LaunchAgents and LaunchDaemons from default search paths.

Platform support

Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: launchd

  • Mac OSX

Table schema

Name Type Description
path TEXT Path to daemon or agent plist
name TEXT File name of plist (used by launchd)
label TEXT Daemon or agent service name
program TEXT Path to target program
run_at_load TEXT Should the program run on launch load
keep_alive TEXT Should the process be restarted if killed
on_demand TEXT Deprecated key, replaced by keep_alive
disabled TEXT Skip loading this daemon or agent on boot
username TEXT Run this daemon or agent as this username
groupname TEXT Run this daemon or agent as this group
stdout_path TEXT Pipe stdout to a target path
stderr_path TEXT Pipe stderr to a target path
start_interval TEXT Frecuency of running in seconds
program_arguments TEXT Command line arguments passed to program
watch_paths TEXT Key that launches daemon or agent if path is modified
queue_directories TEXT Similar to watch_paths but only with non-empty directories
inetd_compatibility TEXT Run this daemon or agent as it was launched from inetd
start_on_mount TEXT Run daemon or agent every time a filesystem is mounted
root_directory TEXT Key used to specify a directory to chroot to before launch
working_directory TEXT Key used to specify a directory to chdir to before launch
process_type TEXT Key describes the intended purpose of the job

Query examples

Select all the results for the given table.

SELECT * FROM launchd;