2

I want to stop a user in MacOS from unloading a plist using launchctl?

Launchctl does not seem to always require a su / sudo. I have a non-admin user that is managing to switch off app restrictions and adjust various processes that are running.

I don't want to block Terminal, which is my current solution.

Improve this question
6
  • 1
    Is it a launch daemon or a launch agent? Daemons shouldn't be disablable without admin access.
    – Gordon Davisson
    Nov 26, 2019 at 1:43
  • You needn't block Terminal, but you can restrict the privileges of just his specific user account, either in what he can do through a shell, or by setting the permissions of the ~/Library and other similar folders so that only administrators and wheel or root can edit/view/etc.
    – CJK
    Nov 26, 2019 at 1:54
  • Have a look at this answer. In short, use Gatekeeper and disallow access
    – Allan
    Nov 26, 2019 at 5:43
  • launchctl unload -w /System/Library/LaunchDaemons/... it's not asking for a su password... so they can unload app restrictions. I am not sure how a non-admin account is managing this. At the moment I have just renamed and moved Terminal to a local App folder for an Admin account (with SIP disabled) as a not so sexy solution...
    – Adey Jade
    Nov 26, 2019 at 21:28
  • i can't lock ~/Library/ to Admin accounts because a local user can just change the permissions and it stops most apps working properly. Firefox won't even launch.
    – Adey Jade
    Nov 26, 2019 at 21:34

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .