Escape Velocity. with 1 PSUMacAdmins 2016

Size: px

Start display at page:

Download "Escape Velocity. with 1 PSUMacAdmins 2016"

Dominic Hood
6 years ago
Views:

1 Approaching Escape Velocity with 1 PSUMacAdmins 2016

Shoulders of Giants: Introduction: Google Tech Talk 2007 1 Dave Zarzycki Overview: PSUMacAdmins 2012 2 Matt Hansen Deep Dive: MacSysAdmin 2014 3 Jonathan

2 Shoulders of Giants: Introduction: Google Tech Talk Dave Zarzycki Overview: PSUMacAdmins Matt Hansen Deep Dive: MacSysAdmin Jonathan Levin 1 Launchd: One Program to Rule them All youtube 2 Getting Started with launchd for Sys Admins youtube 3 Launchd - At Your Service video 2 PSUMacAdmins 2016

3 init pid 1 /etc/rc.local /etc/inittab runlevels 3 PSUMacAdmins 2016

4 init inetd xinetd watchdog at cron SystemStarter 4 PSUMacAdmins 2016

5 launchd Take advantage of multi-core systems Reduce reliance on dependencies Use privilege separation Run processes as needed Interprocess Communication 4 4 Root and Login Sessions [dev site] 5 PSUMacAdmins 2016

6 launchd 2.0 Increased usage by Apple: Leopard: 166 launchd jobs Lion: 361 launchd jobs El Capitan: 535 launchd jobs Complete re-write No longer open source New and deprecated keys and arguments 6 PSUMacAdmins 2016

7 What launchd does Loads parameters from plists Registers requested sockets & file descriptors Launches always-on daemons Watches processes & passes requests to daemons Stops daemons at system shut down 5 5 Creating Launch Daemons and Agents [dev site] 7 PSUMacAdmins 2016

8 What launchd does not Wait for network to be active Wait for file system mounts Wait for hardware drivers Make any assumptions at all 5 5 Creating Launch Daemons and Agents [dev site] 8 PSUMacAdmins 2016

9 Daemons vs Agents /System/Library/Launch{Daemons,Agents} /Library/Launch{Daemons,Agents} ~/Library/LaunchAgents 5 5 Creating Launch Daemons and Agents [dev site] 9 PSUMacAdmins 2016

10 Types of plists file /System/Library/LaunchDaemons/* /System/Library/LaunchDaemons/bootps.plist: /System/Library/LaunchDaemons/com.apple.AirPlayXPCHelper.plist: /System/Library/LaunchDaemons/com.apple.AppleFileServer.plist: /System/Library/LaunchDaemons/com.apple.AssetCacheLocatorService.plist: /System/Library/LaunchDaemons/com.apple.CommCenterRootHelper.plist: /System/Library/LaunchDaemons/com.apple.CoreRAID.plist: /System/Library/LaunchDaemons/com.apple.CrashReporterSupportHelper.plist: /System/Library/LaunchDaemons/com.apple.DesktopServicesHelper.plist: /System/Library/LaunchDaemons/com.apple.DumpGPURestart.plist: /System/Library/LaunchDaemons/com.apple.DumpPanic.plist: /System/Library/LaunchDaemons/com.apple.FileCoordination.plist: /System/Library/LaunchDaemons/com.apple.FileSyncAgent.sshd.plist: /System/Library/LaunchDaemons/com.apple.FontWorker.plist: /System/Library/LaunchDaemons/com.apple.GSSCred.plist: /System/Library/LaunchDaemons/com.apple.GameController.gamecontrollerd.plist: XML document text XML document text XML document text Apple binary property list XML document text XML document text XML document text XML document text XML document text XML document text Apple binary property list XML document text XML document text XML document text XML document text 10 PSUMacAdmins 2016

11 Convert bplist cat com.some.launchd.plist plutil -convert xml1 - -o - <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" " <plist version="1.0"> <dict> <key>label</key> <string>com.some.launchd</string> <key>programarguments</key> <array> <string>/usr/local/bin/some_script.sh</string> <string>-some_argument</string> </array> <key>runatload</key> <true/> </dict> </plist> 11 PSUMacAdmins 2016

12 Required Keys Label unique identifier for the job ProgramArguments the command being run (Some trigger) tells the job when to run 12 PSUMacAdmins 2016

13 Label & ProgramArguments com.some.launchd.plist <dict> <key>label</key> <string>com.some.launchd</string> <key>programarguments</key> <array> <string>/usr/local/bin/some_script.sh</string> <string>-some_argument</string> </array> <key>runatload</key> <true/> </dict> </plist> 13 PSUMacAdmins 2016

14 KeepAlive SuccessfulExit boolean, restart on (un)successful exit PathState boolean, dict of filesystem paths OtherJobEnabled boolean, dict of other jobs labels Crashed boolean, restart if crashed 14 PSUMacAdmins 2016

