search

objective-see / KnockKnock

Enumerate persistently installed software
GNU General Public License v3.0
430 stars 32 forks source link

/Library/LaunchDaemons ignored #30

Open engineer-plus-plus opened 8 months ago

engineer-plus-plus commented 8 months ago

It appears that KnockKnock straight up ignores the things in ~/Library/LaunchDaemons, ~/Library/LauchAgents and the like. And that's the first place that gets poluted with startup items. Why doesn't KnockKnock report on stuff there?

objective-see commented 8 months ago

Can you provide more information? ...as this definitely should not be the case!

  1. The code here, in the shared item enumerator should take care of those directories:
NSString * const LAUNCHITEM_SEARCH_DIRECTORIES[] = {@"/System/Library/LaunchDaemons/", @"/Library/LaunchDaemons/", @"/System/Library/LaunchAgents/", @"/Library/LaunchAgents/", @"~/Library/LaunchAgents/"};
...

(Note, AFAIK, there is no ~/Library/LaunchDaemons ...as daemons run as root, and thus are found in /System/Library/LaunchDaemons or /Library/LaunchDaemons/)

  1. On macOS 13+ such items are also enumerated via the "Background Task Management" plugin.

If you are seeing specific items being missed please let me know, and I'll look into that ASAP :)