Mysterious unmounts from launchd...

Questions and Answers about all things *OS (macOS, iOS, tvOS, watchOS)

Mysterious unmounts from launchd...

Postby LuigiVampa » Mon Jun 15, 2015 2:25 pm

Guys
I've got a launchd-initiated script which creates a RAM disk using hdiutil and mounts it to some path (does not seem to matter which one).
But for some mysterious reason, 10 seconds after that, something or someone mysteriously initiates an unmount request (I see the unmount request in system log...).
However if I manually mount the same thing after I logged on, all is fine.

Does anyone know which mysterious entity in OS X (10.9) automagically unmounts hdiutil-based image drives?
Could it be that there is some secret security mechanism which prevents image-based mounts prior to user login? If so, anyway to disable it?
Thanks!
LuigiVampa
 
Posts: 4
Joined: Mon Jun 15, 2015 2:20 pm

Re: Mysterious unmounts from launchd...

Postby morpheus » Tue Jun 16, 2015 6:59 pm

Not that I know of. I'd need more details here. Specifically, the args to hdiutil? If you can, attach the script and the plist here
morpheus
Site Admin
 
Posts: 532
Joined: Thu Apr 11, 2013 6:24 pm

Re: Mysterious unmounts from launchd...

Postby LuigiVampa » Wed Jun 17, 2015 2:07 pm

Hey
Thanks for the attention. I can't send the FULL script due to internal policies, but in general what we do is this:

script.sh:
RAMDISK_BSD_NAME=`hdiutil attach -nomount 'ram://804000'`
newfs_hfs -v "RAMDISK" ${RAMDISK_BSD_NAME}
mount -o nobrowse -t hfs ${RAMDISK_BSD_NAME} ${RAMDISK_PATH}

(the full scripts checks for various failure conditions but it does not seem to matter).

launchctl.plist runs this script.

By default, we mount the RAM disk on /System/RAMDISK, but even if we change /System to something less conspicuous (like /var/tmp/RAMDISK) we get the same behavior.

What we see is that no matter what RAMDISK_PATH is, it gets briefly mounted correctly but then, 10 seconds afterwards, we see the following (the BSD name we got was "/dev/disk1")
Jun 14 01:46:57 vampas-Mac.local loginwindow[92]: Login Window Started Security Agent
Jun 14 01:46:57 vampas-Mac kernel[0]: hfs: unmount initiated on RAMDISK on device disk1

Could it be that some security mechanism in OS X prevents images to be mounted before a user sessions begins? If so, is there a way we can control it?
Thanks again!
LuigiVampa
 
Posts: 4
Joined: Mon Jun 15, 2015 2:20 pm

Re: Mysterious unmounts from launchd...

Postby morpheus » Wed Jun 17, 2015 2:35 pm

It's not a security mechanism in OS X, per se, but rather in LoginWindow. It's a protected binary (with Apple's crude SG_PROTECTED_1) but one can clearly see it interfaces with the DiskArbitration framework, which controls the mounts/unmounts. The kernel message you got is from hfs_umount, but either LoginWindow or Security Agent were the ones to call that.

What you could do is run your mount in a LaunchAgent, rather than a Daemon, post user login.
morpheus
Site Admin
 
Posts: 532
Joined: Thu Apr 11, 2013 6:24 pm

Re: Mysterious unmounts from launchd...

Postby LuigiVampa » Wed Jun 17, 2015 4:00 pm

Thanks a lot!!
We need to have this mounted specifically before any user logs in, so we'll try to see if there is a way to disable this via some security policy.
If not, we'll figure something out.
Thanks again for the help!
LuigiVampa
 
Posts: 4
Joined: Mon Jun 15, 2015 2:20 pm


Return to Questions and Answers

Who is online

Users browsing this forum: No registered users and 2 guests