Privoxy / Support Requests / #1599 Privoxy won't run or install on Mac OSX 10.9

Fabian Keil - 2013-11-06

Is it likely that Apple considers the account removal a bug and fixes it soonish, or do we need a FAQ entry for this?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ian Silvester - 2013-11-06

I'm quite sure Apple would consider this a feature not a bug ;o)

I'd imagine, given their core market, that removal of any non-OS,
non-interactive user accounts would typical of Apple's ham-fisted
approach to security.

All this to say that a FAQ entry is a very good idea.

Ian

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Dutchwood - 2013-11-15

It's not Gatekeeper. It's Mavericks as a whole.
I tried reinstalling with the advice mentioned, no success.
Had to go back to my method of my altered LD file to get it to work again.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Cbg - 2013-11-15

Hi Lan,

1) As you wrote me on November the 6th: I have set GK ( Gatekeeper ) to everything.
as in this link described, that you have provided: http://i1.wp.com/imagecdn5.maketecheasier.com/2013/10/mavericks-allow-apps-from-anywhere.png

2) What is the final conclusion now? I didn't get it somehow? Is there a resolution for this issue now ?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ian Silvester - 2013-11-16

Hi Cannonballgray,

The resolution that has worked for all so far (apart from Dutchwood) is as follows:

- uninstall Privoxy using the uninstall.command script in /Applications/Privoxy. You will need to run it using an administrator account. You can retain your configuration files when prompted by the script if you desire.
- reinstall Privoxy from scratch using the installation package downloaded from Sourceforge.

Cheers,

Ian

P.S. my name is ian with an i as in 'indicator', not lan with an l as in 'long' ;o)

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

cjpragman - 2014-02-27

Any updates on this? It is still occurring. On about every other system reboot, privoxy fails to load (now occurring on 10.9.2 as well). Same messages in the system.log as before.
2/25/14 7:21:20.823 PM com.apple.launchd[1]: (org.ijbswa.privoxy[73]) getpwnam("_privoxy") failed
2/25/14 7:21:20.823 PM com.apple.launchd[1]: (org.ijbswa.privoxy[73]) Exited with code: 3

Manually unloading and reloading using launchctl commands yields success. It is only automatic start on reboot that seems to fail, and even then it doesn't fail every time.

Could it be some sort of dependancy that privoxy needs to have loaded before it, that isn't specified in the launchd .plist file?

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ian Silvester - 2014-02-27

Hi cjpragman,

I suppose a dependency issue is possible, but I don't know on what nor how to find out; if you've ideas on how to investigate this I'm all ears. My main problem is how to map the error output of 3 to a particular constant of errno - nothing I can find on the 'net gives an explicit mapping so I just don't know what error 3 actually means.

The accepted workaround is to modify privoxy's launchitem plist, removing the UserName key entirely and instead passing the user as a commandline parameter, obviating the need for launchd to check the user at all. Please see Dutchwood's earlier post on this thread with details of the adjustments to make to the plist.

Cheers,

Ian

Last edit: Ian Silvester 2014-02-27

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

cjpragman - 2014-02-28

I changed the launched plist file as Dutchwood explained, and so far it has worked properly after one reboot. Fingers crossed that it will keep working. Will the installer get updated to include this work-around?

http://sourceforge.net/p/ijbswa/support-requests/1599/?limit=10&page=3#077d

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ian Silvester - 2014-02-28

I'm not sure that I want to include this workaround since it is not especially 'clean' and it is Mavericks that is at fault not Privoxy. If the underlying cause is found and has a better fix before the next release goes out (we've no release on the cards at present) then I won't include the workaround; if the cause remains a mystery then I'll decide at the time how best to approach it.

Do keep us updated on whether the workaround proves 100% reliable.

Cheers,

Ian

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Lynn Clark - 2014-03-12

I just upgraded from Snow Leopard 10.6.8 to Mavericks 10.9.2. Nothing in this thread, including Dutchwood's LaunchDaemons plist modifications enables privoxy to survive a reboot. So this appears to be a problem that is still in need of a solution.

On an early 2009 Macbook Pro (which probably doesn't make any difference).

