Hi, We're trying to generate the key inside secure enclave from the deamon, but it fails with the below error. The operation couldn’t be completed. (OSStatus error -26276 - failed to generate asymmetric keypair) Could you please help me to resolve the issue?

Having some problems with launchd since I upgraded to Sonoma. First some background. I run a secondary userid which is logged in whenever the Mac is turned on. At startup it logs in. It contains a launchd file to run at load & lock the user, in case my Mac falls into the wrong hands. It also contains two launchd files which run an app at load & daily at 2PM. All the above worked reliably under Ventura. Focusing on the launch process now. I noticed the app was not starting up at login. Suspected that two launchd run at launch files may be a problem. So, as a test, I renamed (plist > xml) so that only the app would run at launch. When I tested it. my app did not launch, but the renamed file which locks the id still ran. Strange. Any insights as to what's happening? Thanks.

I am trying to build Endpoint Security demo app on xcode, when I run sudo launchctl list 3xxxxxxxx6.com.example.apple-samplecode.SampleEndpointApp.Extension i get { "LimitLoadToSessionType" = "System"; "MachServices" = { "3FB5H67G96.com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension.xpc" = mach-port-object; }; "Label" = "3FB5H67G96.com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension"; "OnDemand" = false; "LastExitStatus" = 9; "Program" = "/Library/SystemExtensions/24197CF7-F318-4968-87D5-B869AAF544F5/com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension.systemextension/Contents/MacOS/com.example.apple-samplecode.SampleEndpointApp3FB5H67G96.Extension"; }; when I run the app i get Successfully installed the extension ✅ but noting happens. what should I do from here? plz halp

I am currently not able to change the ulimit on my machine. As of the newest MacOs releases (11.7.9, 12.6.8, and 13.5) I am no longer able to increase the ulimit of my computer using the strategies outlined here: https://wilsonmar.github.io/maximum-limits/ https://apple.stackexchange.com/questions/453050/how-to-increase-global-maxfiles-ulimit-on-osx-13-1-ventura?newreg=44fe471004094ccdb3ba51c1c3f9f84a Running sudo launchctl limit maxfiles 65536 200000 returns Could not set resource limits: 150: Operation not permitted while System Integrity Protection is engaged. This is relevant for me as I am using Vite which is currently broken and blocks me from developing locally. It is mentioned in their troubleshooting page (https://vitejs.dev/guide/troubleshooting.html#requests-are-stalled-forever) that Vite causes a large number of open files and how to increase the limit. There are similar comments in the Ruby Vite troubleshooting page (https://vite-ruby.netlify.app/guide/troubleshooting.html#requests-to-vite-sporadically-return-a-500-error-response). I have added a comment in the Vite discussion board about this issue. There is a discussion the Apple Stack Exchange that reports this problem but no one has provided a solution yet (https://apple.stackexchange.com/questions/462489/how-to-increase-global-max-opened-files-limit-on-osx-13-5-ventura)

Hello everyone, I'm interested in creating an agent or daemon on macOS that can monitor several types of user interactions: File Upload Events: I want to listen for events when users upload files to their Macs. Drag-and-Drop Events: I'd like to capture events when users perform drag-and-drop actions. Clipboard Events: I'm also interested in monitoring copy/paste actions in the clipboard. Keystroke Events: Finally, I want to be able to track keystroke events. Could anyone provide guidance or point me in the right direction on how to achieve this? Any help or resources would be greatly appreciated. Thank you!

I am currently making an XCode project where I plan to use SMAppService to register a launch agent so that the app can change the desktop wallpaper on a monthly basis. However, I am an amateur and have had difficulties getting the SMAppService to work. So far I have roughly followed the instructions listed in the answer here: https://developer.apple.com/forums/thread/721737 However, I still cannot get the launchd agent to run (although it does get added to the launchctl list) as I'm not fully sure how to follow those instructions. Therefore I am asking if anyone has some resources to help point me in the right direction to using the SMAppService to launch a launchAgent. Thanks,

i want to add a cert to system keychain in my program. with command "security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ", i can add success manually. but when i run with my program, it fail. my program is a daemon runatload. can any one help?

I'm struggling to understand how to use launchctl enable/disable instead of launchctl load/unload on 10.11 15A279bThe specific issue is I want to disable mongodb so it no longer starts at boot:manoa:~ mike$ ps -ef|grep [m]ongo manoa:~ mike$ launchctl load ~/Library/LaunchAgents/homebrew.mxcl.mongodb.plist manoa:~ mike$ ps -ef|grep [m]ongo 501 1722 1 0 9:12AM ?? 0:00.09 /usr/local/opt/mongodb/bin/mongod --config /usr/local/etc/mongod.conf manoa:~ mike$ launchctl disable ~/Library/LaunchAgents/homebrew.mxcl.mongodb.plist Usage: launchctl disable <service-target>The man page for launchctl states:launchctl allows for detailed examination of launchd endpoints. A domain manages the execution policy for a collection of services. A service may be thought of as a virtual process that is always available to be spawned in response to demand. Each service has a collection of endpoints, and sending a message to one of those endpoints will cause the service to launch on demand. Domains advertise these endpoints in a shared namespace and may be thought of as synonymous with Mach bootstrap subsets. Many subcommands in launchctl take a specifier which indicates the target domain or service for the subcommand. This specifier may take one of the following forms:I'm lost without some concrete example/tutorial at this point. Which domain is my plist a part of (or can it sit across several?)Is there a WWDC session that covers how to understand what the difference is between:system/[service-name]user/<uid>/[service-name]login/<asid>/[service-name]gui/<uid>/[service-name]session/<asid>/[service-name]pid/<pid>/[service-name]Is <service-target> from the Usage: help one of the above choices or something else?manoa:~ mike$ launchctl list|grep mongo 1722 0 homebrew.mxcl.mongodbWhat is service-name specifically in this case? manoa:~ mike$ launchctl disable pid/1722/homebrew.mxcl.mongodb Could not disable service: 1: Operation not permitted

Hello, due to a problem with displaying daemons in login items that are loaded in a postinstall script using launchctl bootstrap plist-name. Instead of the name of the application, there is the name of the organization. I read eskimo post . AssociatedBundleIdentifiers are in the plist and contains correct bundle id, but the system still does not determine the name of the application. We thought if we remake it on use SMAppService API, then we are faced with another problem, this is the inability to install the application using remote device management, and speaking of a large number of computers, it becomes impossible to go and set a password on each individual device to load the daemon during installation. Are there any ways to solve this situation? Or may be how fix displaying name in login items?

Hi, I'm working on macOS launchAgent based project, and using 3rd party code to upload big files to remote server. from time to time, I see that the upload rate is very slow and when i try it to use command line tool, the paste is much faster. Therefore, I believe that launchAgent based processes, may get low priority in using network bandwidth compared to foreground tools. I wonder if there's anything I can do on the process' info.plist file to get better prioritization on network resources. Perhaps I need to call the file uploader/downloader from dedicated XPC helper tool, but I prefer doing it from the same process. Thanks !

I'v set sudo launchctl config user path PATH and now I cannot launch brew, npm, node and ect. from terminal. What I should to do for these commands work again from terminal?

Hi, as title said, i have two problems with new login items on Ventura/Sonoma. I have main bundle and 5 background tasks. First problem: After installation, menu item for background tasks have name of company instead of application name. I read thread about it, but it seems be a long time. Is it possible that bug is still present on released Ventura? Thread: https://developer.apple.com/forums/thread/713493 Second problem: One of the background tasks can create plist and copy to /Library/LaunchDaemons. After that, i have two login items with different labels, one item as mentioned in first problem e.g. company name, and second login item for created plist, but with right name. Each plist has AssociatedBundleIdentifiers set to bundle id. Thank you

macOS 13 introduced a new mechanism for users to control background items on their Mac. These items now show up in a list under System Settings > General > Login Items > Allow in the Background. The name in that list should be the name of the app responsible for the background item. If it’s not, there are two possible reasons: Your product is built incorrectly. There’s a bug in macOS. It’s important to distinguish between those two cases, and the best way to do that is to test your product on a fresh machine: Set up a new machine that’s never seen your product before. I generally use a VM for this, restoring from a snapshot between each test. Install your app as the user would. Check what you see in System Settings. If you see the right name, it’s likely that your product is built correctly. If that same product shows the wrong name in other environments, it’s reasonable to assume that this is a bug in macOS. Note Such bugs are very common on development machines. The code that gets the name of your product relies on the Launch Services database, and it’s not uncommon for the building and rebuilding you do on your development machine to thoroughly scramble that database. That’s why testing on a fresh machine is so important. OTOH, if this test shows the wrong value you need to start looking at your code. There are three common cases here: Your product is an app that calls SMAppService to install its background items. Your product includes an app but installs its background items by writing launchd property list file to /Library/LaunchDaemons, /Library/LaunchAgents, or ~/Library/LaunchAgents. Your product does not include an app. If you use SMAppService and the wrong name shows up, that’s strong evidence that you’re dealing with a bug in macOS. SMAppService should provide the system the information it needs to understand that your app is responsible for your service. If you work with launchd property list files directly, make sure to add an AssociatedBundleIdentifiers property that lists your app’s bundle ID. Again, that lets the system know that your app is responsible for these launchd jobs. If your product doesn’t include an app then there’s a limit to how well the system can do here. You might want to consider creating and installing some sort of management app, one that exists solely to become the responsible code for your launchd jobs. If you’ve concluded that your product is built correctly and you’re able to consistently reproduce the problem on a fresh machine, that’s definitely worth filing a bug about it. Such a bug should be actionable. Even if you can’t reproduce the problem, you might still want to file a bug about it, with the understanding that it’s significantly harder to fix such bugs. Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi Team, We have developed an Daemon process using Microsoft Windows Worker Service written in .NET Core. On the first run the daemon process supposed to copy an sqlite database file on our specified path and then it will also generate some image files and save them on the specified path. The daemon process is working perfectly fine in DEBUG mode. However whenever we launch the daemon process in RELEASE mode via launchd command, the daemon process is unable to copy or write the files on the specified path. It looks like in the RELEASE mode the exe file of daemon needs file writing permissions to copy and write the files. Can you please guide us how can we resolve this issue and grant the file writing rights to the daemon process to work? Thank you. Asif from Techliance.

