macOS Ventura Beta: launchd does not load plist for guest account

Question

RudoBaker OP

Created Jul ’22

Replies 2

Boosts 0

Views 1.9k

Participants 2

Hi,

I have experienced strange behavior from launchd on macOS Ventura. The scenarios are following:

If a .plist is copied to /Library/LaunchAgents then:

it loads for normal user
it does not load for guest user

If a .plist is a symlink to a .plist inside app bundle, it loads in both cases.

Following are the launchd logs from the scenario when it does not load:

2022-07-21 16:04:29.403496 (gui/201/com.avast.userinit [4556]) <Error>: Service could not initialize: Untrusted spawn was denied for /Library/LaunchAgents/com.avast.userinit.plist, error 0xa1 - Service cannot be launched because of BTM policy
2022-07-21 16:04:29.403513 (gui/201/com.avast.userinit [4556]) <Error>: initialization failure: 22A5295i: xpcproxy + 21944 [418][B19C1C8C-E684-388B-857E-802288C1D9C3]: 0xa1
2022-07-21 16:04:29.403520 (gui/201/com.avast.userinit [4556]) <Error>: Untrusted service was denied launch by BTM. Removing.
2022-07-21 16:04:29.403523 (gui/201/com.avast.userinit [4556]) <Notice>: internal event: INIT, code = 161
2022-07-21 16:04:29.404265 (gui/201/com.avast.userinit [4556]) <Notice>: xpcproxy exited due to exit(78)
2022-07-21 16:04:29.404272 (gui/201/com.avast.userinit [4556]) <Notice>: exited due to exit(78)

Is this a bug in launchd? Or is it now preferred to use symlinks so the OS can figure out to what bundle the .plist belongs.

If similar policy will later be applied also to non-guest users or for plists inside /Library/LaunchDemons, it will break our application.

Thanks for any info on this.

Boost

Answer 1

DTS Engineer OP

Apple

Jul ’22

This is probably fallout from the SMAppService changes we made in macOS 13 beta. I recommend that you review the WWDC preso on this [1] and decide whether you can take advantage of it. If so, that’s probably your best path forward. If not, I’m going to recommend that you file two bugs:

One compatibility bug, describing the impact this is having on your product
Another enhancement request, for a way that SMAppService could be improved to meet the needs of your product

Please post the numbers of any bugs you file, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] You can find a link to it in the Service Management Resources post.

0

Answer 2

RudoBaker OP

Jul ’22

Thank you for the reply,

I have filled FB10807608 describing the compatibility issue.

Our app uses Apple Installer instead of SMAppService as we support systems all the way back to El Capitan. So I will not create a ticket for that as I would not be able to provide sample code.

Kind regards,

Jakub

0