{"id":5201,"date":"2020-11-19T16:15:13","date_gmt":"2020-11-19T15:15:13","guid":{"rendered":"https:\/\/rakhesh.com\/?p=5201"},"modified":"2020-11-19T16:38:37","modified_gmt":"2020-11-19T15:38:37","slug":"macos-launchctl-commands","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/mac\/macos-launchctl-commands\/","title":{"rendered":"macOS launchctl commands"},"content":{"rendered":"<p>Creating this post so I can refer to it later when I want to do some <code>launchctl<\/code> related thing. This tool is used to control <code>launchd<\/code> which is the equivalent of <code>systemd<\/code> and other service managers on the macOS.<\/p>\n<h3>To view services<\/h3>\n<pre class=\"lang:ps decode:true \">sudo launchctl list<\/pre>\n<p>Important to specify <code>sudo<\/code> else you only get your own services. Notice the difference in output between these two:<\/p>\n<pre class=\"lang:ps decode:true \">$ sudo launchctl list | grep ssh\r\n-\t0\tcom.openssh.sshd\r\n\r\n$ launchctl list | grep ssh\r\n3521\t0\tcom.openssh.ssh-agent<\/pre>\n<h3>To view the details of a particular service<\/h3>\n<pre class=\"lang:ps decode:true \">$ sudo launchctl list com.openssh.sshd\r\n{\r\n\t\"Wait\" = false;\r\n\t\"Sockets\" = {\r\n\t\t\"Listeners\" = (\r\n\t\t\tfile-descriptor-object;\r\n\t\t\tfile-descriptor-object;\r\n\t\t);\r\n\t};\r\n\t\"LimitLoadToSessionType\" = \"System\";\r\n\t\"StandardErrorPath\" = \"\/dev\/null\";\r\n\t\"Label\" = \"com.openssh.sshd\";\r\n\t\"inetdCompatibility\" = true;\r\n\t\"OnDemand\" = true;\r\n\t\"LastExitStatus\" = 0;\r\n\t\"Program\" = \"\/usr\/libexec\/sshd-keygen-wrapper\";\r\n\t\"ProgramArguments\" = (\r\n\t\t\"\/usr\/sbin\/sshd\";\r\n\t\t\"-i\";\r\n\t);\r\n};<\/pre>\n<h3>Starting and stopping services<\/h3>\n<pre class=\"lang:ps decode:true\">sudo launchctl stop com.openssh.sshd\r\n\r\nsudo launchctl start com.openssh.sshd<\/pre>\n<p>You stop and start to restart.<\/p>\n<h3>Types of services<\/h3>\n<p>There&#8217;s two types of services as far as <code>launchd<\/code> is <a href=\"https:\/\/developer.apple.com\/library\/archive\/documentation\/MacOSX\/Conceptual\/BPSystemStartup\/Chapters\/CreatingLaunchdJobs.html\">concerned<\/a>.<\/p>\n<ul>\n<li>Agents are services run for the logged in user (the output of my <code>launchctl list<\/code> command above without a <code>sudo<\/code>). They obviously require someone to be logged in to run.\n<ul>\n<li>These are stored in <code>~\/Library\/LaunchAgents<\/code> (empty on my system) and <code>\/Library\/LaunchAgents<\/code> (on my system <code>ssh-agent<\/code> is the only one I recognize, but there&#8217;s a whole bunch more) and <code>\/System\/Library\/LaunchAgents<\/code> (on my system I have iStat Menu, Karabiner, Citrix WorkSpace, etc.).<\/li>\n<li>It would appear that <code>\/System\/Library\/LaunchAgents<\/code> have agents which have a GUI presence while <code>\/Library\/LaunchAgents<\/code> are GUI-less?<\/li>\n<\/ul>\n<\/li>\n<li>Daemons are services run by the system either as the root user or any other username specified in the service definition. They don&#8217;t require anyone to be logged in.\n<ul>\n<li>These are stored in <code>\/System\/Library\/LaunchDaemons<\/code> (the ones provided by Apple) and <code>\/Library\/LaunchDaemons<\/code> (the ones from 3rd parties; on my system I have Karabiner, iStat Menu, Docker &#8211; presumeably the user agents talk to these).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Service Definitions<\/h3>\n<p>Service Definitions are stored as <code>.plist<\/code> files in the above directories. There doesn&#8217;t seem to be easy way of finding the <code>.plist<\/code> file of a service. The closest I could find was do a <code>launchctl dumpstate<\/code> and grep for the service name.