launchd - can it run a script when users log in OR switch?

Question

Level 1

59 points

launchd - can it run a script when users log in OR switch?

I'm hoping to find someone who knows all the gory details of launchd. Here's the why and what: I'm trying to coerce Aperture into letting two users on the same computer share the same Aperture Library, both able to import photos and see and use what the other has done. Initially it is no problem, change the permissions so everyone has read/write/execute, put the Library in a common area, and point both person's Aperture at it. The problem is that Aperture changes permissions of things inside the Library as you use it, and especially when one person imports, the other person can't see that stuff.

So I want to run a script whenever someone logs in or becomes the active user by fast user switching; the script will simply change ownership and permissions of the library and everything in it to restore full access.

After days of research and testing, I made a test launchd plist file (this is the configuration file or agent that launchd looks at and runs your script when criteria are met). It sits in /Library/LaunchAgents/, here it is:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>org.jim.test</string>
<key>LimitLoadToSessionType</key>
<string>LoginWindow</string>
<key>ProgramArguments</key>
<array>
<string>/Library/Scripts/testscript.sh</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StandardErrorPath</key>
<string>/Users/jim/Desktop/test.err</string>
<key>StandardOutPath</key>
<string>/Users/jim/Desktop/test.out</string>
</dict>
</plist>

The actual test script is sitting in /Library/Scripts/:

#!/bin/bash
echo "org.jim.test.plist was run at `date`"

So if the plist is loaded and the script run, the date and time are written in the test.out file on my desktop. This thing runs great when a user logs in. The problem is, it doesn't run when users switch by fast user switching. In reading the documentation, it was vague about this, whether that could be done; I thought it could.

Can anyone help with a way to get the script to run when any user takes control by any means? As an added complication, which I'll worry about later, the script has to run as root because it's the only way to get the ownership and permissions changed.
Thanks,
Jim

MacBook Pro early 2010, Mac OS X (10.6.5)

Posted on Dec 16, 2010 8:27 AM

Reply

Answer 1

Best reply

BobHarris

Level 9

53,267 points

Dec 16, 2010 8:54 AM in response to Dessicator

Have you thought about inheritance ACLs on the parent directories?


man chmod

That might allow you to avoid using launchd. Just a thought, as I have not worked out any of the details myself.

Reply

Answer 2

Dessicator Author

Level 1

59 points

Dec 16, 2010 9:12 AM in response to BobHarris

No, I haven't; never knew really what ACLs were. Now I see that they take precedence over regular permissions and as you say can be inherited, so it sounds promising. Gee, if it is this easy, there goes all my launchd fun!
Thanks very much, I'll reply back when I get a chance to explore that.
Jim

Reply

Answer 3

etresoft

Level 8

46,560 points

Dec 16, 2010 10:42 AM in response to Dessicator

Thanks for adding the "big picture" of what you are actually trying to accomplish.

I suggest two thing:
1) Repost your question in the Aperture forum
2) Look at some previous, similar questions such as this one: http://discussions.apple.com/message.jspa?messageID=7188577

Reply

Answer 4

Dessicator Author

Level 1

59 points

Dec 16, 2010 12:13 PM in response to etresoft

Thanks. The first thing I did was search through the Aperture discussions. The only solution I found there that may work is putting the library on an external drive, which is not a doable option for us with a laptop. Then there are workarounds like manually changing permissions each time, or establishing both users' default permissions such that any new files created can be read and written and executed by others, which don't seem like attractive options. I posted here because readers of this forum would be more likely to answer the immediate question I had about launchd.

I'm still chasing down the ACL idea, on the surface it seems like it should work because ACL entries override normal permissions. So Aperture can have its way with the standard unix permission, doesn't matter if we two both have the necessary ACL permissions. I'm having trouble really understanding what those 16 or so ACL permission really do and how they work.

Reply

Answer 5

rccharles

Level 6

12,957 points

Dec 16, 2010 12:33 PM in response to Dessicator

If the ACL thing doesn't pan out, you could try changing the permission after a file was added to a folder.

