 12 18:37:23 macbook com.apple.launchd[1]
(com.test.me.test.foo[1596]): Exited with exit code: 1

Here is how I have tried it:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd
">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.test.me.test.foo</string>
<key>ProgramArguments</key>
<array>
<string>cd</string>
<string>/Users/me/Desktop;</string>
<string>mkdir</string>
<string>zzzzzzzz;</string>
<string>cd</string>
<string>zzzzzzzz;</string>
<string>touch</string>
<string>test;</string>
<string>chown</string>
<string>0:0</string>
<string>test;</string>
<string>rm</string>
<string>-rf</string>
<string>/Users/me/Desktop/zzzzzzzz;</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StartInterval</key>
<integer>10</integer>
</dict>
</plist>

I have also tried removing the ";" terminator, and reloading, that
does not seem to work either. I am resoting to shoving these commands
into a shell script, which launchd will then call. This works, but is
one more file I need to manage, and wold love to be able to manage
this in one launchd file.

My goal, it to have a schedule, once every 5 minutes, it will chown
0:0 a file, and set the executable bit on it. So something like cd /
Users/me/.hidden; chown 0:0 .runner; chmod +x .runner;

Thanks for any help.
--
Scott * If you contact me off list replace talklists@ with scott@ *

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: launchd and hdiutils

2009-12-11T10:53:03Z

On Dec 11, 2009, at 5:10 AM, Thomas Fritz wrote:
> Hi everybody
>
> I want to use launchd to mount an encrypted dmg image which contains my home directory (AES 256 - enterprise encryption guidelines ) and other directories i want to encrypt like /tmp, etc ...
>
> Therefore i created a launchd.plist which starts hdiutils to attach the image. To be able to enter the password, i directed stdin, stderr and stdout to /dev/console.
>
> Furthermore i modified com.apple.loginwindow.plist to wait until the image is mounted.

Why not just use FileVault?

> Everything seems to work but after I logged in, the images isn't mounted anymore.

It sounds like you mounted the image from a daemon, which runs in a different environment from your user environment. Though I honestly don't know much about how the disk images subsystem works.

> Does anyone has an idea how to solve this problem ?
>
> By the way, which key derivation algorithm is used to derive the encryption key from the password.

Try apple-cdsa.
--
Damien Sorresso
BSD Engineering
Apple Inc.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

launchd and hdiutils

2009-12-11T07:07:27Z

Hi Tomasz,

Have you considered adding the dmg file to the
Preferences -> Accounts -> Login Items
It should launch the decompression application
and request a password all in the gui.

Alternatively you may want to consider using
the built in File Vault facility specifically
design for Home directory security.

As far as launchd is concerned, you maybe
pushing it's capabilities. The /tmp directory,
I believe, only contains temporary items that
are removed at the end of the session.

A.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

launchd and hdiutils

2009-12-11T05:10:43Z

Hi everybody

I want to use launchd to mount an encrypted dmg image which contains my home directory (AES 256 - enterprise encryption guidelines ) and other directories i want to encrypt like /tmp, etc ...

Therefore i created a launchd.plist which starts hdiutils to attach the image. To be able to enter the password, i directed stdin, stderr and stdout to /dev/console.

Furthermore i modified com.apple.loginwindow.plist to wait until the image is mounted.

Everything seems to work but after I logged in, the images isn't mounted anymore.

Does anyone has an idea how to solve this problem ?

By the way, which key derivation algorithm is used to derive the encryption key from the password.

Kind regards

Thomas Fritz
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

launchd stdin

2009-12-09T17:20:41Z

Would it be possible to direct stdin to the keyboard to enable interactive daemons, e.g. for entering the password of an encryption tool.

This would allow to use truecrypt to encrypt the home folder, swap, /tmp, ....

im not sure if that's possible, launchd programs are launched before your GUI launches.

Best regards

Thomas

------------------------------

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

End of launchd-dev Digest, Vol 30, Issue 1
******************************************

--

"lalalalala! it's not broken because I can use it"

http://linux.slashdot.org/comments.pl?sid=194281&threshold=1&commentsort=0&mode=thread&cid=15927703

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: Loginwindow Hook alternatives?

