Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I'm trying to setup a TeamCity Build Agent on a Mac Mini Server running 10.7.3. I have successfully got it running and building but only if I login and launch the process manually.

We'd prefer to have the process kick off at startup which appears to be easily done by putting a plist file in the /Library/LaunchDaemon folder. Unfortunately this doesn't work for us as the process fires off as root rather than as our specified user. We really would prefer to keep things constrained to the user's folder and moreover need access to a keychain to handle the iOS code signing mechanics. Unfortunately, using ~/Library/LaunchAgents doesn't work as that seems to require someone visit the terminal and login -- this needs to kick off from boot and stay running when the user is logged out.

Is there a way to launch a process as a specified user on boot?

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

You can easily run as another user with sudo -u like so:

#!/bin/sh

UZER=jsmith

sudo -u "$UZER" /path/to/program/you/want/to/run

exit 0

Just change 'jsmith' to the appropriate short user name, and then save that as a script somewhere, and call from /Library/LaunchDaemons

Remember that all files in /Library/LaunchDaemons must be owned by root to be run.

(I think this is what bmike was suggesting)

Another option

However, I wrote up a HOWTO for making auto-login more secure:

Terminally Geeky: use automatic login more securely

The executive summary is this:

  • Turn on Automatic login
  • Put this launchd plist in ~/Library/LaunchAgents
  • Reboot

What it does:

As soon as you login, launchd will throw you back to the login screen using:

"/System/Library/CoreServices/Menu Extras/User.menu/Contents/Resources/CGSession" -suspend

Note that is all one long line.

Considering that someone with physical access to your computer has a lot of potential exploits, I consider this relatively safe, but of course everyone has to make their own determination. I run this in my small office, but my iMac is in my private office which I can lock when I'm not there.

Also note that automatic login doesn't work with FileVault 2.

share|improve this answer
    
Does running sudo -u get keychain access for the user specified? –  Wyatt Barnett Feb 8 '12 at 21:23
    
That I do not know. You could try the security tool to see if you can access it that way. –  TJ Luoma Feb 10 '12 at 0:14
    
In the end auto login with your logout was good enough for our purposes. –  Wyatt Barnett Feb 11 '12 at 22:34
add comment

The easy way is to set that user to auto log in and then lock the screen with fast user switching enabled. Otherwise you will have to do the hard work of creating an admin level user and having your script or process launch itself with a specific user.

Processes launched before the user login session starts are functionally root and need to demote themselves if you don't want them running as root. Apple does this with the web server and the user _www and on the client side, some processes are running as users nobody, _spotlight and , _mdnsresponder.

share|improve this answer
    
Gotcha. Former option sounds really ugly, is there any documentation on how to do the latter option? –  Wyatt Barnett Feb 8 '12 at 17:21
    
I would start with developer.apple.com/library/mac/#documentation/MacOSX/… for documentation. It is dense so have you considered just changing your daemon to have sudo pick the user rather than launch as an inherited task. I haven't tried that lately, but it's fast and might just work. –  bmike Feb 8 '12 at 17:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.