Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I work as admin in a college environment. One of the challenges is to stop the services installed by students with CS major. Some time back they got the admin access and installed launch agents and daemons on some systems.The students have also added some plists as com.apple.myprog.run. The problem is these are not present in the launchagents directory or in the launchdaemons directory.

So my question is how to find the path for these daemon services.Then next step is how to stop these. Since some of these could start again and again(based on certain flags).

share|improve this question
    
Similar problem. Can't stop a daemon that was started up with launchctl load -wF /Library/LaunchDaemons/name.of.this.plist. –  Meltemi Jun 12 '12 at 21:50

1 Answer 1

If you want to stop the item for this boot simply issue an unload command to launchd via launchctl. For a permanent fix add a disabled key into the plist with value true or delete/move the file to a folder where launchd will not scan it automatically.

  • launchctl unload /System/Library/LaunchAgents/com.apple.AppStoreUpdateAgent.plist

The man page for launchctl has nice documentation for controlling jobs. As for the general defeating of CS majors, you might also consider that they edited the existing apple plists to make them do something you don't expect, so it will prove to be far easier to just reinstall the OS and migrate the user data back from a backup (paying particular note to note re-install any plist files in the /System/Library, /Library space (and perhaps also audit the ~/Library of admin users). Losing admin / root against someone that knows how to change the system is basically game over and the defense (finding and disabling) the changes is very time consuming as opposed to offense (reinstalling the system from a known good source and use configuration management tools to ensure changed files are detected).

share|improve this answer
    
the point is I don't know where the plist has been stored. I have searched in the LaunchAgents directory and I don't see the apps plist there. –  Prashant Jan 17 '12 at 0:26
    
They can be anywhere. You could boot into safe mode and compare a launchctl list output to the normal boot list. mdfind will show you the files containing the rogue jobs (if they didn't exclude them from spotlight). You could also theoretically run fs_usage against launchd itself to track which files it read during boot, but again the logistics of getting fs_usage running that soon at boot combined with the fact that you still need to inspect each and every plist file means you have a lot of work cut out to "detect the changes and surgically remove them" as opposed to start clean. –  bmike Jan 17 '12 at 0:35
    
If you really want to find every .plist on the system this will do it. It's a long list. find / -type f -name "*.plist" –  afragen Jan 17 '12 at 2:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.