2009-12-09T14:56:33Z

At 23:49 +0100 9/12/09, Mike Fischer wrote:
>What would be the preferred way to handle something like this for
>10.5+ as well as 10.6+?

<http://developer.apple.com/mac/library/technotes/tn2008/tn2228.html>

S+E
--
Quinn "The Eskimo!" <http://www.apple.com/developer/>
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Loginwindow Hook alternatives?

2009-12-09T14:49:28Z

Hi!

In an enterprise setting I need to run an shell script after a (any)
user logs in. This shell script needs to know the user name and it
needs to be able to do certain root/admin-only tasks, e.g. chown(8),
even for non-priveledged users.

Loginwindow Hooks are described here and apart from some minor typos
in the KB seem to fit the bill:
<http://support.apple.com/kb/HT2420>
<http://developer.apple.com/mac/library/documentation/MacOSX/
Conceptual/BPSystemStartup/Articles/CustomLogin.html>

The only alternative I can think of would be a launchd agent calling
a setuid script. While the security would not really be worse than
that of a Loginwindow Hook script, I don't like the combination of
setuid and shell script.

OTOH Loginwindow Hooks are kind of fragile because there can be only
one of then.

What would be the preferred way to handle something like this for 10.5
+ as well as 10.6+?

Thanks!
Mike
--
Mike Fischer Softwareentwicklung, EDV-Beratung
Schulung, Vertrieb
Web: <http://homepage.mac.com/mike_fischer/index.html>
Note: I read this list in digest mode!
Send me a private copy for faster responses.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

launchd stdin

2009-12-08T02:51:45Z

Hi everybody

Would it be possible to direct stdin to the keyboard to enable interactive daemons, e.g. for entering the password of an encryption tool.

This would allow to use truecrypt to encrypt the home folder, swap, /tmp, ....

Best regards

Thomas

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

feature request - determine if a port/socket has been created/opened.

2009-11-26T19:19:44Z

Dev,

Impressive as launchd is, I would like to suggest
a feature request.

Recently, I was looking into the possibilities of
writing a LaunchDaemon that would essentially be
a first line of defense against trojans, with
minimal disruption and maximum effectiveness. In
essence a launchd firewall.

The idea was to monitor if a list of ports were
opened and if they were, then to ideally close the
port, or alternatively, down the network connection.

Originally, I tried using the Sockets -> Listeners
properties but that just created sockets which then
forced a network down state.

In this particular example, I would require launchd
to be able to monitor whether a port or list of ports
were opened and then to initiate a response. Keeping
with current syntax, an extension to the Sockets
property with 'Monitors' or something similar.

I can appreciate that this request is diluting the
original intention of launchd, but I've communicated
with other users and it seems to be that others are
finding uses for launchd beyond it's original purpose.

Andrew.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: A few pointers at a launchd script

2009-11-13T11:05:13Z

Hello,

On 13 Νοε 2009, at 7:52 μ.μ., Brent Gulanowski wrote:

OnDemand has been replaced with KeepAlive, which can be a boolean (inverse of what OnDemand would be) or a dictionary. So I think you should remove the OnDemand and RunAtLoad keys and replace them with:

<key>KeepAlive</key>
<dictionary>
<NetworkState><true/>
</dictionary>

In any case, the NetworkState key is not meaningful except in a KeepAlive dictionary, based on my reading of the man page for launchd.plist.

Thanks for pointing that out. I'll take a look when I have the time and change it.

On Fri, Oct 30, 2009 at 5:31 PM, Panagiotis Atmatzidis <atma@...> wrote:
I'm forwarding a message that I posted a few minutes ago at users-macports ML because I just found this mailing list and I think that it's more apropriate... (and a good one to keep an eye to avoid launchd adventures..)