15 KeepAlive com.apple.airportd.plist <key>keepalive</key> <dict> <key>successfulexit</key> <false/> <key>crashed</key> <true/> </dict> 15 PSUMacAdmins 2016

16 Scheduling Jobs RunAtLoad runs immediately when plist is loaded StartInterval runs every N seconds StartCalendarInterval specify weekday/hour/minute LaunchOnlyOnce run once and never try again 16 PSUMacAdmins 2016

17 StartInterval com.adobe.fpsaud.plist <dict> <key>label</key> <string>com.adobe.fpsaud</string> <key>programarguments</key> <array> <string>/library/application Support/Adobe/Flash Player Install Manager/fpsaud</string> </array> <key>startinterval</key> <integer>3600</integer> <key>keepalive</key> <false/> </dict> </plist> 17 PSUMacAdmins 2016

18 StartCalendarInterval com.apple.locate.plist <key>startcalendarinterval</key> <dict> <key>hour</key> <integer>3</integer> <key>minute</key> <integer>15</integer> <key>weekday</key> <integer>6</integer> </dict> 18 PSUMacAdmins 2016

19 LimitLoad LimitLoadToSessionType Aqua LoginWindow Background System LimitLoadToHardware i.e. MacBookPro11,5 LimitLoadFromHardware inverse 19 PSUMacAdmins 2016

20 LimitLoadToSessionType com.apple.quicklook.config.plist <key>limitloadtosessiontype</key> <array> <string>aqua</string> <string>loginwindow</string> </array> 20 PSUMacAdmins 2016

21 LimitLoadToHardware com.apple.firmwareupdatehelper.plist <key>limitloadtohardware</key> <dict> <key>model</key> <array> <string>macbook8,1</string> <string>macbook9,1</string> </array> </dict> 21 PSUMacAdmins 2016

22 Triggers WatchPaths boolean, array of filenames to watch QueueDirectories boolean, array of dirnames to watch StartOnMount boolean, start on filesystem mount 22 PSUMacAdmins 2016

23 WatchPaths com.oracle.java.helper-tool.plist <key>programarguments</key> <array> <string>/library/internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Helper-Tool</string> </array> <key>watchpaths</key> <array> <string>/library/internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/com.oracle.java.Java-Updater.plist</string> </array> 23 PSUMacAdmins 2016

24 QueueDirectories com.apple.reportpanic.plist <key>program</key> <string>/system/library/coreservices/reportpanic.app/contents/macos/reportpanic</string> <key>queuedirectories</key> <array> <string>/var/db/panicreporter/</string> </array> <key>launchonlyonce</key> <true/> 24 PSUMacAdmins 2016

25 StartOnMount com.apple.tmhelperagent.setupoffer.plist <key>programarguments</key> <array> <string>/system/library/coreservices/backupd.bundle/contents/resources/tmhelperagent.app/contents/macos/tmhelperagent</string> <string>-offer</string> </array> <key>startonmount</key> <true/> 25 PSUMacAdmins 2016

26 Sockets listeners can be any name SockType stream (tcp) or dgram (tcp) SockPathName socket filepath SockPathMode ownership, in decimal 26 PSUMacAdmins 2016

27 SockPathName com.apple.rpcbind.plist <key>sockets</key> <dict> <key>ondemandtickler</key> <dict> <key>sockpathname</key> <string>/var/run/portmap.socket</string> <key>sockpathmode</key> <integer>511</integer> </dict> </dict> 27 PSUMacAdmins 2016

28 Additional Limiters {Soft,Hard}ResourceLimits Core, CPU, Data, NumberOfFiles, etc Throttling keys Nice, LowPriorityIO, ThrottleInterval ProcessType Standard, Background, Interactive, Adaptive 28 PSUMacAdmins 2016

29 ThrottleInterval com.apple.screensharing.agent.plist <key>throttleinterval</key> <integer>1</integer> 29 PSUMacAdmins 2016

30 Additional Controllers EnvironmentVariables pass to the job {Root,Working}Directory chroot & chdir Standard{In,Out,Error}Path redirects stdio 30 PSUMacAdmins 2016

31 StandardErrorPath com.apple.alf.agent.plist <key>standarderrorpath</key> <string>/var/log/alf.log</string> <key>standardoutpath</key> <string>/var/log/alf.log</string> 31 PSUMacAdmins 2016

32 intermission 32 PSUMacAdmins 2016

33 James Buchanan 33 PSUMacAdmins 2016

34 launchctl Changes in "Legacy" commands load/unload, start/stop, bsexec, asuser Newer commands bootstrap, enable/disable, kickstart 34 PSUMacAdmins 2016

35 Listing service info list "legacy", lists service info print prints description about domain/service print-disabled prints which services are disabled 35 PSUMacAdmins 2016

