LoginHook frustration

[iSteve]

Good morning,

 

I'm trying to implement a LoginHook and LogoutHook on a 10.14 Mojave machine. I have created my login script, which works when I run it in Terminal, or send it as a UNIX command to the machine using Apple Remote Desktop as root. I have set defaults write com.apple.loginwindow LoginHook /path-to-my-script. I have made sure the script is executable. If I run defaults read com.apple.loginwindow LoginHook, the path to my script is returned. However, the script doesn't run at login.

 

The same goes for my LogoutHook script - I can run it manually, it's all 'there' but it doesn't run.

 

Is there anything I can check, or anything stupid that I am missing here? I'm now at the point where I can't see the wood for the trees!

 

TIA

[dhicks]

The same goes for my LogoutHook script - I can run it manually, it's all 'there' but it doesn't run.

 

What user does the script (try to) get run as on login? I'm guessing not root, in which case you'll need to make sure the script is executable by the specific user (or just make it executable by all users). Also,if the script isn't running from the shell then the environment won't be populated, so things like $HOME might not be set.

[iSteve]

Thanks - I will double check. I was under the impression that the Hooks run as root.

 

edit

 

The script is executable by all (chmod a+x), but is not running as root. Running manually it returns a 'permission denied' error when it tries to delete some folders.

Edited January 18, 2021 by iSteve

[dhicks]

The script is executable by all (chmod a+x), but is not running as root. Running manually it returns a 'permission denied' error when it tries to delete some folders.

 

Sorry, I'm not on a Mac at the moment, and it's been a while since I've dealt with Mac login scripts, but I seem to remember having to split functionality between the login script, which I think runs as some limited non-root user, and a deamon of some sort that runs as root and has access to do thing like remove folders. I seem to remember the login script having to trigger actions for the deamon to execute, which all got a little too complex for what was initially mean to be a quick login script.

 

Edit: found a previous post with a few more details of what I did:

 

http://www.edugeek.net/forums/mac/196741-macros-using-symbolic-links-redirect-home-folders-network-drive.html#post1681482

Edited January 18, 2021 by dhicks

[2ilent8cho]

Thanks - I will double check. I was under the impression that the Hooks run as root.

 

edit

 

The script is executable by all (chmod a+x), but is not running as root. Running manually it returns a 'permission denied' error when it tries to delete some folders.

 

Could it be SIP blocking it? I have to whitelist a lot of my scripts starting with 10.14 , 11.0 was blocking everything I did and had to start using https://github.com/jamf/PPPC-Utility to create profiles to allow my scripts to run. When running it manually do you get a popup in the GUI saying its trying to access a folder?

[iSteve]

If I run the script from Terminal, manually, the script gets to the delete part which needs elevated permissions and sits as a "Password:" prompt, so I think this is just needing to be sudo'd. I've edited my sudoers file to allow this script to be run with sudo, without needing a password but that seems to also be ignored.