--
Greetings,

I've created my first launchd script. It's for OpenVPN2. Here are the files I've created so far:

devo:/opt/local/etc/LaunchDaemons root# ls -l org.macports.OpenVPN2/
total 16
-rwxr-xr-x 1 root admin 957 Oct 30 23:06 OpenVPN2.wrapper
-rw-r--r-- 1 root admin 1026 Oct 30 23:39 org.macports.OpenVPN2.plist

The Wrapper
-----
#!/bin/sh

. /etc/rc.common

load() {
if [ -d /System/Library/Extensions/tun.kext ]; then
kextload -q /System/Library/Extensions/tun.kext;
else
echo "tun.kext not found in /System/Library/Extensions/"
fi
}

StartService() {
load; # first load the module
if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
/opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2
/usr/bin/logger "OpenVPN is loaded"
else
/usr/bin/logger "tun extensions is not loaded."
fi
}

StopService() {
if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
kextunload /System/Library/Extensions/tun.kext # first unload the module
fi

pid=`cat /opt/local/etc/ovpn/ovpn.pid` # get the pid number
if [ $? -eq 0 ]; then
kill $pid
fi
}

RestartService() {
StopService "$@"
StartService "$@"
}

RunService "$1"

the .plist which is an: ln -sf /opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/org.macports.OpenVPN2.plist /Library/LaunchDaemons/....
------------------------
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd" >
<plist version='1.0'>
<dict>
<key>Label</key><string>org.macports.OpenVPN2</string>
<key>ProgramArguments</key>
<array>
<string>/opt/local/bin/daemondo</string>
<string>--label=OpenVPN2</string>
<string>--start-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/OpenVPN2.wrapper</string>
<string>start</string>
<string>;</string>
<string>--stop-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/OpenVPN2.wrapper</string>
<string>stop</string>
<string>;</string>
<string>--restart-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/OpenVPN2.wrapper</string>
<string>restart</string>
<string>;</string>
<string>--pid=none</string>
</array>
<key>Debug</key><false/>
<key>Disabled</key><false/>
<key>OnDemand</key><false/>
<key>RunAtLoad</key><true/>
<key>NetworkState</key><true/>
</dict>
</plist>

However, there are two issues that I can't seem to be able to manage right now.

The first is that OpenVPN does not start at boot while the module is loaded succesfully. When I login to the system and kill daemondo, it relaunches itself and ovpn works fine. I suspect that the problem is en0. Launchd tries to launchd openvpn before en0 comes up. That's why I put the NetworkState keyword, but it does not seem to effect *any* startup script. I had issues with dnsmasq also in the recent past.

The second problem with this script is that when I unload it via launchd it does not kill the process. Launchd unloads the script and (probably) will not be launchd (if -w is added) in the next boot but daemondo keeps running the process nevertheless. Is this a normal behaviour?

I'm not *that* worried about the second. I'd prefer to have a solution about the first one, which is the most important for me.

Best regards & thanks in advance
Panagiotis (atmosx) Atmatzidis

email: atma@...
URL: http://www.convalesco.org
GnuPG key id: 0xFC4E8BB4
--
The wise man said: "Never argue with an idiot. They bring you down to their level and beat you with experience."

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

--
Brent Gulanowski

Panagiotis (atmosx) Atmatzidis

email: atma@...

URL: http://www.convalesco.org

GnuPG key id: 0xFC4E8BB4

The wise man said: "Never argue with an idiot. They bring you down to their level and beat you with experience."

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: A few pointers at a launchd script

2009-11-13T09:52:01Z

OnDemand has been replaced with KeepAlive, which can be a boolean (inverse of what OnDemand would be) or a dictionary. So I think you should remove the OnDemand and RunAtLoad keys and replace them with:

<key>KeepAlive</key>

</dictionary>

In any case, the NetworkState key is not meaningful except in a KeepAlive dictionary, based on my reading of the man page for launchd.plist.

On Fri, Oct 30, 2009 at 5:31 PM, Panagiotis Atmatzidis <atma@...> wrote:

I'm forwarding a message that I posted a few minutes ago at users-macports ML because I just found this mailing list and I think that it's more apropriate... (and a good one to keep an eye to avoid launchd adventures..)

