I would like to run a script as a particular user on startup (not on login). I thought a launchd LaunchDaemon would do it, but 'man launchd' says:
"If you wish your service to run as a certain user, in that user's environment, making it a launchd agent is the ONLY supported means of accomplishing this on Mac OS X. In other words, it is not sufficient to perform a setuid(2) to become a user in the truest sense on Mac OS X."
They aren't kidding--when I try to run my script as a LaunchDaemon it doesn't work. In particular I'm trying to automate some keychain operations using the 'security' command, and it won't let me change the default keychain when I run the script through LaunchDaemon, though the script works fine when run using sudo from a shell.
A LaunchAgent won't work, because the goal is for the proces to run without a user logging in and LaunchAgents only run when someone logs in. I looked at cron and the @reboot directive and that looks promising, but I read that cron is deprecated on OSX.
I had similar problems trying to make a long running process use a default keychain. Essentially LaunchAgent doesn't seem to run in a full login environment for doing the security commands so changing the default keychain doesn't work and comes back with a permissions error on the
/Library/Preferences/directory.The secret sauce is to add:
to your plist. This is a undocumented feature which will force a proper environment and will enable you to set the default keychain. Credit to joensson on this question for pointing me in the right direction.
Save as a global daemon (
/Library/LaunchDaemons) and specify the user with keyUserName:There are a number of other places where you can hide startup items in OS X (most of which are thoroughly unsupported). I'd try
/etc/rc.local; I seem to recall that working in Panther, so there's a possibility it might still work today.