<\/p>\n<pre class=\"lang:ps range:5 decode:true\">sudo launchctl dumpstate | grep ssh\r\n\t\t       0      - \tcom.openssh.sshd\r\n\t\"com.openssh.sshd\" =&gt; false\r\ncom.openssh.sshd = {\r\n\tpath = \/System\/Library\/LaunchDaemons\/ssh.plist\r\n\tprogram = \/usr\/libexec\/sshd-keygen-wrapper\r\n\t\t\/usr\/sbin\/sshd\r\n\t\tXPC_SERVICE_NAME =&gt; com.openssh.sshd\r\n\t\t\tservice = com.openssh.sshd\r\n\t\t\t\t\t0 = \"ssh\"\r\n\t\t\t\t\t1 = \"sftp-ssh\"\r\n\t\t\t\t\"SockServiceName\" =&gt; \"ssh\"\r\n\t\t\tservice name = ssh\r\n\t\t    3521      - \tcom.openssh.ssh-agent\r\ncom.openssh.ssh-agent = {\r\n\tpath = \/System\/Library\/LaunchAgents\/com.openssh.ssh-agent.plist\r\n\tprogram = \/usr\/bin\/ssh-agent\r\n\t\t\/usr\/bin\/ssh-agent\r\n\t\tXPC_SERVICE_NAME =&gt; com.openssh.ssh-agent<\/pre>\n<p>That is a bit of a hit and miss I suppose.<\/p>\n<p>A better way is to use the <code>print<\/code> subcommand:<\/p>\n<pre class=\"lang:ps decode:true\">sudo launchctl print system\/com.openssh.sshd<\/pre>\n<p>The argument to be this has to be <code>system<\/code> or <code>user<\/code> (depending on whether it&#8217;s a system service or user service) followed by the service name, with a <code>\/<\/code> in between.<\/p>\n<p>Thus for the SSH agent, the above command would be:<\/p>\n<pre class=\"lang:ps decode:true \">sudo launchctl print user\/com.openssh.ssh-agent<\/pre>\n<h3>Loading (Installing), Unloading (Uninstalling), Enabling, Disabling services<\/h3>\n<p>It&#8217;s obvious what they do. I hadn&#8217;t realized you need to load\/ install and enable separately. Thought it would be just one step.<\/p>\n<p>Loading &amp; Uninstalling require the path to the <code>.plist<\/code> file. The other two require the service to be called with a <code>system\/<\/code> or <code>user\/<\/code> prefix as above.<\/p>\n<pre class=\"lang:sh decode:true\"># load\r\nsudo launchctl load \/System\/Library\/LaunchDaemons\/ssh.plist\r\n\r\n# enable\r\nsudo launchctl enable system\/com.openssh.sshd\r\n\r\n# disable\r\nsudo launchctl disable system\/com.openssh.sshd \r\n\r\n# unload\r\nsudo launchctl unload \/System\/Library\/LaunchDaemons\/ssh.plist<\/pre>\n<p>You can also install\/ load a service and give it a kick to start (maybe you installed and the service is set to disabled so you&#8217;d like to do a one-time start):<\/p>\n<pre class=\"lang:ps decode:true\">launchctl kickstart system\/com.openssh.sshd<\/pre>\n<p>The <code>kickstart<\/code> subcommand can take <code>-p<\/code> as a switch to print the PID or <code>-k<\/code> to kill any currently running instance before starting the new one.<\/p>\n<p>If you want to reload a service after its <code>.plist<\/code> file is changed you have to <code>unload<\/code> and <code>load<\/code> it. Simply enabling\/ disabling or starting\/ stopping won&#8217;t help. (It&#8217;s like <code>systemctl daemon-reload<\/code>).<\/p>\n<h3>Disabled Services<\/h3>\n<p>You can find disabled services with the <code>print-disabled<\/code> subcommand. This requires you to specify <code>system<\/code> to show the status for system services; or <code>user\/&lt;uid&gt;<\/code> for the UID (User ID) in question (there&#8217;s other options too but I am going to skip that for now, check <a href=\"https:\/\/ss64.com\/osx\/launchctl.html\">launchctl(1)<\/a>).<\/p>\n<p>Examples:<\/p>\n<pre class=\"lang:sh decode:true\">$ sudo launchctl print-disabled system\r\ndisabled services = {\r\n\t\"org.pqrs.karabiner.karabiner_grabber\" =&gt; false\r\n\t\"com.apple.CSCSupportd\" =&gt; true\r\n\t\"com.apple.ftpd\" =&gt; true\r\n        \"com.openssh.sshd\" =&gt; false\r\n}<\/pre>\n<p>Here Karabiner is not disabled as its value is <code>false<\/code>. The others are actually disabled. Bit confusing, eh?