Hello, I currently am designing a data backup solution, and have an unsandboxed launch agent written in DotNet 6 that needs read access to files in order to back them up. It is configured together with its own App Group (with the sandboxed GUI). However, this Launch Agent cannot access files or enumerate directories in ~/Library/Group Containers/com.apple.notes whatsoever (even after enabling full disk access for the calling app, the files are not restricted either). I am trying to access the NoteStore.sqlite and similar files so that the Launch Agent can read the file and upload it to S3. Is there some entitlement I need to add, or access prompt? It seems like there is additional security layers for Sandboxed folders for apps that I'm trying to bypass. What is the recommended solution for my use case? (For Ventura and Sonoma users)

I customize an open source app (yo), sign it, and deploy it to a bunch of Macs. We've been doing this for almost 4 years and it relies on 2 LaunchAgents that run a python script. With the move to Ventura, I discovered the background items and that this particular item shows up as 2 "yo_scheduler" items I have now: signed the python script add AssociatedBundleIdentifiers to the LaunchAgents Call LSRegisterUrl as part of the postinstall script I've packaged all this up, and install it on clients. Based on the documentation, I would anticipate that these 2 items would now show up as "Yo.app" but they don't. They show up as our developer program name. Based on some discussion with other Mac admins it sounds like we have to register AND open the app before the LaunchAgents are actually installed. If I install, then run sfltool resetbtm, then restart the Mac this all shows up properly... What's the proper way to use legacy LaunchAgents installed by a PKG?

My app needs a HelperTool which runs as root. I did in Xcode Version 14.3.1 (14E300c), macOS 13.4.1 (22F82): • Create new Project: macOS App: TestSM • Add new target: XPC Service: HelperSM • make new Property List: smProp.plist with: Label de.mdenkmann.HelperSM BundleProgram /Contents/XPCServices/HelperSM.xpc/Contents/MacOS/HelperSM • add Copy File Build Phase in TestSM for smProp.plist with: Destination: Wrapper Subpath: Contents/Library/LaunchDaemons smAppService = SMAppService.daemon(plistName: "smProp.plist") smAppService.register() now: smAppService.status = "enabled" When I do: let connectionToService = NSXPCConnection(serviceName: helperSMBundleIdentifier) I can communicate with HelperSM, but it does NOT run as root. Bad. When I do: let connectionToService = NSXPCConnection(machServiceName: "de.mdenkmann.HelperSM", options: [. privileged]) I get NSXPCConnectionInvalid when I communicate with the HelperSM. Even worse. How to get my root Helper? When I look at: System Settings → General → Login Items → Allow in the Background I see: TestSM.app 3 items; 3 items affect all users. What are these 3 items? Why Background? I want my HelperSM get started as root when called from TestSM, then run it as long as the system sees fit, then stop. It should not be called from other apps. It has no need to run in the background once TestSM stops.

Hi guys. I'm evaluating porting our daemon/agent service over to the new SMAppService API. I noticed one major gap here (or maybe I missed something?) that, with launchctl, we can put something under "/Library/LaunchAgents" and trivially register it as a global launch agent, yet with SMAppService.agent(...) or SMAppService.loginItem(...), the item is bound to the current user and won't propagate to a different user logged in subsequently. So what is the equivalent of the global launch agent using SMAppService?

Hi, We're trying to generate the key inside secure enclave from the deamon, but it fails with the below error. The operation couldn’t be completed. (OSStatus error -26276 - failed to generate asymmetric keypair) Could you please help me to resolve the issue?

Having some problems with launchd since I upgraded to Sonoma. First some background. I run a secondary userid which is logged in whenever the Mac is turned on. At startup it logs in. It contains a launchd file to run at load & lock the user, in case my Mac falls into the wrong hands. It also contains two launchd files which run an app at load & daily at 2PM. All the above worked reliably under Ventura. Focusing on the launch process now. I noticed the app was not starting up at login. Suspected that two launchd run at launch files may be a problem. So, as a test, I renamed (plist > xml) so that only the app would run at launch. When I tested it. my app did not launch, but the renamed file which locks the id still ran. Strange. Any insights as to what's happening? Thanks.

I am trying to build Endpoint Security demo app on xcode, when I run sudo launchctl list 3xxxxxxxx6.com.example.apple-samplecode.SampleEndpointApp.Extension i get { "LimitLoadToSessionType" = "System"; "MachServices" = { "3FB5H67G96.com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension.xpc" = mach-port-object; }; "Label" = "3FB5H67G96.com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension"; "OnDemand" = false; "LastExitStatus" = 9; "Program" = "/Library/SystemExtensions/24197CF7-F318-4968-87D5-B869AAF544F5/com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension.systemextension/Contents/MacOS/com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension"; }; when I run the app i get Successfully installed the extension ✅ but noting happens. what should I do from here? plz halp