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

cjpragman - 2014-03-12

@Lynn Clark,
Did you uninstall & reinstall privoxy? That seems to be an important step.
Changing the launchd plist file per Dutchwood also seems to be important.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Lynn Clark - 2014-03-13
  
  Yes, I did uninstall and reinstall, plus Dutchwood's launchd plist changes. Privoxy works fine until I restart the computer. Then it doesn't work. After a restart, the only way I can get internet access is to disable the http/https proxies in the Network preferences and/or uninstall privoxy (but you still have to disable the http/https proxy settings in Network preferences). Privoxy 3.0.21 on OS X 10.9.2.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
  - cjpragman - 2014-03-13
    
    What about the logs?
    If launched fails to load the privoxy.plist, there will be a message about it in the system.log. What do those messages say?
    Have you tried manually unloading and reloading the launched plist, as follows? See what's written to the system log when you try.
    
    $ sudo launchctl unload /Library/LaunchDaemons/org.ijbswa.privoxy.plist
    $ sudo launchctl load /Library/LaunchDaemons/org.ijbswa.privoxy.plist
    
    If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
    - Lynn Clark - 2014-03-13
      
      After a reboot, the following two lines are at the end of the system.log file:
      
      Mar 13 16:38:37 localhost com.apple.launchd[1] (org.ijbswa.privoxy[62]): getgrnam("_privoxy") failed
      Mar 13 16:38:37 localhost com.apple.launchd[1] (org.ijbswa.privoxy[62]): Exited with code: 3
      
      Running 'ps -ef | grep privoxy' verifies that privoxy is not running (no privoxy lines in the ps output, except for the grep line)
      
      Running the two "sudo launchctl unload/load ..." commands gets privoxy running again.
      
      This is with Dutchwood's modifications to the org.ijbswa.privoxy.plist file (add --user _privoxy" to the program arguments, and remove the UserName key/value pair.
      
      I spent many, many years in Unix-land (Solaris and many flavors of Linux), but the BSD Unix underneath OS X is somewhat opaque to me. I'm starting to wonder if there's some kind of time dependency on when things happen during the startup process on OS X. Maybe (sometimes?) privoxy tries to startup before the _privoxy user account is visible? Is there a way to delay the LaunchDaemon plist running? Does privoxy need to run as the _privoxy user? Could it run as a "normal" user, i.e. yourself? I don't know the answers to these questions. Just thinking out loud.
      
      If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
      - Ian Silvester - 2014-03-14
        
        Thanks for the detailed troubleshooting info Lynn,
        
        What's curious about your situation (and the reason why Dutchwood's
        modification did not work) is that in your case it is the _privoxy group
        that is not being found rather than the _privoxy user (in prior cases it
        was the function getpwnam("_privoxy") that failed). Consequently it would
        seem that you should add --user _privoxy._privoxy to specify both the user
        and group on the command line and remove the references to user and group
        in the plist.
        
        cjpragman also hypothesised that there may be a race hazard in the launchd
        loading process on Mavericks (I'd not be surprised - the code quality of
        OS X has been in decline ever since roughly Tiger, when the cream of the
        dev team were stolen to go develop iOS). I have no idea about whether
        launchd validates all the plists presented to it at startup prior to
        actually executing them, but if it's first look at the plist is at
        execution time it would seem unlikely to be a simple race hazard, since of
        course privoxy itself will cause a query to the credentials database when
        it de-escalates its privileges according to the user/group specified on
        the command line, and this seems not to throw any error. My money is more
        on how Mavericks handles non-GUI user accounts; OS X has never really been
        aimed at 'proper geeks', it being rather a GUI user's operating system
        (unlike the NextStep that begat it!) and I suspect a failure of testing in
        regards to that type of user account.
        
        Oh and to answer you last question, it is standard safety practice to run
        privoxy using the least-privileged access model - in that way even if
        there were a fault in it that were leveraged to gain control of the
        process, it would not have the 'power' to do any great harm to the system.
        If left to launchd's own devices it would run as root, which is
        undesirable, and running it as any other user would probably run into the
        same issues as we're seeing (although it might be an interesting exercise
        to run it using your own interactive login account user/group, just to
        test the hypothesis I established above).
        
        Do let me know if the further plist modification I outline above resolves
        the issue for you; if it does I will likely incorporate it into future
        Privoxy releases for installation targets <= 10.9.
        
        Cheers,
        
        Ian
        
        On Thu, 13 Mar 2014 19:13:37 -0400, Lynn Clark lclark0751@users.sf.net
        wrote:
        
        After a reboot, the following two lines are at the end of the system.log
        file:
        
        Mar 13 16:38:37 localhost com.apple.launchd[1] (org.ijbswa.privoxy[62]):
        getgrnam("_privoxy") failed
        Mar 13 16:38:37 localhost com.apple.launchd[1] (org.ijbswa.privoxy[62]):
        Exited with code: 3
        
        Running 'ps -ef | grep privoxy' verifies that privoxy is not running (no
        privoxy lines in the ps output, except for the grep line)
        
        Running the two "sudo launchctl unload/load ..." commands gets privoxy
        running again.
        