<\/p>\n<p>Another one:<\/p>\n<pre class=\"lang:sh decode:true \"># find my UID\r\n$ id -u\r\n501\r\n\r\n$ $ sudo launchctl print-disabled user\/501\r\ndisabled services = {\r\n\t\"com.docker.helper\" =&gt; false\r\n\t\"com.bjango.istatmenus.agent\" =&gt; false\r\n\t\"com.pointum.hazeover.launcher\" =&gt; false\r\n\t\"com.apple.Siri.agent\" =&gt; true\r\n\t\"com.citrix.ReceiverHelper\" =&gt; false\r\n\t\"org.pqrs.karabiner.agent.karabiner_grabber\" =&gt; false\r\n\t\"io.tailscale.ipn.macos.login-item-helper\" =&gt; false\r\n\t\"com.apple.FolderActionsDispatcher\" =&gt; true\r\n\t\"org.pqrs.karabiner.agent.karabiner_observer\" =&gt; false\r\n}\r\nlogin item associations = {\r\n\t\"com.pointum.hazeover.launcher\" =&gt; \"com.pointum.hazeover\"\r\n\t\"version.com.docker.helper\" =&gt; \"48173\"\r\n\t\"com.docker.helper\" =&gt; \"com.docker.docker\"\r\n\t\"version.io.tailscale.ipn.macos.login-item-helper\" =&gt; \"101.0.5\"\r\n\t\"com.robinlu.Tooth-Fairy-Helper\" =&gt; \"com.robinlu.mac.Tooth-Fairy\"\r\n\t\"version.com.robinlu.Tooth-Fairy-Helper\" =&gt; \"56\"\r\n\t\"io.tailscale.ipn.macos.login-item-helper\" =&gt; \"io.tailscale.ipn.macos\"\r\n\t\"version.com.pointum.hazeover.launcher\" =&gt; \"980\"\r\n}<\/pre>\n<p>That gives login associations too. Not sure what that is.<\/p>\n<p>An interesting aside on disabled services. Here&#8217;s what my SSH <code>.plist<\/code> has:<\/p>\n<pre class=\"lang:xhtml range:5,6 decode:true\">&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;\r\n&lt;!DOCTYPE plist PUBLIC \"-\/\/Apple\/\/DTD PLIST 1.0\/\/EN\" \"http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd\"&gt;\r\n&lt;plist version=\"1.0\"&gt;\r\n&lt;dict&gt;\r\n\t&lt;key&gt;Disabled&lt;\/key&gt;\r\n\t&lt;true\/&gt;\r\n\t&lt;key&gt;Label&lt;\/key&gt;\r\n\t&lt;string&gt;com.openssh.sshd&lt;\/string&gt;\r\n...\r\n&lt;\/dict&gt;\r\n&lt;\/plist&gt;<\/pre>\n<p>Whoa, it&#8217;s disabled? But it&#8217;s not, coz I can access SSH.<\/p>\n<p>Turns out this is ignored? From the manpage, under the <code>load<\/code> section we have the following:<\/p>\n<pre class=\"lang:ps decode:true\">-w       Overrides the Disabled key and sets it to false or true for the load and unload subcommands respectively. In previous versions, this option would modify the configuration file. Now the state of the Disabled key is stored elsewhere on- disk in a location that may not be directly manipulated by any process other than launchd.\r\n\r\n-F       Force the loading or unloading of the plist. Ignore the Disabled key.<\/pre>\n<p>Hmm, so 1) you&#8217;d do <code>load -w<\/code> to load\/ install a <code>.plist<\/code> file and have it not be disabled even though the file might say so, and 2) <em>more importantly<\/em> the <code>Disabled<\/code> key in the <code>.plist<\/code> file is irrelevant as the actual state is stored in some other place. Weird.<\/p>\n<p>Basically, stick with the <code>print-disabled<\/code> sub-command rather than the <code>.plist<\/code> file.<\/p>\n<h3>Elsewhere<\/h3>\n<p>For when this blog post isn&#8217;t enough for me:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.launchd.info\/\">https:\/\/www.launchd.info\/<\/a><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Creating this post so I can refer to it later when I want to do some launchctl related thing. This tool is used to control launchd which is the equivalent of systemd and other service managers on the macOS. To view services sudo launchctl list Important to specify sudo else you only get your own &hellip; <a href=\"https:\/\/rakhesh.com\/mac\/macos-launchctl-commands\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">macOS launchctl commands<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[853],"tags":[957,891,391],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5201"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=5201"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/5201\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=5201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=5201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=5201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}