I am currently not able to change the ulimit on my machine. As of the newest MacOs releases (11.7.9, 12.6.8, and 13.5) I am no longer able to increase the ulimit of my computer using the strategies outlined here: https://wilsonmar.github.io/maximum-limits/ https://apple.stackexchange.com/questions/453050/how-to-increase-global-maxfiles-ulimit-on-osx-13-1-ventura?newreg=44fe471004094ccdb3ba51c1c3f9f84a Running sudo launchctl limit maxfiles 65536 200000 returns Could not set resource limits: 150: Operation not permitted while System Integrity Protection is engaged. This is relevant for me as I am using Vite which is currently broken and blocks me from developing locally. It is mentioned in their troubleshooting page (https://vitejs.dev/guide/troubleshooting.html#requests-are-stalled-forever) that Vite causes a large number of open files and how to increase the limit. There are similar comments in the Ruby Vite troubleshooting page (https://vite-ruby.netlify.app/guide/troubleshooting.html#requests-to-vite-sporadically-return-a-500-error-response). I have added a comment in the Vite discussion board about this issue. There is a discussion the Apple Stack Exchange that reports this problem but no one has provided a solution yet (https://apple.stackexchange.com/questions/462489/how-to-increase-global-max-opened-files-limit-on-osx-13-5-ventura)

Hello everyone, I'm interested in creating an agent or daemon on macOS that can monitor several types of user interactions: File Upload Events: I want to listen for events when users upload files to their Macs. Drag-and-Drop Events: I'd like to capture events when users perform drag-and-drop actions. Clipboard Events: I'm also interested in monitoring copy/paste actions in the clipboard. Keystroke Events: Finally, I want to be able to track keystroke events. Could anyone provide guidance or point me in the right direction on how to achieve this? Any help or resources would be greatly appreciated. Thank you!

I am currently making an XCode project where I plan to use SMAppService to register a launch agent so that the app can change the desktop wallpaper on a monthly basis. However, I am an amateur and have had difficulties getting the SMAppService to work. So far I have roughly followed the instructions listed in the answer here: https://developer.apple.com/forums/thread/721737 However, I still cannot get the launchd agent to run (although it does get added to the launchctl list) as I'm not fully sure how to follow those instructions. Therefore I am asking if anyone has some resources to help point me in the right direction to using the SMAppService to launch a launchAgent. Thanks,

i want to add a cert to system keychain in my program. with command "security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ", i can add success manually. but when i run with my program, it fail. my program is a daemon runatload. can any one help?

I'm struggling to understand how to use launchctl enable/disable instead of launchctl load/unload on 10.11 15A279bThe specific issue is I want to disable mongodb so it no longer starts at boot:manoa:~ mike$ ps -ef|grep [m]ongo manoa:~ mike$ launchctl load ~/Library/LaunchAgents/homebrew.mxcl.mongodb.plist manoa:~ mike$ ps -ef|grep [m]ongo 501 1722 1 0 9:12AM ?? 0:00.09 /usr/local/opt/mongodb/bin/mongod --config /usr/local/etc/mongod.conf manoa:~ mike$ launchctl disable ~/Library/LaunchAgents/homebrew.mxcl.mongodb.plist Usage: launchctl disable <service-target>The man page for launchctl states:launchctl allows for detailed examination of launchd endpoints. A domain manages the execution policy for a collection of services. A service may be thought of as a virtual process that is always available to be spawned in response to demand. Each service has a collection of endpoints, and sending a message to one of those endpoints will cause the service to launch on demand. Domains advertise these endpoints in a shared namespace and may be thought of as synonymous with Mach bootstrap subsets. Many subcommands in launchctl take a specifier which indicates the target domain or service for the subcommand. This specifier may take one of the following forms:I'm lost without some concrete example/tutorial at this point. Which domain is my plist a part of (or can it sit across several?)Is there a WWDC session that covers how to understand what the difference is between:system/[service-name]user/<uid>/[service-name]login/<asid>/[service-name]gui/<uid>/[service-name]session/<asid>/[service-name]pid/<pid>/[service-name]Is <service-target> from the Usage: help one of the above choices or something else?manoa:~ mike$ launchctl list|grep mongo 1722 0 homebrew.mxcl.mongodbWhat is service-name specifically in this case? manoa:~ mike$ launchctl disable pid/1722/homebrew.mxcl.mongodb Could not disable service: 1: Operation not permitted

Hello, due to a problem with displaying daemons in login items that are loaded in a postinstall script using launchctl bootstrap plist-name. Instead of the name of the application, there is the name of the organization. I read eskimo post . AssociatedBundleIdentifiers are in the plist and contains correct bundle id, but the system still does not determine the name of the application. We thought if we remake it on use SMAppService API, then we are faced with another problem, this is the inability to install the application using remote device management, and speaking of a large number of computers, it becomes impossible to go and set a password on each individual device to load the daemon during installation. Are there any ways to solve this situation? Or may be how fix displaying name in login items?