36 launchctl list PID Status Label - 0 com.apple.trustd.agent - 0 com.apple.mailserviceagent - 0 com.apple.appkit.xpc.sandboxedservicerunner - 0 com.apple.mdworker.mail com.apple.mdworker.shared com.apple.datadetectorsdynamicdata com.apple.cfprefsd.xpc.agent - 0 com.apple.coreauthentication.daemon - 0 com.apple.quicklook - 0 com.apple.parentalcontrols.check com.apple.finder - 0 com.apple.packagekit.installstatus - 0 com.apple.fontworker com.<apple class="bird"></apple> 36 PSUMacAdmins 2016

37 launchctl print user/501 com.apple.xpc.launchd.domain.user.501 = { type = user handle = 501 active count = 41 on-demand count = 0 service count = 39 active service count = 0 activity ratio = 0.00 creator = sshd.269 creator euid = 0 external activation count = 1 session = Background security context = { uid = 501 asid = } PSUMacAdmins 2016

38 launchctl print user/ services = { com.apple.mdworker.shared com.apple.syncdefaultsd 0 - com.apple.trustd.agent 0 - com.apple.mdworker.sizing 0 - com.apple.mailserviceagent 0 - com.apple.accounts.dom com.apple.icloudhelper 0 - com.apple.tonelibraryd 0 - com.apple.appkit.xpc.sandboxedservicerunner com.apple.tccd 0 - com.apple.mdworker.mail 0 - com.apple.cvmscompagent3600_x86_64_ com.apple.mdworker.single com.apple.speechrecognitioncore.brokerd PSUMacAdmins 2016

39 launchctl list com.apple.syslogd { }; "EnableTransactions" = true; "Sockets" = { "BSDSystemLogger" = ( file-descriptor-object; ); }; "LimitLoadToSessionType" = "System"; "MachServices" = { "com.apple.system.logger" = mach-port-object; }; "Label" = "com.apple.syslogd"; "TimeOut" = 30; "OnDemand" = false; "LastExitStatus" = 0; "PID" = 38; "Program" = "/usr/sbin/syslogd"; "ProgramArguments" = ( "/usr/sbin/syslogd"; ); 39 PSUMacAdmins 2016

40 launchctl print system/com.apple.syslogd com.apple.syslogd = { active count = 2 path = /System/Library/LaunchDaemons/com.apple.syslogd.plist state = running program = /usr/sbin/syslogd arguments = { /usr/sbin/syslogd } default environment = { } PATH => /usr/bin:/bin:/usr/sbin:/sbin environment = { ASL_DISABLE => 1 XPC_SERVICE_NAME => com.apple.syslogd } 40 PSUMacAdmins 2016

41 Loading services load/unload (un)loads a service or services bootstrap/bootout (un)loads a service or services bsexec/asuser execute in another user context reboot logout force logout of a GUI session reboot (-s) system force reboot, or into single user mode 41 PSUMacAdmins 2016

42 launchctl asuser 6 #!/bin/bash [[ $3!= "/" ]] && exit 0 /usr/bin/python /Library/Security/SecurityAgentPlugins/KeychainMinder.bundle/Contents/Resources/update_authdb.py install user=$(/usr/bin/stat -f '%u' /dev/console) [[ -z "$user" ]] && exit 0 /bin/launchctl asuser ${user} /bin/launchctl load /Library/LaunchAgents/com.google.corp.keychainminder.plist /bin/launchctl load /Library/LaunchDaemons/com.google.corp.keychainminderagent.plist exit 0 6 Keychain Minder [github] 42 PSUMacAdmins 2016

43 launchctl bootout gui/<uid> $ launchctl list grep demo - 0 com.psumac.demo.foo - 0 com.psumac.demo.bar $ launchctl bootout gui/501 /Library/LaunchAgents/com.psumac.demo.foo.plist $ launchctl list grep demo PID Status Label - 0 com.psumac.demo.bar 43 PSUMacAdmins 2016

44 44 PSUMacAdmins 2016

45 Mac Admins 45 PSUMacAdmins 2016

46 Imagr <dict> <key>label</key> <string>com.grahamgilbert.imagr-first-boot-pkg</string> <key>programarguments</key> <array> <string>/usr/local/first-boot/first-boot</string> </array> <key>runatload</key> <true/> <key>startinterval</key> <integer>20</integer> </dict> </plist> 46 PSUMacAdmins 2016

47 AutoPkg... <key>keepalive</key> <false/> <key>sockets</key> <dict> <key>autopkgserver</key> <dict> <key>sockpathname</key> <string>/var/run/autopkgserver</string> <key>sockpathmode</key> <integer>438</integer> </dict> </dict> </dict> </plist> 47 PSUMacAdmins 2016

48 PlanB <dict> <key>groupname</key> <string>staff</string> <key>label</key> <string>com.megacorp.planb</string> <key>lowpriorityio</key> <true/> <key>nice</key> <integer>20</integer> <key>processtype</key> <string>background</string> <key>programarguments</key> <array> <string>/usr/local/sbin/planb_check</string> <string>-q</string> <string>-s</string> <string>180</string> </array> PSUMacAdmins 2016

49 PlanB... <key>programarguments</key> <array> <string>/usr/local/sbin/planb_check</string> <string>-q</string> <string>-s</string> <string>180</string> </array> <key>runatload</key> <true/> <key>startinterval</key> <integer>3607</integer> <key>timeout</key> <integer>1800</integer> <key>username</key> <string>root</string> <key>workingdirectory</key> <string>/</string> </dict> </plist> 49 PSUMacAdmins 2016

50 Casper <dict> <key>abandonprocessgroup</key> <true/> <key>groupname</key> <string>wheel</string> <key>keepalive</key> <true/> <key>label</key> <string>com.jamfsoftware.jamf.daemon</string> <key>machservices</key> <dict> <key>com.jamfsoftware.daemon.services.mount</key> <true/> </dict> <key>nice</key> <integer>20</integer> <key>programarguments</key> <array> PSUMacAdmins 2016

51 demo stupid launchd tricks 51 PSUMacAdmins 2016

52 Outset 7 Motivation Learn python Supporting air-gapped labs ScriptRunner 8 & first-boot-pkg 9 Desired Features System & user context Scripts & pkgs & profiles First-boot & every-boot 7 Outset [github] 8 ScriptRunner [github] 9 first-boot-pkg [github] 52 PSUMacAdmins 2016

53 Basic Outset daemons & agents /Library/LaunchDaemons/com.github.outset.boot.plist /Library/LaunchDaemons/com.github.outset.cleanup.plist /Library/LaunchAgents/com.github.outset.login.plist /Library/LaunchAgents/com.github.outset.on-demand.plist 53 PSUMacAdmins 2016

54 Basic Outset com.github.outset.boot.plist <dict> <key>label</key> <string>com.github.outset.boot</string> <key>programarguments</key> <array> <string>/usr/local/outset/outset</string> <string>--boot</string> </array> <key>runatload</key> <true/> </dict> </plist> 54 PSUMacAdmins 2016

55 Basic Outset payload directories /usr/local/outset/boot-once/ /usr/local/outset/boot-every/ /usr/local/outset/login-once/ /usr/local/outset/login-every/ 55 PSUMacAdmins 2016

56 Basic Outset boot process Unloads loginwindow Waits until Mac has a valid IP Processes everything in boot-once Deletes everything in boot-once Loads loginwindow Processes everything in boot-every 56 PSUMacAdmins 2016

57 Basic Outset login process Processes everything in login-once Logs login-once items to run-once plist Processes everything in login-every 57 PSUMacAdmins 2016

58 OnDemand Outset com.github.outset.on-demand.plist <dict> <key>label</key> <string>com.github.outset.on-demand</string> <key>programarguments</key> <array> <string>/usr/local/outset/outset</string> <string>--on-demand</string> </array> <key>keepalive</key> <dict> <key>pathstate</key> <dict> <key>/private/tmp/.com.github.outset.ondemand.launchd</key> <true/> </dict> </dict> <key>ondemand</key> <true/> </dict> 58 PSUMacAdmins 2016

59 OnDemand Outset postinstall #!/bin/bash [[ $3!= "/" ]] && exit 0 /usr/bin/touch /private/tmp/.com.github.outset.ondemand.launchd exit 0 59 PSUMacAdmins 2016

60 Advanced Outset Ignored users Network timeout Profiles 60 PSUMacAdmins 2016

61 /usr/local/outset/share/com.chilcote.outset.plist <dict> <key>ignored_users</key> <array> <string>luser</string> <string>ginger</string> <string>fred</string> </array> <key>network_timeout</key> <integer>180</integer> <key>wait_for_network</key> <true/> </dict> 61 PSUMacAdmins 2016

62 Scoping profiles 10 $./dock_profiler.py -h usage: dock_profiler.py [-h] -p PROFILE -n NAME [-i IDENTIFIER] [-o OUTPUT] [--once] [-s IDENTITY] [-v VERSION] Creates a package for Outset that will install a profile for a specific user on login. 10 Outset Dock Profiler [github] 62 PSUMacAdmins 2016

63 demo stupid outset tricks 63 PSUMacAdmins 2016

64 feedback => 64 PSUMacAdmins 2016

Getting Started with launchd for Sys Admins. Penn State MacAdmins Conference 2012

Getting Started with launchd for Sys Admins Penn State MacAdmins Conference 2012 whoami Matt Hansen Systems Administrator Penn State College of Education @hansen_m history Released with 10.4 Tiger (2005)