{
	"id": "5ea3f8c2-e9af-4075-9650-d8ba7909aa46",
	"created_at": "2026-04-06T00:12:53.257427Z",
	"updated_at": "2026-04-10T03:21:08.837248Z",
	"deleted_at": null,
	"sha1_hash": "1cd2ed8c9af0bb46cb6b9a1ae5f68432eb3cbe22",
	"title": "Startup Items",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 120468,
	"plain_text": "Startup Items\r\nPublished: 2016-09-13 · Archived: 2026-04-05 20:36:39 UTC\r\nA startup item is a specialized bundle whose code is executed during the final phase of the boot process, and at other\r\npredetermined times (see Managing Startup Items). The startup item typically contains a shell script or other executable file\r\nalong with configuration information used by the system to determine the execution order for all startup items.\r\nThe /System/Library/StartupItems directory is reserved for startup items that ship with OS X. All other startup items\r\nshould be placed in the /Library/StartupItems directory. Note that this directory does not exist by default and may need\r\nto be created during installation of the startup item.\r\nAnatomy of a Startup Item\r\nUnlike many other bundled structures, a startup item does not appear as an opaque file in the Finder. A startup item is a\r\ndirectory whose executable and configuration property list reside in the top-level directory. The name of the startup item\r\nexecutable must match the name of the startup item itself. The name of the configuration property list is always\r\nStartupParameters.plist . Depending on your needs, you may also include other files in your startup item bundle\r\ndirectory.\r\nMyStartupItem/\r\n |\r\n |- MyStartupItem\r\n \\- StartupParameters.plist\r\nTo create your startup item:\r\n1. Create the startup item directory. The directory name should correspond to the behavior you’re providing.\r\nExample: MyDBServer\r\n2. Add your executable to the directory. The name of your executable should be exactly the same as the directory name.\r\nFor more information, see Creating the Startup Item Executable.\r\n3. Create a property list with the name StartupParameters.plist and add it to the directory. For information on the\r\nkeys to include in this property list, see Specifying the Startup Item Properties .\r\nExample: MyDBServer/StartupParameters.plist\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 1 of 11\n\n4. Create an installer to place your startup item in the /Library/StartupItems directory of the target system. (Your\r\ninstaller may need to create this directory first.)\r\nYour installer script should set the permissions of the startup item directory to prevent non-root users from modifying\r\nthe startup item or its contents. For more information, see Startup Item Permissions.\r\nCreating the Startup Item Executable\r\nThe startup item executable can be a binary executable file or an executable shell script. Shell scripts are more commonly\r\nused because they are easier to create and modify.\r\nIf you are implementing your startup item executable as a shell script, OS X provides some code to simplify the process of\r\ncreating your script. The file /etc/rc.common defines routines for processing command-line arguments and for gathering\r\nsystem settings. In your shell script, source the rc.common file and call the RunService routine, passing it the first\r\ncommand-line argument, as shown in the following example:\r\n#!/bin/sh\r\n. /etc/rc.common\r\n \r\n# The start subroutine\r\nStartService() {\r\n # Insert your start command below. For example:\r\n mydaemon -e -i -e -i -o\r\n # End example.\r\n}\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 2 of 11\n\n# The stop subroutine\r\nStopService() {\r\n # Insert your stop command(s) below. For example:\r\n killall -TERM mydaemon\r\n sleep 10\r\n killall -9 mydaemon\r\n # End example.\r\n}\r\n \r\n# The restart subroutine\r\nRestartService() {\r\n # Insert your start command below. For example:\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 3 of 11\n\nkillall -HUP mydaemon\r\n # End example.\r\n}\r\n \r\nRunService \"$1\"\r\nThe RunService routine looks for StartService , StopService , and RestartService functions in your shell script and\r\ncalls them to start, stop, or restart your services as needed. You must provide implementations for all three routines, although\r\nthe implementations can be empty for routines whose commands your service does not support.\r\nIf your startup-item executable contains code that might take a long time to finish, consider spawning off a background\r\nprocess to run that code. Performing lengthy startup tasks directly from your scripts delays system startup. Your startup item\r\nscript should execute as quickly as possible and then exit.\r\nFor more information about writing shell scripts, see Shell Scripting Primer.