I'm trying to setup a TeamCity Build Agent on a Mac Mini Server running 10.7.3. I have successfully got it running and building but only if I login and launch the process manually.

We'd prefer to have the process kick off at startup which appears to be easily done by putting a plist file in the /Library/LaunchDaemon folder. Unfortunately this doesn't work for us as the process fires off as root rather than as our specified user. We really would prefer to keep things constrained to the user's folder and moreover need access to a keychain to handle the iOS code signing mechanics. Unfortunately, using ~/Library/LaunchAgents doesn't work as that seems to require someone visit the terminal and login -- this needs to kick off from boot and stay running when the user is logged out.

Is there a way to launch a process as a specified user on boot?

2 Answers 2


You can easily run as another user with sudo -u like so:



sudo -u "$UZER" /path/to/program/you/want/to/run

exit 0

Just change 'jsmith' to the appropriate short user name, and then save that as a script somewhere, and call from /Library/LaunchDaemons

Remember that all files in /Library/LaunchDaemons must be owned by root to be run.

(I think this is what bmike was suggesting)

Another option

However, I wrote up a HOWTO for making auto-login more secure:

Terminally Geeky: use automatic login more securely

The executive summary is this:

  • Turn on Automatic login
  • Put this launchd plist in ~/Library/LaunchAgents
  • Reboot

What it does:

As soon as you login, launchd will throw you back to the login screen using:

"/System/Library/CoreServices/Menu Extras/User.menu/Contents/Resources/CGSession" -suspend

Note that is all one long line.

Considering that someone with physical access to your computer has a lot of potential exploits, I consider this relatively safe, but of course everyone has to make their own determination. I run this in my small office, but my iMac is in my private office which I can lock when I'm not there.

Also note that automatic login doesn't work with FileVault 2.

  • Does running sudo -u get keychain access for the user specified? Feb 8, 2012 at 21:23
  • That I do not know. You could try the security tool to see if you can access it that way.
    – TJ Luoma
    Feb 10, 2012 at 0:14
  • In the end auto login with your logout was good enough for our purposes. Feb 11, 2012 at 22:34

The easy way is to set that user to auto log in and then lock the screen with fast user switching enabled. Otherwise you will have to do the hard work of creating an admin level user and having your script or process launch itself with a specific user.

Processes launched before the user login session starts are functionally root and need to demote themselves if you don't want them running as root. Apple does this with the web server and the user _www and on the client side, some processes are running as users nobody, _spotlight and , _mdnsresponder.

  • Gotcha. Former option sounds really ugly, is there any documentation on how to do the latter option? Feb 8, 2012 at 17:21
  • I would start with developer.apple.com/library/mac/#documentation/MacOSX/… for documentation. It is dense so have you considered just changing your daemon to have sudo pick the user rather than launch as an inherited task. I haven't tried that lately, but it's fast and might just work.
    – bmike
    Feb 8, 2012 at 17:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .