0

Exploring a plist related with a flash pop-up when booting, I found this folders:

launchctl print gui/$(id -u)/com.apple.sharingd

...
    path = /System/Library/LaunchAgents/com.apple.sharingd.plist
    state = running

    program = /usr/libexec/sharingd
    inherited environment = {
        DISPLAY => /private/tmp/com.apple.launchd.NycH5eDM3b/org.xquartz:0
        SSH_AUTH_SOCK => /private/tmp/com.apple.launchd.9u8d0kZoxg/Listeners
    }
...
    properties = keepalive | runatload | supports transactions | system service | exponential throttling
...

This Listeners thing, happens to be a socket (I have no experience at all with sockets). So any attemp to explore it in a file fashion way, failed. How can I do some kind of basic/starting forensic to that socket. Meaning, grabbing it's meaningful dependencies or the things that had done in the system? I need just some kind of starting clue and I will do my best effort to continue by myself.

% cd /private/tmp/com.apple.launchd.9u8d0kZoxg/         
% ls
Listeners
% ls -lrt
total 0
srw-rw-rw-  1 myhost  wheel  0  2 abr 09:05 Listeners
% cat Listeners 
cat: ai_family not supported: Undefined error: 0
cat: Listeners: Invalid argument
% less Listeners 
Listeners is not a regular file (use -f to see it)
% less -f Listeners
Listeners: Operation not supported on socket
4
  • Welcome to the community. Does this work?: superuser.com/a/576404 Apr 3 at 6:01
  • Otherwise check out tools like AppScope from Cribl Apr 3 at 6:08
  • @SirMuffington In your post. Why is this step necessary and why is a mv and not a cp? sudo mv /var/run/docker.sock /var/run/docker.sock.original A "backup of the socket" shouldn't be a copy instead of a move? Where do I have to move the socket [any folder to tinker with it safely?]? Do I need to move it back to its place or by sockets nature never went out of its original folder, even with a move. I am a bit confused on that step. (I already obtained socat through brew install socat).
    – nostromo
    Apr 3 at 6:13
  • That was just an example... You can try using cp as well Apr 4 at 16:08

0

You must log in to answer this question.

Browse other questions tagged .