I want to prevent a LaunchDaemon (/Library/LaunchDaemons/com.mycorp.service.plist) from being loaded by a non-root user.

Running sudo launchctl load /Library/LaunchDaemons/com.mycorp.service.plist starts the service. Running launchctl load /Library/LaunchDaemons/com.mycorp.service.plist without sudo will load the service, but because my service exits immediately when not run as root, it doesn't actually do anything other than reload repeatedly.

Is there a way to prevent a non-root user from running launchctl load /Library/LaunchDaemons/com.mycorp.service.plist? The following do not work:

  • chmod 600 com.mycorp.service.plist (not readable to non-root)
  • chmod 000 com.mycorp.service.plist (not readable to any user!)
  • Using the UserName key in com.mycorp.service.plist - apparently this is ignored when launchctl is not run as root

With the above changes, launchctl load still works (uselessly) as non-root.

  • Not a full solution, but: how about having the service program check its UID, and if it's not 0 throw up a notification or something similar (to the user it is running as) that it hasn't been loaded properly & how to fix it (launchctl unload ... as user, then sudo launchctl load ...). Or you might even be able to fire of the process of reloading in a semi-automated fashion, but that might be tricky. – Gordon Davisson Nov 1 '19 at 22:08

You must log in to answer this question.

Browse other questions tagged .