Hi, I'm working on macOS launchAgent based project, and using 3rd party code to upload big files to remote server. from time to time, I see that the upload rate is very slow and when i try it to use command line tool, the paste is much faster. Therefore, I believe that launchAgent based processes, may get low priority in using network bandwidth compared to foreground tools. I wonder if there's anything I can do on the process' info.plist file to get better prioritization on network resources. Perhaps I need to call the file uploader/downloader from dedicated XPC helper tool, but I prefer doing it from the same process. Thanks !

I'v set sudo launchctl config user path PATH and now I cannot launch brew, npm, node and ect. from terminal. What I should to do for these commands work again from terminal?

Hi, as title said, i have two problems with new login items on Ventura/Sonoma. I have main bundle and 5 background tasks. First problem: After installation, menu item for background tasks have name of company instead of application name. I read thread about it, but it seems be a long time. Is it possible that bug is still present on released Ventura? Thread: https://developer.apple.com/forums/thread/713493 Second problem: One of the background tasks can create plist and copy to /Library/LaunchDaemons. After that, i have two login items with different labels, one item as mentioned in first problem e.g. company name, and second login item for created plist, but with right name. Each plist has AssociatedBundleIdentifiers set to bundle id. Thank you

macOS 13 introduced a new mechanism for users to control background items on their Mac. These items now show up in a list under System Settings > General > Login Items > Allow in the Background. The name in that list should be the name of the app responsible for the background item. If it’s not, there are two possible reasons: Your product is built incorrectly. There’s a bug in macOS. It’s important to distinguish between those two cases, and the best way to do that is to test your product on a fresh machine: Set up a new machine that’s never seen your product before. I generally use a VM for this, restoring from a snapshot between each test. Install your app as the user would. Check what you see in System Settings. If you see the right name, it’s likely that your product is built correctly. If that same product shows the wrong name in other environments, it’s reasonable to assume that this is a bug in macOS. Note Such bugs are very common on development machines. The code that gets the name of your product relies on the Launch Services database, and it’s not uncommon for the building and rebuilding you do on your development machine to thoroughly scramble that database. That’s why testing on a fresh machine is so important. OTOH, if this test shows the wrong value you need to start looking at your code. There are three common cases here: Your product is an app that calls SMAppService to install its background items. Your product includes an app but installs its background items by writing launchd property list file to /Library/LaunchDaemons, /Library/LaunchAgents, or ~/Library/LaunchAgents. Your product does not include an app. If you use SMAppService and the wrong name shows up, that’s strong evidence that you’re dealing with a bug in macOS. SMAppService should provide the system the information it needs to understand that your app is responsible for your service. If you work with launchd property list files directly, make sure to add an AssociatedBundleIdentifiers property that lists your app’s bundle ID. Again, that lets the system know that your app is responsible for these launchd jobs. If your product doesn’t include an app then there’s a limit to how well the system can do here. You might want to consider creating and installing some sort of management app, one that exists solely to become the responsible code for your launchd jobs. If you’ve concluded that your product is built correctly and you’re able to consistently reproduce the problem on a fresh machine, that’s definitely worth filing a bug about it. Such a bug should be actionable. Even if you can’t reproduce the problem, you might still want to file a bug about it, with the understanding that it’s significantly harder to fix such bugs. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi Team, We have developed an Daemon process using Microsoft Windows Worker Service written in .NET Core. On the first run the daemon process supposed to copy an sqlite database file on our specified path and then it will also generate some image files and save them on the specified path. The daemon process is working perfectly fine in DEBUG mode. However whenever we launch the daemon process in RELEASE mode via launchd command, the daemon process is unable to copy or write the files on the specified path. It looks like in the RELEASE mode the exe file of daemon needs file writing permissions to copy and write the files. Can you please guide us how can we resolve this issue and grant the file writing rights to the daemon process to work? Thank you. Asif from Techliance.

I did some research and found that we can add our app by bundling a 'helper app' inside the main app's Contents/Library/LoginItems. Then in the main app (say from app delegate didlaunchwithoptions), call SMLoginItemSetEnabled and pass it the bundle identifier of the helper app and flag=true. This is way, when the main app is launched, it will configure the helper app as the 'login item', and that helper app will be launched automatically upon system login. Then in the helper app launch process, check if the 'main app' is not running, open it by using its path/url. But we also want that users are not able to quit (or force-quit) the main app (it's a security app). Or at least, if they kill the app, it should be relaunched automatically. Will just doing the above achieve all this? app should be launched upon system login app should be launched if it's killed by any way If not, what are the options?

My situtation: I recently added AssociatedBundleIdentifiers in launchd plist and see the result that my app's name is on the System Settings > Login Items (Allow in the background). But the machine that already has installed the older app without AssociatedBundleIdentifiers still shows Developer ID due to the cached state. And it is commemted at https://developer.apple.com/forums/thread/713493. It can be updated by resetting command and then restarting the system, but doing it on my users' machines seems inappropriate in many ways. My question: So, is there any way that I can make the change(Developer ID -> App name) without resetting and restarting by any chance?