\r\nSpecifying the Startup Item Properties\r\nThe configuration property list of a startup item provides descriptive information about the startup item, lists the services it\r\nprovides, and lists its dependencies on other services. OS X uses the service and dependency information to determine the\r\nlaunch order for startup items. This property list is stored in ASCII format (as opposed to XML) and can be created using the\r\nProperty List Editor application.\r\nTable A-1 lists the key-value pairs you can include in your startup item’s StartupParameters.plist file. Each of the listed\r\narrays contains string values. You can use the Property List Editor application that comes with the Xcode Tools to create this\r\nproperty list. When saving your property-list file, be sure to save it as an ASCII property-list file.\r\nTable A-1  StartupParameters.plist key-value pairs\r\nKey Type Value\r\nDescription String A short description of the startup item, used by administrative tools.\r\nProvides Array The names of the services provided by this startup item. Although a startup item can potentially\r\nprovide multiple services, it is recommended that you limit your startup items to only one\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 4 of 11\n\nservice each.\r\nRequires Array\r\nThe services provided by other startup items that must be running before this startup item can\r\nbe started. If the required services are not available, this startup item is not run.\r\nUses Array\r\nThe services provided by other startup items that should be started before this startup item, but\r\nwhich are not required. The startup item should be able to start without the availability of these\r\nservices.\r\nFor example, here is an old-style plist:\r\n{\r\n Description = \"Software Update service\";\r\n Provides = (\"SoftwareUpdateServer\");\r\n Requires = (\"Network\");\r\n Uses = (\"Network\");\r\n OrderPreference = \"Late\";\r\n Messages =\r\n {\r\n start = \"Starting Software Update service\";\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 5 of 11\n\nstop = \"Stopping Software Update service\";\r\n };\r\n}\r\nAnd here is an XML plist example:\r\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\r\n\u003c!DOCTYPE plist SYSTEM \"file://localhost/System/Library/DTDs/PropertyList.dtd\"\u003e\r\n\u003cplist version=\"0.9\"\u003e\r\n \u003cdict\u003e\r\n \u003ckey\u003eDescription\u003c/key\u003e\r\n \u003cstring\u003eApple Serial Terminal Support\u003c/string\u003e\r\n \u003ckey\u003eOrderPreference\u003c/key\u003e\r\n \u003cstring\u003eLate\u003c/string\u003e\r\n \u003ckey\u003eProvides\u003c/key\u003e\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 6 of 11\n\n\u003carray\u003e\r\n \u003cstring\u003eSerial Terminal Support\u003c/string\u003e\r\n \u003c/array\u003e\r\n \u003ckey\u003eUses\u003c/key\u003e\r\n \u003carray\u003e\r\n \u003cstring\u003eSystemLog\u003c/string\u003e\r\n \u003c/array\u003e\r\n \u003c/dict\u003e\r\n\u003c/plist\u003e\r\nThe service names you specify in the Requires and Uses arrays may not always correspond directly to the name of the\r\nstartup item that provides that service. The Provides property specifies the actual name of the service provided by a\r\nstartup item, and while this name usually matches the name of the startup item, it is not required to do so. For example, if the\r\nstartup item launches multiple services, only one of those services can have the same name as the startup item.\r\nIf two startup items provide a service with the same name, the system runs only the first startup item it finds with that name.\r\nThis is one of the reasons why your own startup items should launch only one service. If the name of only one of the\r\nservices matches the name of another service, the entire startup item might not be executed and neither service would be\r\nlaunched.\r\nThe values of the Requires and Uses keys do not guarantee a particular launch order.\r\nIn OS X v10.4 and later, most low-level services are started with launchd . By the time your startup item starts executing,\r\nlaunchd is running, and any attempt to access any of the services provided by a launchd daemon will result in that\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 7 of 11\n\ndaemon starting. Thus, you can safely assume (or at least pretend) that any of these services are running by the time your\r\nstartup item is called.\r\nFor this reason, with few exceptions, the Requires and Uses keys are largely irrelevant after OS X v10.3 except to\r\nsupport service dependencies between two or more third-party startup items.\r\nManaging Startup Items\r\nDuring the boot process, the system launches the available startup items, passing a start argument to the startup item\r\nexecutable. After the boot process, the system may run the startup item executable again, this time passing it a restart or\r\nstop argument. Your startup item executable should check the supplied argument and act accordingly to start, restart, or\r\nstop the corresponding services.\r\nIf you want to start, restart, or stop startup items from your own scripts, you can do so using the SystemStarter program.\r\nTo use SystemStarter , you must execute it with two parameters: the desired action and the name of the service provided\r\nby the startup item. For example, to restart the Apache Web server (prior to OS X v10.4), you would execute the following\r\ncommand:\r\n/sbin/SystemStarter restart \"Web Server\"\r\nStartup items should always respect the arguments passed in by SystemStarter . However, the response to those arguments\r\nis dependent on the startup item. The stop and restart options may not make sense in all cases. Your startup item could also\r\nsupport the restart option using the existing code for stopping and starting its service.\r\nDisplaying and Localizing a Startup Message\r\nWhen your startup item starts at boot time, you may (if desired) display a message to the user. To do this, use the\r\nConsoleMessage command. (You can use this command even if the computer is not starting up, but the user will not see it\r\nunless the Console application is running.)\r\nFor example:\r\nConsoleMessage \"MyDaemon is running. Better go catch it.\"\r\nIf you want to localize the message displayed when a startup item starts, you must create a series of property list files with\r\nlocalized versions of the strings. Each of these files must be named Localizable.strings , and must be in a localized\r\nproject directory whose name is based on the name of a language or locale code for the desired language. These folders, in\r\nturn, must be in a folder called Resources in the startup item folder.\r\nFor example, you might create a tree structure that looks like this:\r\nMyDaemon\r\n |\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 8 of 11\n\n|- MyDaemon\r\n |- StartupParameters.plist\r\n \\- Resources\r\n |\r\n |- English.lproj\r\n |- French.lproj\r\n |- German.lproj\r\n \\- zh_CN.lproj\r\nWithin each of these localizable strings files, you must include a dictionary whose keys map an English string to a string in\r\nanother language. For example, the French version of the PrintingServices localization file looks like this:\r\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\r\n\u003c!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e\r\n\u003cplist version=\"1.0\"\u003e\r\n \u003cdict\u003e\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 9 of 11\n\n\u003ckey\u003eStarting printing services\u003c/key\u003e\r\n \u003cstring\u003eDémarrage des services d’impression\u003c/string\u003e\r\n \u003c/dict\u003e\r\n\u003c/plist\u003e\r\nWhenever the ConsoleMessage command is passed the string “Starting printing services”, if the user’s language preference\r\nis French, the user will instead see “Démarrage des services d’impression” at startup. C’est très bien!\r\nThe value of the key field must precisely match the English string printed by your startup item using ConsoleMessage .\r\nSee the manual page for locale for more information about locale codes.\r\nStartup Item Permissions\r\nBecause startup items run with root authority, you must make sure your startup item directory permissions are set correctly.\r\nFor security reasons, your startup item directory should be owned by root, the group should be set to wheel, and the\r\npermissions for the directory should be 755 (rwxr-xr-x). This means that only the root user can modify the directory\r\ncontents; other users can examine the directory and view its contents, but cannot modify them. The files inside the directory\r\nshould have similar permissions and ownership. Thus, the file listing for the Apache startup item directory is as follows:\r\n./Apache:\r\ntotal 16\r\ndrwxr-xr-x 4 root wheel 136 Feb 14 14:33 .\r\ndrwxr-xr-x 21 root wheel 714 Feb 14 15:03 ..\r\n-rwxr-xr-x 1 root wheel 1253 Feb 10 19:31 Apache\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 10 of 11\n\n-rw-r--r-- 1 root wheel 152 Feb 10 19:31 StartupParameters.plist\r\nSource: https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nhttps://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html\r\nPage 11 of 11",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html"
	],
	"report_names": [
		"StartupItems.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434373,
	"ts_updated_at": 1775791268,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1cd2ed8c9af0bb46cb6b9a1ae5f68432eb3cbe22.pdf",
		"text": "https://archive.orkl.eu/1cd2ed8c9af0bb46cb6b9a1ae5f68432eb3cbe22.txt",
		"img": "https://archive.orkl.eu/1cd2ed8c9af0bb46cb6b9a1ae5f68432eb3cbe22.jpg"
	}
}