        This is with Dutchwood's modifications to the org.ijbswa.privoxy.plist
        file (add --user _privoxy" to the program arguments, and remove the
        UserName key/value pair.
        
        I spent many, many years in Unix-land (Solaris and many flavors of
        Linux), but the BSD Unix underneath OS X is somewhat opaque to me. I'm
        starting to wonder if there's some kind of time >dependency on when
        things happen during the startup process on OS X. Maybe (sometimes?)
        privoxy tries to startup before the _privoxy user account is visible? Is
        there a way to delay the >LaunchDaemon plist running? Does privoxy need
        to run as the _privoxy user? Could it run as a "normal" user, i.e.
        yourself? I don't know the answers to these questions. Just thinking out
        loud.
        
        [support-requests:#1599] Privoxy won't run or install on Mac OSX 10.9
        
        Status: closed
        Group: 3.0.21
        Labels: startupCreated: Thu Oct 24, 2013 02:00 AM UTC by cjpragman
        Last Updated: Thu Mar 13, 2014 12:45 PM UTC
        Owner: Ian Silvester
        
        Had a working version of privoxy 3.0.21 running fine on a laptop with
        Mac OS 10.8.5.
        I upgraded the laptop today to 10.9 Mavericks. After reboot, I see that
        privoxy hasn't loaded. Used launchctl to unload and reload the .plist
        file in /Library/LaunchDaemons. Still wound't start.
        
        Next I tried downloading a fresh copy from here (3.0.21 64 bit). Ran
        installer. Installer failed. I've attached the installer logs below.
        
        Sent from sourceforge.net because you indicated interest in
        https://sourceforge.net/p/ijbswa/support-requests/1599/
        
        To unsubscribe from further messages, please visit
        https://sourceforge.net/auth/subscriptions/
        
        Related
        
        Support Requests: ~~#1599~~
        
        If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
        
        Lynn Clark - 2014-03-14
        
        Ian, thanks for the info. After removing the GroupName key/value pair and changing the ProgramArguments to "--user _privoxy._privoxy" as you suggested, Privoxy has continued to start up after three reboots. So this may be a solution to the problem. I'll add more information here if it doesn't continue to start up as time goes by.
        
        Here is my current /Library/LaunchDaemons/org.ijbswa.privoxy.plist file (indentation only for readability here, indentation is not necessary or required in the plist file):
        
        <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>org.ijbswa.privoxy</string> <key>ProgramArguments</key> <array> <string>/usr/local/sbin/privoxy</string> <string>--user</string> <string>_privoxy._privoxy</string> <string>--no-daemon</string> <string>/usr/local/etc/privoxy/config</string> </array> <key>RunAtLoad</key> <true/> <key>StandardErrorPath</key> <string>/var/log/privoxy/logfile.log</string> <key>StandardOutPath</key> <string>/var/log/privoxy/logfile.log</string> </dict> </plist>
        
        If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Dutchwood - 2014-03-13

@Lynn Clark

Have you:

Fixed permissions?
Tried a Start up in Safe Boot mode (start up with shift pressed)?

checked if there are a privoxy user and group?

NB:even with my modifications I have to do an extra reboot after an update or rebuild.

Hope this helps

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

cjpragman - 2014-03-14

it appears some part of mac's directory services is not awake yet when the plist loads.
Probably needs an entry in the .plist to check that "opendirectoryd" is running first. I'm not an expert on launched plist files, so not sure how to do this.
My .plist has the lines:

<key>GroupName</key> <string>_privoxy</string> <key>Label</key>

But I'm NOT getting a getgrnam() error. I was getting a getpwnam() error before I made DutchWood's modifications.

Could just be a timing difference in your boot process.
You could try putting a "wait" statement in your launched file. You could also try putting a "keep alive" = "true" statement in the launched file. I noticed that the other daemon processes use the keep alive directive. That would seem to make sense here, as launched would keep trying to load it till it succeeded. Maybe add a respawn time of 10 seconds or so, so launched won't hammer the system too bad while it's waiting for the other supporting daemons to load.

Last edit: cjpragman 2014-03-14
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

cjpragman - 2014-03-14

A little googling, and found to potential hits. Apparently, there's a launched directive that can be put in the users/groups section of the .plist called "InitGroups". Adding InitGroups is supposed to call the function initgroups() before starting the job. The man page for initgroups seems to indicate it has something to do with loading the users & groups (i.e., directory serviced info).

Details are on this page, in the second tab titled "Configuration"
http://launchd.info

There's another thread that's dated, but might have relevant info in it as well.

http://mac-os-forge.2317878.n4.nabble.com/LaunchDaemon-unable-to-launch-and-causing-messages-in-log-td189188.html

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

cjpragman - 2014-03-14

Did a search of my /system/library/launchdaemons directory. The following launched plists include the InitGroups directive. Perhaps perusing these will give a clue...

com.apple.kdumpd.plist
com.apple.mDNSResponder.plist
com.apple.ocspd.plist
com.apple.TrustEvaluationAgent.system.plist
finger.plist
tftp.plist

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Lynn Clark - 2014-03-14
  
  I've modified the org.ijbswa.privoxy.plist file to use the InitGroups key/value pair. So far Privoxy continues to start up after a couple reboots. I'll try a couple more reboots. If it continues to start up I'll post my updated plist file.
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

OK, I've tested the InitGroups key/value pair in the privoxy plist file. So far it has enabled privoxy to start successfully after several reboots. It also works on OS X 10.6.8, at least as far as stopping/starting privoxy via the scripts in the /Applications/Privoxy directory.

So here is my current /Library/LaunchDaemons/org.ijbswa.privoxy.plist file:
(again, indentation is OK, but not necessary or required in the file)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Label</key>
            <string>org.ijbswa.privoxy</string>
        <key>ProgramArguments</key>
            <array>
                <string>/usr/local/sbin/privoxy</string>
                <string>--no-daemon</string>
                <string>/usr/local/etc/privoxy/config</string>
            </array>
        <key>RunAtLoad</key>
            <true/>
        <key>InitGroups</key>
            <true/>
        <key>GroupName</key>
            <string>_privoxy</string>
        <key>UserName</key>
            <string>_privoxy</string>
        <key>StandardErrorPath</key>
            <string>/var/log/privoxy/logfile.log</string>
        <key>StandardOutPath</key>
            <string>/var/log/privoxy/logfile.log</string>
    </dict>
</plist>

Notice that I restored the GroupName and UserName key/value pairs and removed the "--user _privoxy._privoxy" part from the ProgramArguments section. InitGroups requires the use of the UserName key/value pair, so it made sense to add both the UserName and GroupName key/value pairs.

Ian Silvester - 2014-03-14

Well it's a tad banal to say it but hurrah for open source software!

Thank you both cjpragman and Lynn Clark for your research and testing; I'll commit the changes you've developed to source control and make a new build. Once I've completed my usual testing round I'll then publish the new installer.

Many thanks again for your contribution to the project; if you have no objections I will add your names to the OS X readme as contributors.

Cheers,

Ian

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Lynn Clark - 2014-03-14
  
  Yes, thanks to both you and cjpragman for the research and suggestions. I ended up learning more about plist files that I ever thought I would. They've always been a bit of a mystery to me.
  
  I have no objection to being listed as a contributor. One minute of fame down, fourteen more to go. ;-)
  
  Last edit: Lynn Clark 2014-03-14
  
  If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

cjpragman - 2014-03-14

WAIT!!

Just got home and reverted my .plist to the default, and then added the InitGroups TRUE directive. Upon reboot, mine didn't work. See log lines below. I think we're going to have to bite the bullet and add the KeepAlive directive. When I look at the system log on a normal reboot, I see that a lot of processes are churning and relaunched by launched before their support processes are available. Adding KeepAlive to privoxy will put it in the same ballpark as these other processes.

3/14/14 6:31:31.756 PM com.apple.launchd[1]: (org.ijbswa.privoxy[75]) getpwnam("_privoxy") failed
3/14/14 6:31:31.757 PM com.apple.launchd[1]: (org.ijbswa.privoxy[75]) Exited with code: 3

Note that manually unloading / loading via launchctl after the failed reboot attempt worked. Just the auto-launch on reboot failed.

Last edit: cjpragman 2014-03-14

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Privoxy won't run or install on Mac OSX 10.9

HTTP proxy to block ads and customize webpages

Group

Searches

Help

#1599 Privoxy won't run or install on Mac OSX 10.9

Related

Discussion

Related