How do I run a sudo command at login/logout on macOS

Question

I'm trying to run a command at login/logout which requires sudo. I've read about LaunchDaemon and LaunchAgent but as I understand it, LaunchDaemon will run the command at startup with root permissions, and LaunchAgent will run it at login but with the current user permissions, which won't always be an administrator.

Alternatively, is there a way to run my command without the need of sudo? I'm trying to wipe all files in the home directories (Desktop, Documents etc.) on user login/logout so am currently using sudo rm -rf /users/randomuser/Desktop/* etc. Similar to how a guest account works, but without the account being guest and with a little more control. I'm pretty new to this kind of thing so please explain like I'm 5. More than happy to try out another solution if required. Thanks!

EDIT - Thanks for the help so far. Here's a bit more detail about the use case:

I have a mac that will be used by myself (admin) and a few other people (second account). I don't want data to persist between logins on this second account, similar to how the Guest Account works. The problem with the guest account is, it resets applications placed in the dock between logins as well as resetting the desktop wallpaper (which I would like to keep the same throughout logins). My solution was to set up a standard account, lock the dock using defaults write com.apple.Dock size-immutable -bool yes and set the wallpaper manually. As for the data, I would like all files that have been downloaded or transferred by the user to be wiped when the user logs out (or equally, when the next user logs in). Alternatively, If there is a way for the Guest Account to not reset the dock and wallpaper on logout, this would also work. Thanks again!

Answer 1

Unless the files are created with sudo the user can delete files within his own profile.

So, creating a LaunchAgent that cleans the desktop at login would do the trick.

Login in with the account you want to use for guests.

Create a small script with the following code and save it as /usr/local/bin/cleanDesktop.sh.

#!/bin/bash
rm -rf /Users/$(whoami)/Desktop/* 

Make it executable by running chmod +x /usr/local/bin/cleanDesktop.sh.

Now create a LaunchAgent to run your script. Save the code below as ~/Library/LaunchAgent/com.local.cleanDesktop.plist

and run launchctl load ~/Library/LaunchAgent/com.local.cleanDesktop.plist from the command line.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.local.cleanDesktop</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/cleanDesktop.sh</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

Warning this code deletes stuff and I did not test it. So use with caution. Also, the user could delete this code. Alternatively you could save the file in /Library/LaunchAgents. Then it won't be editable for standard users. But it will run for all users.

Answer 2

It is a bad idea to call sudo to remove files. Sudo may ask for the password and since it isn't entered it may fail. And yes, there are situations where you need to call sudo to remove your own files. Simply clone a Git repository to your desktop. The Git metadata will prevent a 'normal' rm from working.

You could utilize MacOS' Login/Logout hooks as long they work on your machine. I expect Apple to remove them some day.

LoginHook.sh - commands to be executed as root when a user logs in. $1 is the user name, consider this being a sample script:

#!/bin/bash

logfile=$(pwd)/LoginHookLog.txt
echo "" > $logfile

user=$1
if [ -d /Users/$user/Library/Login ] ; then
    cd /Users/$user/Library/Login
    for s in *
    do
        echo `su -l $user -c /Users/$user/Library/Login/$s` >> $logfile
    done
fi
exit

LogoutHook.sh - commands to be executed as root when a user logs out. $1 is the user name, consider this being a sample script:

#!/bin/bash

logfile=$(pwd)/LogoutHookLog.txt
echo "" > $logfile

user=$1
if [ -d /Users/$user/Library/Logout ] ; then
    cd /Users/$user/Library/Logout
    for s in *
    do
        echo `su -l $user -c /Users/$user/Library/Logout/$s` >> $logfile
    done
fi
exit

Installation:

mkdir /Library/LoginWindowScripts
cp LoginHook.sh /Library/LoginWindowScripts/LoginHook.sh
cp LogoutHook.sh /Library/LoginWindowScripts/LogoutHook.sh
chmod 755 /Library/LoginWindowScripts/LoginHook.sh
chmod 755 /Library/LoginWindowScripts/LogoutHook.sh
defaults write com.apple.loginwindow LoginHook /Library/LoginWindowScripts/LoginHook.sh
defaults write com.apple.loginwindow LogoutHook /Library/LoginWindowScripts/LogoutHook.sh

Per user installation:

mkdir ~/Library/Login && mkdir ~/Library/Logout

Users place their personal scripts to these folders and make them executable. The scripts may not launch any app.

--- EDIT ---

As of today, only the logout hook seems to work.

Answer 3

I have detailed the process I used to run a script as root at any users login here: Hiding default folders via launchagent: not applying to documents

I'm afraid that I do not know how to run on logout without using logout hooks, which I would not recommend as Apple have been trying to depreciate this for years.