Slide 25
Slide 25 text
Requirements to adding
Daemon via SMJobBless()
1. The calling application and target executable tool must both be signed.
2. The calling application's Info.plist must include a "SMPrivilegedExecutables" dictionary of strings.
Each string is a textual representation of a code signing requirement used to determine whether the
application owns the privileged tool once installed (i.e. in order for subsequent versions to update the
installed version). See example on next slide.
3. The helper tool must have an embedded Info.plist containing an "SMAuthorizedClients" array of
strings. Each string is a textual representation of a code signing requirement describing a client which
is allowed to add and remove the tool. How to embed: see futher.
4. The helper tool must have an embedded launchd plist. The only required key in this plist is the
Label key. When the launchd plist is extracted and written to disk, the key for ProgramArguments will
be set to an array of 1 element pointing to a standard location. You cannot specify your own program
arguments, so do not rely on custom command line arguments being passed to your tool. Pass any
parameters via IPC.
5. The helper tool must reside in the Contents/Library/LaunchServices directory inside the
application bundle, and its name must be its launchd job label. So if your launchd job label is
"com.apple.Mail.helper", this must be the name of the tool in your application bundle.
Details: https://developer.apple.com/documentation/servicemanagement/1431078-smjobbless