2

I want to stop a user in MacOS from unloading a plist using launchctl?

Launchctl does not seem to always require a su / sudo. I have a non-admin user that is managing to switch off app restrictions and adjust various processes that are running.

I don't want to block Terminal, which is my current solution.

Adey Jade
  • 41
  • 1
    Is it a launch daemon or a launch agent? Daemons shouldn't be disablable without admin access. – Gordon Davisson Nov 26 '19 at 01:43
  • You needn't block Terminal, but you can restrict the privileges of just his specific user account, either in what he can do through a shell, or by setting the permissions of the ~/Library and other similar folders so that only administrators and wheel or root can edit/view/etc. – CJK Nov 26 '19 at 01:54
  • Have a look at this answer. In short, use Gatekeeper and disallow access – Allan Nov 26 '19 at 05:43
  • launchctl unload -w /System/Library/LaunchDaemons/...

    it's not asking for a su password... so they can unload app restrictions. I am not sure how a non-admin account is managing this. At the moment I have just renamed and moved Terminal to a local App folder for an Admin account (with SIP disabled) as a not so sexy solution...

     – Adey Jade Nov 26 '19 at 21:28
  • i can't lock ~/Library/ to Admin accounts because a local user can just change the permissions and it stops most apps working properly. Firefox won't even launch. – Adey Jade Nov 26 '19 at 21:34
  • It shouldn't be possible to unload a launch daemon except as root (i.e. with sudo or su). Something really weird is going on here, and I think you'd be better off trying to figure out what it is than to try to patch symptoms like this. – Gordon Davisson Nov 28 '19 at 19:49

0 Answers0