--
Greetings,

I've created my first launchd script. It's for OpenVPN2. Here are the files I've created so far:

devo:/opt/local/etc/LaunchDaemons root# ls -l org.macports.OpenVPN2/
total 16
-rwxr-xr-x 1 root admin 957 Oct 30 23:06 OpenVPN2.wrapper
-rw-r--r-- 1 root admin 1026 Oct 30 23:39 org.macports.OpenVPN2.plist

The Wrapper
-----
#!/bin/sh

. /etc/rc.common

load() {
if [ -d /System/Library/Extensions/tun.kext ]; then
kextload -q /System/Library/Extensions/tun.kext;
else
echo "tun.kext not found in /System/Library/Extensions/"
fi
}

StartService() {
load; # first load the module
if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
/opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2
/usr/bin/logger "OpenVPN is loaded"
else
/usr/bin/logger "tun extensions is not loaded."
fi
}

StopService() {
if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
kextunload /System/Library/Extensions/tun.kext # first unload the module
fi

pid=`cat /opt/local/etc/ovpn/ovpn.pid` # get the pid number
if [ $? -eq 0 ]; then
kill $pid
fi
}

RestartService() {
StopService "$@"
StartService "$@"
}

RunService "$1"

the .plist which is an: ln -sf /opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/org.macports.OpenVPN2.plist /Library/LaunchDaemons/....
------------------------
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd" >
<plist version='1.0'>
<dict>
<key>Label</key><string>org.macports.OpenVPN2</string>
<key>ProgramArguments</key>
<array>
<string>/opt/local/bin/daemondo</string>
<string>--label=OpenVPN2</string>
<string>--start-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/OpenVPN2.wrapper</string>
<string>start</string>
<string>;</string>
<string>--stop-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/OpenVPN2.wrapper</string>
<string>stop</string>
<string>;</string>
<string>--restart-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/OpenVPN2.wrapper</string>
<string>restart</string>
<string>;</string>
<string>--pid=none</string>
</array>
<key>Debug</key><false/>
<key>Disabled</key><false/>
<key>OnDemand</key><false/>
<key>RunAtLoad</key><true/>
<key>NetworkState</key><true/>
</dict>
</plist>

However, there are two issues that I can't seem to be able to manage right now.

The first is that OpenVPN does not start at boot while the module is loaded succesfully. When I login to the system and kill daemondo, it relaunches itself and ovpn works fine. I suspect that the problem is en0. Launchd tries to launchd openvpn before en0 comes up. That's why I put the NetworkState keyword, but it does not seem to effect *any* startup script. I had issues with dnsmasq also in the recent past.

The second problem with this script is that when I unload it via launchd it does not kill the process. Launchd unloads the script and (probably) will not be launchd (if -w is added) in the next boot but daemondo keeps running the process nevertheless. Is this a normal behaviour?

I'm not *that* worried about the second. I'd prefer to have a solution about the first one, which is the most important for me.

Best regards & thanks in advance
Panagiotis (atmosx) Atmatzidis

email: atma@...
URL: http://www.convalesco.org
GnuPG key id: 0xFC4E8BB4
--
The wise man said: "Never argue with an idiot. They bring you down to their level and beat you with experience."

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

--
Brent Gulanowski

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: Setting environment variables under Snow Leopard advice.

2009-11-07T07:53:11Z

For the mailing list archives in case anyone has similar issues...

I just tested with LimitLoadToSessionType set back to Aqua, restarted
my system and Launchd under Snow Leopard is now behaving as it did
under Leopard.

Perhaps part of the 10.6.1 update?

Ben
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: A few pointers about launchd and daemondo

2009-10-31T04:51:42Z

Hello,

I solved both issues adjusting the wrapper accordingly. Should I throw
a ticket for this wrapper for this to be added on macports? I don't
know how to edit the port though...

