Launching Network System Extension from LaunchAgent

App & System Services Drivers
muddymurphydog OP
Created
Replies 5
Boosts 0
Views 1.8k
Participants 4

In another question on this forum (https://developer.apple.com/forums/thread/124775) eskimo stated that launching a system extension from an daemon is not the right approach and that the OSSystemExtensionRequest.activationRequest API should be called from an App.

My question is, does this same restriction apply to a LaunchAgent started App?

If so, to ensure activation as soon as possible is the only option to use a SMLoginItemSetEnabled helper to start the App on login?

Answered by Systems Engineer in 706792022

My question is, does this same restriction apply to a LaunchAgent started App?

Yes, do not activate a System Extension from a daemon, launch agent, command line tool, helper app, or any other mechanism other than the Container App for the extension. Doing so may cause issues and inconsistencies when deactivating and uninstalling.

Also, a Network System Extension on macOS is started when the system starts so you should not need to worry about starting the extension as soon as possible. Last I knew, networking on the system was not allowed until the Network System Extension was started.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Replies  5
Boosts 0
Views  1.8k
Participants  4
Systems Engineer OP
Apple
Accepted Answer

My question is, does this same restriction apply to a LaunchAgent started App?

Yes, do not activate a System Extension from a daemon, launch agent, command line tool, helper app, or any other mechanism other than the Container App for the extension. Doing so may cause issues and inconsistencies when deactivating and uninstalling.

Also, a Network System Extension on macOS is started when the system starts so you should not need to worry about starting the extension as soon as possible. Last I knew, networking on the system was not allowed until the Network System Extension was started.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
muddymurphydog OP

Thanks for the clarification, Matt.

If our app is installed or updated without a user login active, ie via MDM like JAMF, how should we ensure the Container App is run on login so that the system extension activation or update (ie .replace) is performed?

I'm trying to use a Helper application installed using SMLoginItemSetEnabled but it's not starting the App. However, will that even work from a MDM install?

Systems Engineer OP
Apple

If our app is installed or updated without a user login active, ie via MDM like JAMF, how should we ensure the Container App is run on login so that the system extension activation or update (ie .replace) is performed?

Are you able to run an open command from a post install script on startup to make sure your container app is opened to complete the installation / activation flow?

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
tagnal OP

Yes, do not activate a System Extension from a daemon, launch agent, command line tool, helper app, or any other mechanism other than the Container App for the extension. Doing so may cause issues and inconsistencies when deactivating and uninstalling.

Can my launch agent be the Container App for the system extension? Or does it need to be separate?

DTS Engineer OP
Apple

Can my launch agent be the Container App for the system extension?

See here for my standard advice on that topic.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"