FileVault and Launch Services

Does someone know if there's a fix in 10.5.3? This problem drives me nuts.

I can confirm that the automator script provided earlier in this thread is an effective work around to the default preferences issue.

I'll also add that after a 2 year absence I just began using filevault on a new computer. Filevault had killed my disk on a previous powerbook in 2006. When I replaced my laptop in late 2006, I chose not to use filevault due to its many flaws. I can confirm that one of those flaws, which I experienced on that old machine, was this very issue of default settings being restored. I filed a ticket for this issue in 2005 and now nearly 3 years later the issue still exists, so I suspect those of us who want to use filevault will just have to live with its imperfections as clearly Apple does not consider it an important issue.

*dig up*

Seems to be fixed in 10.5.3. Can someone confirm this?

No. For me it is not fixed in 10.5.3.

NO NOT FIXED IN 10.5.3!

Why can't Apple fix this bug???

Same problem here, also under 10.5.3. Logged a bug report per gordon142's suggestion.

I still have this issue on 10.5.3.

Problem still seems to be persisting in 10.5.4

Hi all! I had the same problem on my MBP running Mac OS X 10.5.4 with FileVault being activated. Using the "Reset LaunchServices" function of Maintenance 1.2.1 seems to have solved the problem. I have performed 5 reboots so far - and Firefox is still my default browser.

Can you please trz and confirm, whether this really is a fix?

Thanks!

Hi.

I can't check right now, because my MacBookAir will be repaired in the next two weeks because of processor core shutdowns. (yes, a simple logic board exchange takes two weeks in Germany. Thx. Apple!)

Anyway: When I tried to show this phenomenon to an Apple genius in the Apple store in Tokyo a normal reboot didn't do the trick.

Only after I duplicated a 500MB file and deleted it and rebooted the machine OSX had forgotten (had stopped reading) the proper launch services.

I don't know if that makes any sense, but try to delete something and do a reboot if you have the time.

Thank you.

Hey mar.b!

I have deleted a big folder on the volume and rebooted without loosing my LaunchService settings. Firefox is still my default browser.

Btw, what are you doing in Tokyo - I go there quite often myself...

Regards

Hello.

I tried maintenance today and it did NOT work.

The reset of the LaunchServices is the same as in Onyx and that was one of the first things I tried when this problem came up (with 10.4?)

After another reboot OSX had forgotten once again that I e.g. want a movie file being opened with mplayer and not Quicktime.

Testmachine: As I mentioned before my MacBook Air is being repaired right now, so I activated File Vault on a MacBook, System 10.5.4.

@Tetsu: I had a job to do in Japan for the last three month. Food and weather is great, but it's also nice to be back in Germany... 😉 Might go to the States in two weeks though.

Cheers
mar.b

I’ve been fighting the same problem and have to say the hint provided here about resetting the launch services, and letting launchd do this at login (via Lingon) is invaluable. Thanks a lot for that, it makes FileVault far more usable!

After using this for a while, I have however discovered a side effect of resetting the launch services that is rather annoying – but I have also found a solution for it.

*The problem* is that after resetting the launch services, calling a protocol handler registered by a user installed application is considered a first time call again, meaning it needs to be confirmed by the user (unless the app has been started directly before the call). Examples I stumbled upon are: bookmarking through the Pukka bookmarklet, opening an Evernote note from a Spotlight search, calling a man page in Safari through Bwana – others abound, as most apps seem to install some kind of protocol handler nowadays.

*The solution* to this is to change the file ownership of the app bundles in question to root – which is the default for Apple’s own apps anyway (including those not part of the OS, like iLife, iWorks) – as app bundles owned by root seem not to be subject to first launch protocol handler confirmation.

+sudo find /Applications -iname "*.app" \! -user root -prune -exec chown -R root \\{} \;+

will do the trick. I’d also recommend setting group ownership to admin instead of staff, and setting permissions for the group to rwx, to facilitate app management after the ownership change (again, these are the Apple defaults, as +ls -le+ will tell you):

+sudo find /Applications -iname "*.app" -group staff -prune -exec chown -R :admin \\{} \;+
+sudo find /Applications -iname "*.app" \! -perm g=rwx -prune -exec chmod -R g=rwx \\{} \;+

will do that for you (don’t use +find \! -group admin+, as some apps, notably System Preferences, are set to the wheel group). Reset launch services after that and you are good to go. You will need to provide an administrator password to manipulate all app bundles in the /Applications directory henceforth, but I find it a matter of discussion if this can be qualified as an annoyance, or rather as a security improvement 🙂.

This being said, two other very minor remarks are:

1.) the syntax for lsregister has changed along with its location under Leopard (though the syntax given above seems to be only deprecated, not unsupported). A full reset is now executed with the command +lsregister -kill -r -all system,local,user+ it seems.

2.) redirecting the output of a command to /dev/null in a launchd agent is listed as a thing not to do by the launchd.plist man page, unless I’m mistaken.

These minor quibbles do not detract in any way from the merit of having figured out the reset would do the trick. Again, kudos for that!

Well, just for the heck of it, I tweaked and twisted my solution (learning an awful lot I never wanted to know about shell scripting in the process – I still hate it, but I’m in love with find) a bit more until I came out with the following:

1. A small GUI app (merely a Platypus wrapper around a shell script), which I call the +FileVault Normaliser+ as it will normalise the permissions of app bundles as I delineated before (root:admin / root:wheel, rwxrwxr-x), either of all bundles in your apps directory, or of the app bundle it gets passed as a parameter (sorry, only the first one at this point, right now I can’t be bothered with shell parameter cycling), reset Launch Services and install a launchd agent that will reset them on every logon henceforth.

2. A pkg installer that will not only get the above app onto your system, but also install a launchd daemon that will execute the normalising command (a rather convoluted find one liner) at boot, and then every hour after that.

Drop me a line at myfirstname.mylastname@googlemail.com if you’d like to give it a whirl. Cheers.

PS: If you really need to know, run this as root (via sudo or in a root context):
+find /Applications -type d -name "*.app" -prune \( -not -user root -exec chown -R root \{} \; \) -or \( -group staff -exec chown -R :admin \{} \; \) -or \( -not -perm ug=rwx,o=rx -exec chmod -R ug=rwx,o=rx \{} \; \)+

Bugger this, I tripped over my own smarty-pantness. The find statement I used above will only process the first -or clause it finds, meaning you will need three passes to fully normalise a file whose owner, group and permissions are all off. The way to go, of course, to get the thing into a one liner for launchd is the ";" concatenator, i.e.:

+find /Applications -type d -name "\*.app" -prune -not -user root -exec chown -R root \\{} \; ; find /Applications -type d -name "\*.app" -prune -group staff -exec chown -R :admin\\{} \; ; find /Applications -type d -name "*.app" -prune -not -perm ug=rwx,o=rx -exec chmod -R ug=rwx,o=rx \\{} \;+

which takes somewhat longer (as it executes three find passes, something I originally tried to avoid), but will solve the problems in one go.

I have updated the FileVault Normaliser package to reflect this, and while I was at it, I also improved the GUI script to handle multiple parameters (shift and for, here we come) and to replace the Launch Services reset agent when it is older than the version bundled in the GUI (before, it would not install over an older version). Contact me at myfirstname.mylastname@googlemail.com for a 1.1 version (I’ll send one unsolicited to anybody who has already got one; lucky me that’s a very select clientele, as this is not exactly a state of the art file distribution procedure 🙂 ).