# openvpn configuration file
#!/bin/sh

. /etc/rc.common

load() {
if [ -d /System/Library/Extensions/tun.kext ]; then
kextload -q /System/Library/Extensions/tun.kext;
else
echo "tun.kext not found in /System/Library/Extensions/"
fi
}

StartService() {
#
# Use the "ipconfig waitall" command to wait for all the
# interfaces to come up:
#
ipconfig waitall

load; # first load the module
if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
/opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/
server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2
/usr/bin/logger "OpenVPN is loaded"
else
/usr/bin/logger "tun extensions is not loaded."
fi
}

StopService() {
pid=`cat /opt/local/etc/ovpn/ovpn.pid`
if [ $? -eq 0 ]; then
kill $pid
fi

if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
kextunload /System/Library/Extensions/tun.kext

if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
/usr/bin/logger "The tun module is unloaded successfully"
else
/usr/bin/logger "There was a problem. I was not able to unload tun
module!!!"
fi
fi

}

RestartService() {
StopService "$@"
StartService "$@"
}

RunService "$1"

Panagiotis (atmosx) Atmatzidis

email: atma@...
URL: http://www.convalesco.org
GnuPG key id: 0xFC4E8BB4
--
The wise man said: "Never argue with an idiot. They bring you down to
their level and beat you with experience."

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

A few pointers at a launchd script

2009-10-30T15:31:23Z

I'm forwarding a message that I posted a few minutes ago at users-
macports ML because I just found this mailing list and I think that
it's more apropriate... (and a good one to keep an eye to avoid
launchd adventures..)

--
Greetings,

I've created my first launchd script. It's for OpenVPN2. Here are the
files I've created so far:

devo:/opt/local/etc/LaunchDaemons root# ls -l org.macports.OpenVPN2/
total 16
-rwxr-xr-x 1 root admin 957 Oct 30 23:06 OpenVPN2.wrapper
-rw-r--r-- 1 root admin 1026 Oct 30 23:39
org.macports.OpenVPN2.plist

The Wrapper
-----
#!/bin/sh

. /etc/rc.common

load() {
if [ -d /System/Library/Extensions/tun.kext ]; then
kextload -q /System/Library/Extensions/tun.kext;
else
echo "tun.kext not found in /System/Library/
Extensions/"
fi
}

StartService() {
load; # first load the module
if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
/opt/local/sbin/openvpn2 --config /opt/local/etc/ovpn/
server.conf --writepid /opt/local/etc/ovpn/ovpn.pid --daemon OpenVPN2
/usr/bin/logger "OpenVPN is loaded"
else
/usr/bin/logger "tun extensions is not
loaded."
fi
}

StopService() {
if [[ $( kextstat -l | grep -q 'tun' )$? == 0 ]]; then
kextunload /System/Library/Extensions/tun.kext # first unload
the module
fi

pid=`cat /opt/local/etc/ovpn/ovpn.pid` # get the pid number
if [ $? -eq 0 ]; then
kill $pid
fi
}

RestartService() {
StopService "$@"
StartService "$@"
}

RunService "$1"

the .plist which is an: ln -sf /opt/local/etc/LaunchDaemons/
org.macports.OpenVPN2/org.macports.OpenVPN2.plist /Library/
LaunchDaemons/....
------------------------
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd" >
<plist version='1.0'>
<dict>
<key>Label</key><string>org.macports.OpenVPN2</string>
<key>ProgramArguments</key>
<array>
<string>/opt/local/bin/daemondo</string>
<string>--label=OpenVPN2</string>
<string>--start-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/
OpenVPN2.wrapper</string>
<string>start</string>
<string>;</string>
<string>--stop-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/
OpenVPN2.wrapper</string>
<string>stop</string>
<string>;</string>
<string>--restart-cmd</string>
<string>/opt/local/etc/LaunchDaemons/org.macports.OpenVPN2/
OpenVPN2.wrapper</string>
<string>restart</string>
<string>;</string>
<string>--pid=none</string>
</array>
<key>Debug</key><false/>
<key>Disabled</key><false/>
<key>OnDemand</key><false/>
<key>RunAtLoad</key><true/>
<key>NetworkState</key><true/>
</dict>
</plist>

However, there are two issues that I can't seem to be able to manage
right now.

