SMAppService with root Helper

Question

Gerriet-1 OP

Created Jul ’23

Replies 2

Boosts 0

Views 1.3k

Participants 3

My app needs a HelperTool which runs as root.

I did in Xcode Version 14.3.1 (14E300c), macOS 13.4.1 (22F82):

• Create new Project: macOS App: TestSM • Add new target: XPC Service: HelperSM • make new Property List: smProp.plist with: Label de.mdenkmann.HelperSM BundleProgram /Contents/XPCServices/HelperSM.xpc/Contents/MacOS/HelperSM • add Copy File Build Phase in TestSM for smProp.plist with: Destination: Wrapper Subpath: Contents/Library/LaunchDaemons

smAppService = SMAppService.daemon(plistName: "smProp.plist") smAppService.register()
now: smAppService.status = "enabled"

When I do: let connectionToService = NSXPCConnection(serviceName: helperSMBundleIdentifier) I can communicate with HelperSM, but it does NOT run as root. Bad.

When I do: let connectionToService = NSXPCConnection(machServiceName: "de.mdenkmann.HelperSM", options: [. privileged]) I get NSXPCConnectionInvalid when I communicate with the HelperSM. Even worse.

How to get my root Helper?

When I look at: System Settings → General → Login Items → Allow in the Background I see: TestSM.app 3 items; 3 items affect all users.

What are these 3 items? Why Background? I want my HelperSM get started as root when called from TestSM, then run it as long as the system sees fit, then stop. It should not be called from other apps. It has no need to run in the background once TestSM stops.

Boost

Answer 1

DTS Engineer OP

Apple

Jul ’23

[It’s kinda hard to read your post, so I skipped a lot of it. Sorry. See Quinn’s Top Ten DevForums Tips for suggestions on how to format your post so that folks are more likely to read it.]

It can be hard to get started with Service Management, so I posted a concrete example of the process here. It’s for an agent, not a daemon, but the process is very similar.

What are these 3 items?

It’s possible that you’re not signing your code with a stable code signing identity, so the system doesn’t realise that build N of your app is the ‘same code’ as build N-1. I recommend Apple Development signing during the bring up.

Why Background?

Because that’s a reasonable user-level term. It would be a bit of a stretch for a user to understand the difference between a daemon, an agent, and a a login item.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

artemavrin OP

Oct ’23

I have same problem

I took the demo project from https://developer.apple.com/documentation/servicemanagement/updating_your_app_package_installer_to_use_the_new_service_management_api
Then redesign agent to daemon, in daemon code added FileManager.moveitem()
Build project, register daemon, in system settings I checked the authorization state for daemon
Run test command and get error that I have not permission for folder

0