How to change a system startup daemon into a user launch agent

Question

I'm using The Pritunl VPN software for one of my Mac's user accounts. The software installer creates a system LaunchDaemon found under /Library/LaunchDaemons called com.pritunl.service.plist

Unfortunately this service remains active when I log out from the user profile it's intended for, causing the VPN connection to also remain active for different user accounts.

What I would like to do is to remove this service from the /system/ and add it as a /user/username startup service. My intention is for the service to be started whenever I log in with the specific user and for it to stop whenever the user is logged out.

What I've tried to do so far is to unload the system service, remove the .plist from the system directory /Library/LaunchDaemons and to move it to the user directory ~/Library/LaunchAgents after which I attempted loading and registering it for the specific user account. I've not yet succeeded in performing these steps correctly as the user account in question does not have root access.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.pritunl.service</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Applications/Pritunl.app/Contents/Resources/pritunl-service</string>
    </array>
    <key>KeepAlive</key>
    <true/>
    <key>Umask</key>
    <integer>0</integer>
</dict>
</plist>

sudo launchctl list com.pritunl.service
{
    "LimitLoadToSessionType" = "System";
    "Label" = "com.pritunl.service";
    "OnDemand" = false;
    "LastExitStatus" = 0;
    "PID" = XXXX;
    "Program" = "/Applications/Pritunl.app/Contents/Resources/pritunl-service";
    "ProgramArguments" = (
        "/Applications/Pritunl.app/Contents/Resources/pritunl-service";
    );
};

Reference material I've used: https://rakhesh.com/mac/macos-launchctl-commands/

When trying to learn more about LimitLoadToSessionType I've only managed to find this archived older documentation. https://developer.apple.com/library/archive/technotes/tn2083/_index.html

Trying to find it on the current documentation page hasn't resulted in what I'm looking for. https://developer.apple.com/search/?q=LimitLoadToSessionType

I've found this excellent post detailing a lot of related subjects. launchd: Confusion on semantics of bootstrap and bootout etc. after reading manual pages

Answer 1

First thing I noticed is the LimitLoadToSessionType key. All my user agents have that set to "Aqua" which I am guessing means the Finder is running with a logged in user. Fix this first.

You shouldn't need root access or admin rights to do the required steps.

If you go launchctl print user you will get told that is invalid and it should list all the targets you can access. If things are working one of them should be gui/501/com.pritunl.serviceso then launchctl print gui/501/com.pritunl.service should dump a good guide to what the Mac is thinking about the agent you are specifying. If you don't see it then try loading it again or reboot the box and have another look.