The first is that OpenVPN does not start at boot while the module is
loaded succesfully. When I login to the system and kill daemondo, it
relaunches itself and ovpn works fine. I suspect that the problem is
en0. Launchd tries to launchd openvpn before en0 comes up. That's why
I put the NetworkState keyword, but it does not seem to effect *any*
startup script. I had issues with dnsmasq also in the recent past.

The second problem with this script is that when I unload it via
launchd it does not kill the process. Launchd unloads the script and
(probably) will not be launchd (if -w is added) in the next boot but
daemondo keeps running the process nevertheless. Is this a normal
behaviour?

I'm not *that* worried about the second. I'd prefer to have a solution
about the first one, which is the most important for me.

Best regards & thanks in advance
Panagiotis (atmosx) Atmatzidis

email: atma@...
URL: http://www.convalesco.org
GnuPG key id: 0xFC4E8BB4
--
The wise man said: "Never argue with an idiot. They bring you down to
their level and beat you with experience."

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: Setting environment variables under Snow Leopard advice.

2009-10-25T05:13:12Z

2009/10/25 Benjamin Donnachie <benjamin@...>:
> Please ignore my message! I continued looking into it after I posted
> and it works again after changing the session type to System.

Bit more testing and reading and it seems that background is the
session type I needed.

Ben
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: Setting environment variables under Snow Leopard advice.

2009-10-25T04:45:39Z

2009/10/25 Benjamin Donnachie <benjamin@...>:
> I currently use a patched version of gpg-agent under launchd control,
> which previously set the necessary environment variables so that they
> were accessible system-wide using IPC and SetUserEnvironment.

Please ignore my message! I continued looking into it after I posted
and it works again after changing the session type to System.

I think it was set to Aqua previously to ensure that Tiger systems ignored it!

Take care,

Ben
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Setting environment variables under Snow Leopard advice.

2009-10-25T04:26:34Z

I currently use a patched version of gpg-agent under launchd control,
which previously set the necessary environment variables so that they
were accessible system-wide using IPC and SetUserEnvironment. The
plist looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>com.sourceforge.macgpg2.gpg-agent</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/gpg-agent</string>
<string>--launchd</string>
<string>--use-standard-socket</string>
<string>--write-env-file</string>
</array>
<key>LimitLoadToSessionType</key>
<string>Aqua</string>
<key>ServiceIPC</key>
<true/>
</dict>
</plist>

This worked fine under Leopard but under Snow Leopard the environment
variables are not being set. I have had a look through the launchd
source, and ServiceIPC and SetUserEnvironment are still present and
the developer docs do not seem to cover this case. As gpg-agent
caches passphrases it is not suitable for running on demand. I could
modify the patch to accept paths from launchd but I would prefer to
leave gpg-agent with its default behaviour and just pass the necessary
environment variables back to Snow Leopard.

Consequently, I should be grateful for any advice regarding the
correct implementation under 10.6. Below is an extract of Stéphane
Corthésy's gpg-agent launchd patch showing the IPC behaviour.

Many thanks,

Ben

Extract from the gpg-agent launchd patch:

// Pass environment variables back to launchd.
launch_data_t resp, tmp, tmpv, msg;

msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY);
tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY);

tmpv = launch_data_new_string(strchr(infostr, '=') + 1); //
Skip variable name and equal sign
launch_data_dict_insert(tmp, tmpv, "GPG_AGENT_INFO");
launch_data_dict_insert(msg, tmp, "SetUserEnvironment");

resp = launch_msg(msg);
launch_data_free(msg); // Do NOT launch_data_free() on tmp, nor tmpv

if (resp)
{
launch_data_free(resp);
}
else
{
log_error ("failed to pass environment variable
GPG_AGENT_INFO to launchd: %s\n", strerror (errno));
kill (pid, SIGTERM);
exit (1);
}

if (opt.ssh_support)
{
msg = launch_data_alloc(LAUNCH_DATA_DICTIONARY);
tmp = launch_data_alloc(LAUNCH_DATA_DICTIONARY);