See these launchd options.

I haven't tried any of this...
from

man launchd.plist

WatchPaths <array of strings>
This optional key causes the job to be started if any one of the listed
paths are modified.

QueueDirectories <array of strings>
Much like the WatchPaths option, this key will watch the paths for modi-
fications. The difference being that the job will only be started if the
path is a directory and the directory is not empty.

Reply

Answer 6

etresoft

Level 8

46,560 points

Dec 16, 2010 1:25 PM in response to Dessicator

I briefly looked at creating a disk image for your Aperture data and sharing that between the users. That may allow you to bypass permissions. The thing I don't like about actually changing the permissions is that the OS or Aperture could "fix" it at some point, maybe only partially, and that could result in a corrupted archive. If you put the archive on an external drive that, by default, is set to ignore permissions, then you effectively sidestep the problem. It may be possible to simulate an external drive that is ignoring permissions by using a disk image.

Unfortunately, I didn't make enough progress before I got busy again. It is something that could be explored further.

Reply

Answer 7

Dessicator Author

Level 1

59 points

Dec 16, 2010 1:34 PM in response to rccharles

rccharles wrote:
If the ACL thing doesn't pan out, you could try changing the permission after a file was added to a folder.

Thanks. Yes, that did occur to me as I read about launchd and the plist files. But the Aperture Library has a gazillion files in it, with potentially thousands of file changes when you import photos, do batch edits, and reorganize photos, projects, albums, etc. I had visions of Aperture doing all those file operations and my little script being fired thousands of times separately as a result, each time checking/changing the ownership and permissions of every file in the library. To my limited computer intelligence, that seemed like a recipe for chaos, slower performance, and potential file corruption. So that is pretty low on my list of potential approaches at the moment.

Reply

Answer 8

Dessicator Author

Level 1

59 points

Dec 16, 2010 5:41 PM in response to BobHarris

BobHarris is the MAN. ACLs seem to have worked. I put the Aperture Library in /Users/Shared/ApertureLibrary, restored the regular permissions as best I could (me as owner, staff as group, 755), pointed each person's Aperture to the library, then proceeded with the ACL magic. First I created a group for my wife and I, called 'aperture', in the Accounts preference pane. That was to simplify the ACLs (one entry instead of 2) and so that other users (son) aren't able to muck it up.

It took one stinking Terminal command (note that 'aperture' at the beginning of the quote is the group, not the program, folder or library):
chmod -R +a "aperture allow list,add file,search,delete,add_subdirectory,delete_child,file_inherit,directoryinherit" ApertureLibrary.aplibrary

I was unsure whether this list of permissions was necessary or sufficient, but it seems to have worked so far. Both users can access the library. I imported a different picture by each user, and the other user could then see and delete the picture imported by the other. This was not possible before.

Bob, thanks for the great idea. After a little more testing I'll post a complete how-to in the latest "how do we share Aperture" thread, and give you due credit. The bad news is all the launchd fun is over 🙂
Jim

Reply

Answer 9

Dessicator Author

Level 1

59 points

Dec 16, 2010 5:50 PM in response to Dessicator

This forum seems a little dumb, or maybe I am, I replied to Bob's message, saying the question was answered, but there was no solved button there as on other replies so I can't give him credit. Sorry

Reply

Answer 10

Tony T1

Level 6

10,232 points

Dec 16, 2010 6:13 PM in response to Dessicator

I think that's because you gave him a 'helpful'.
Now, if Bob agrees with me, then you can give him a 'solved' on that message 😉

Reply

Answer 11

BobHarris

Level 9

53,267 points

Dec 16, 2010 7:33 PM in response to Dessicator

This forum seems a little dumb, or maybe I am, I replied to Bob's message, saying the question was answered, but there was no solved button there as on other replies so I can't give him credit. Sorry

Hearing that you have a satisfactory solution is the real reward. "Helpful" or "Solved" stars are just icing on the cake (and as it is, they had a cake at work today, so I'm good for icing at the moment 🙂 ).

Reply