I did some research and found that we can add our app by bundling a 'helper app' inside the main app's Contents/Library/LoginItems. Then in the main app (say from app delegate didlaunchwithoptions), call SMLoginItemSetEnabled and pass it the bundle identifier of the helper app and flag=true. This is way, when the main app is launched, it will configure the helper app as the 'login item', and that helper app will be launched automatically upon system login. Then in the helper app launch process, check if the 'main app' is not running, open it by using its path/url. But we also want that users are not able to quit (or force-quit) the main app (it's a security app). Or at least, if they kill the app, it should be relaunched automatically. Will just doing the above achieve all this? app should be launched upon system login app should be launched if it's killed by any way If not, what are the options?

My situtation: I recently added AssociatedBundleIdentifiers in launchd plist and see the result that my app's name is on the System Settings > Login Items (Allow in the background). But the machine that already has installed the older app without AssociatedBundleIdentifiers still shows Developer ID due to the cached state. And it is commemted at https://developer.apple.com/forums/thread/713493. It can be updated by resetting command and then restarting the system, but doing it on my users' machines seems inappropriate in many ways. My question: So, is there any way that I can make the change(Developer ID -> App name) without resetting and restarting by any chance?

I have a problem with a helper implemented with SMAppService daemonServiceWithPlistName. The helper run a command line program that executes system(dscl . delete /Users/name_of_user) Previously, this was implemented using AuthorizationExecuteWithPrivileges and it worked, from macOS Ventura start to show a dialog window "App would like to administer your computer. Administration can include modifying passwords, networking and system setting". But with SMAppService there is no such dialog window and helper app just stuck. I would like to know if this is a bug or correct behavior for a helper through SMAppService. Thanks for the answer.

I'm getting a code signing crash when I try to register a helper app as a login item, and I think this is new with macOS 13.4. That is, the crash log contains this: Exception Type: EXC_CRASH (SIGKILL (Code Signature Invalid)) Exception Codes: 0x0000000000000000, 0x0000000000000000 Termination Reason: CODESIGNING 4 Launch Constraint Violation I'm seeing one suspicious message in the system log: tccd Prompting policy for hardened runtime; service: kTCCServiceAppleEvents requires entitlement com.apple.security.automation.apple-events but it is missing for accessing={TCCDProcess: identifier=com.jwwalker.AutoPairs.uiapp, pid=91471, auid=501, euid=501, binary_path=/Applications/AutoPairs 4.0.1a1/AutoPairs4.0.1a1.app/Contents/MacOS/AutoPairs}, requesting={TCCDProcess: identifier=com.apple.appleeventsd, pid=531, auid=55, euid=55, binary_path=/System/Library/CoreServices/appleeventsd}, I can't figure out why the OS would think that I need an Apple Events entitlement. I've looked a the thread Resolving Code Signing Crashes on Launch, but it hasn't enlightened me. One problem I ran into is at the step certtool d "authorised0.cer" I get the output CSSM_CL_CertGetAllFields: CSSMERR_CL_UNKNOWN_FORMAT

Looking at the sample project in: https://developer.apple.com/documentation/servicemanagement/updating_your_app_package_installer_to_use_the_new_service_management_api It appears that the SMAppServiceSampleCode command line tool must be executed in a user context to successfully register the agent. Consequently, the pkg that is created in the sample project would not register the agent if it is installed as root (or when installed from an MDM). This could be worked out by using launchctl asuser to run the command line tool as the logged-in user user in the postinstall, but if nobody is logged in the pkg installation would actually fail. If the command line tool is meant to be transparent to the user and not necessarily used by the user, are there any workarounds for this or something that I am missing?

All launchdaemons inside /Library/LaunchDaemons won't launch on reboot. The launchdaemon plists seem to still work if you launch them manually with launchctl load -w but they don't survive a reboot. It was still OK with Ventura 13.0 but something seems to have changed at the system level with 13.1. I've tried every variation with configuring the plists but nothing works. There is a new SMAppService API with Ventura 13 betas but it's still too new - the old system needs to work until we've safely migrated to the new system. Changing horses in midstream and drowning... Does anyone else see this?