I want to stop a user in MacOS from unloading a plist using launchctl?

Launchctl does not seem to always require a su / sudo. I have a non-admin user that is managing to switch off app restrictions and adjust various processes that are running.

I don't want to block Terminal, which is my current solution.

  • 1
    Is it a launch daemon or a launch agent? Daemons shouldn't be disablable without admin access. – Gordon Davisson Nov 26 '19 at 1:43
  • You needn't block Terminal, but you can restrict the privileges of just his specific user account, either in what he can do through a shell, or by setting the permissions of the ~/Library and other similar folders so that only administrators and wheel or root can edit/view/etc. – CJK Nov 26 '19 at 1:54
  • Have a look at this answer. In short, use Gatekeeper and disallow access – Allan Nov 26 '19 at 5:43
  • launchctl unload -w /System/Library/LaunchDaemons/... it's not asking for a su password... so they can unload app restrictions. I am not sure how a non-admin account is managing this. At the moment I have just renamed and moved Terminal to a local App folder for an Admin account (with SIP disabled) as a not so sexy solution... – Adey Jade Nov 26 '19 at 21:28
  • i can't lock ~/Library/ to Admin accounts because a local user can just change the permissions and it stops most apps working properly. Firefox won't even launch. – Adey Jade Nov 26 '19 at 21:34

You must log in to answer this question.

Browse other questions tagged .