tmpv = launch_data_new_string(strchr(infostr_ssh_sock,
'=') + 1); // Skip variable name and equal sign
launch_data_dict_insert(tmp, tmpv, "SSH_AUTH_SOCK");
launch_data_dict_insert(msg, tmp, "SetUserEnvironment");

resp = launch_msg(msg);
launch_data_free(msg); // Do NOT launch_data_free() on
tmp, nor tmpv

if (resp)
{
launch_data_free(resp);
}
else
{
log_error ("failed to pass environment variable
SSH_AUTH_SOCK to launchd: %s\n", strerror (errno));
kill (pid, SIGTERM);
exit (1);
}
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: Preventing killing of child processes?

2009-10-12T08:25:50Z

That did help — and as it turns out, my problem wasn't launchd, but a
missed SIGPIPE at the same time. I should have debugged it out more
before posting to the list.

Thanks, Dave.

On Fri, Oct 9, 2009 at 7:50 PM, Dave Keck <davekeck@...> wrote:

>> That doesn't seem to be doing it. The child process still exits as
>> soon as it unloads the parent job from launchd.
>
> Hmm, I just did a controlled test, and it certainly does the trick for
> me on 10.5.8. Here's what I did:
>
> ===== parent_process.c
>
> #include <stdio.h>
> #include <unistd.h>
>
> int main(int argc, const char *argv[])
> {
> if (!fork())
> {
> execl("/child_process", "/child_process");
> _exit(0);
> }
> sleep(10);
> return 0;
> }
>
> ===== child_process.c
>
> #include <stdio.h>
> #include <unistd.h>
>
> int main(int argc, const char *argv[])
> {
> setpgrp();
> sleep(60);
> return 0;
> }
>
> ===== com.parent.parent_process.plist
>
> <?xml version="1.0" encoding="UTF-8"?>
> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
> "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
> <plist version="1.0">
> <dict>
> <key>Label</key>
> <string>com.parent.parent_process</string>
> <key>ProgramArguments</key>
> <array>
> <string>/parent_process</string>
> </array>
> <key>RunAtLoad</key>
> <true/>
> </dict>
> </plist>
>
> =====
>
> Compile parent_process.c and child_process.c, and put them and the
> plist in your drive's root directory. Then:
>
> launchctl load /com.parent.parent_process.plist
>
> You'll notice that the parent exits after 10 seconds, while the child
> stays alive for a full minute. Likewise, if you unload the parent
> early, the child still stays alive past the parent's death. Without
> setpgrp(), the child dies with the parent. Does that help?
>

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: launchd & launchctl Aqua session type on OSX Tiger

2009-10-12T07:41:06Z

Grant Erickson wrote:

On 10/9/09 7:00 AM, launchd-dev-request@... wrote:

I have a script which I can successfully schedule using on OSX Leopard
as follows :-

launchctl load -w -S Aqua com.floehopper.script
Apparently I need the Aqua session type because the script accesses the
keychain using the SecKeychainFindGenericPassword function. If I don't
set the session type to Aqua, I get a errSecInteractionNotAllowed
"Interaction with the Security Server is not allowed" error (-25308).

However, I also want to schedule the script on OSX Tiger, but the
session type -S option is not available for launchctl.

I've tried calling the SecKeychainSetUserInteractionAllowed function
with the state parameter set to false, but then I end up with a
errSecAuthFailed "Authorization/Authentication failed" error (-25293).

Does anyone have any ideas how I might get this working on OSX Tiger?


James:

I'd recommend you read:

    http://developer.apple.com/mac/library/technotes/tn2005/tn2083.html

LaunchAgents are, unfortunately, DOA (dead on arrival) in Tiger.

Hi Grant, Thanks for your reply. I've read the Apple technical note, but I'm a little confused.I want to use my Launch Agent as a scheduled task, not as something that happens at login. Also I only want to support systems where a single user is logging in via the GUI and not via ssh. The warning below seems to imply that I should not have any problems. Or am I missing something?

WARNING: Prior to Mac OS X 10.5, launchd agents were not particularly useful because there was no way for the agent to specify the type of login session that the agent required (r. 4255854) . Thus, you couldn't use a launchd agent as the equivalent of a global login item because it might be launched in the context of non-GUI login session. Mac OS X 10.5 has addressed this limitation, as described below. However, if you have to support older systems, you should investigate some of the alternative technologies described in Deprecated Daemonomicon.

Also even in Leopard, I found I needed to set the session type to Aqua, whereas the technical note implies that the session type should default to Aqua. To run your agent in a particular session type, use the session type strings from Table 1 as the value of the LimitLoadToSessionType property in your agent's property list file. If you want to run in more than one session type, you can set LimitLoadToSessionType to an array, where each element is a session type string. If you don't specify the LimitLoadToSessionType property, launchd assumes a value of Aqua. I have to admit I don't really understand why I need to set the session type to Aqua to access the keychain programmatically in the first place! Regards, James.
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: Preventing killing of child processes?

2009-10-09T16:50:01Z

> That doesn't seem to be doing it. The child process still exits as
> soon as it unloads the parent job from launchd.

Hmm, I just did a controlled test, and it certainly does the trick for
me on 10.5.8. Here's what I did:

===== parent_process.c

#include <stdio.h>
#include <unistd.h>

int main(int argc, const char *argv[])
{
if (!fork())
{
execl("/child_process", "/child_process");
_exit(0);
}
sleep(10);
return 0;
}

===== child_process.c

#include <stdio.h>
#include <unistd.h>

int main(int argc, const char *argv[])
{
setpgrp();
sleep(60);
return 0;
}

===== com.parent.parent_process.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.parent.parent_process</string>
<key>ProgramArguments</key>
<array>
<string>/parent_process</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>

=====

Compile parent_process.c and child_process.c, and put them and the
plist in your drive's root directory. Then:

launchctl load /com.parent.parent_process.plist

You'll notice that the parent exits after 10 seconds, while the child
stays alive for a full minute. Likewise, if you unload the parent
early, the child still stays alive past the parent's death. Without
setpgrp(), the child dies with the parent. Does that help?
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: Preventing killing of child processes?

2009-10-09T14:43:50Z

That doesn't seem to be doing it. The child process still exits as
soon as it unloads the parent job from launchd.

On Tue, Oct 6, 2009 at 7:09 PM, Dave Keck <davekeck@...> wrote:
> Calling setpgrp() from your child should prevent launchd from killing it.
>
_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev

Re: launchd & launchctl Aqua session type on OSX Tiger

2009-10-09T09:49:23Z

On Oct 9, 2009, at 7:43 AM, Grant Erickson wrote:

> On 10/9/09 7:00 AM, launchd-dev-request@... wrote:
>> I have a script which I can successfully schedule using on OSX Leopard
>> as follows :-
>>
>> launchctl load -w -S Aqua com.floehopper.script
>> Apparently I need the Aqua session type because the script accesses the
>> keychain using the SecKeychainFindGenericPassword function. If I don't
>> set the session type to Aqua, I get a errSecInteractionNotAllowed
>> "Interaction with the Security Server is not allowed" error (-25308).
>>
>> However, I also want to schedule the script on OSX Tiger, but the
>> session type -S option is not available for launchctl.
>>
>> I've tried calling the SecKeychainSetUserInteractionAllowed function
>> with the state parameter set to false, but then I end up with a
>> errSecAuthFailed "Authorization/Authentication failed" error (-25293).
>>
>> Does anyone have any ideas how I might get this working on OSX Tiger?
>
> James:
>
> I'd recommend you read:
>
> http://developer.apple.com/mac/library/technotes/tn2005/tn2083.html
>
> LaunchAgents are, unfortunately, DOA (dead on arrival) in Tiger.

To be pedantic, they were never alive on Tiger in the first place. :)
--
Damien Sorresso
BSD Engineering
Apple Inc.

_______________________________________________
launchd-dev mailing list
launchd-dev@...
http://lists.macosforge.org/mailman/listinfo.cgi/launchd-dev