0

I've a security daemon which performs many security related tasks. Daemon plist is part of /Library/LaunchDaemon/com.xyz.securityservice.plist also KeepAlive flag is 1.

The daemon I've currently can be stopped using this command - sudo launchctl unload /Library/LaunchDaemon/com.xyz.securityservice.plist

I wanted to restrict security daemon from unloading by this command.

I do not want anyone to unload/stop this daemon. One can stop security daemon only if he has security password(not system password) or if we send some private notification to daemon to stop itself. Daemon will observe this private notification.

Please suggest any pointer on this.

  • 1
    Given that root can kill -STOP any process I doubt that you can prevent users from stopping your daemon. – nohillside Mar 18 '15 at 6:53
2

I'm not a developer or a guru in all of the available keys with launch daemons, but that is kind of a tall order as by design, root can do anything. I'm thinking you would basically be creating a security "virus" that would have a helper mechanism reload the daemon if it gets unloaded.

  • I had thought this approach to have a helper daemon which which will check for main daemon service and launch if it's unloaded. The problem with this approach is, if someone wants to unload main daemon then he can write a script and unload both daemon at a time. A normal user would never unload daemon, but we want to protect it from advance users. – Omkar Mar 18 '15 at 4:30
  • You would probably have to create a more robust binary (AFAIK) - Google Chrome behaves this way. If you've ever tried to manage Chrome in an environment it is very tricky - it self-heals if you remove/disable certain components e.g ksadmin/ksfetch for update checking. – willWorkForCookies Mar 18 '15 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .