ERROR: Tunnelblick could not be configured to automatically launch itself after you log in.

[Martin Veasey]

I've just installed TunnelBlick on a new Macbook Air. The VPN connection process works well with no difficulty.

However, I get the following error message when I start the TB application:

" Tunnelblick could not be configured to automatically launch itself after you log in. See the Console log for details. "

and, consequently, the TB icon is not maintained in the top menu bar in between boots.

The Console Log has the following key entries:

*Tunnelblick: OS X 10.11.4; Tunnelblick 3.6.4beta04 (build 4562); prior version 3.6.3 (build 4560); Admin user

 

2016-05-11 19:43:42 Tunnelblick[448] Tunnelblick: OS X 10.11.4; Tunnelblick 3.6.4beta04 (build 4562)

2016-05-11 19:43:43 Tunnelblick[448] Set program update feedURL to https://www.tunnelblick.net/appcast-b.rss

2016-05-11 19:43:43 Tunnelblick[448] Error returned from setAttributes: {

                                           NSFilePosixPermissions = 448;

                                       } ofItemAtPath: /Users/USERNAME/Library/LaunchAgents; Error was Error Domain=NSCocoaErrorDomain Code=513 "You don’t have permission to save the file “LaunchAgents” in the folder “Library”." UserInfo={NSFilePath=/Users/USERNAME/Library/LaunchAgents, NSUnderlyingError=0x1063232a0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}; stack trace: (

                                                0   Tunnelblick                         0x0000000100038ae1 -[NSFileManager(TB) tbChangeFileAttributes:atPath:] + 156

                                                1   Tunnelblick                         0x0000000100070884 createDir + 304

                                                2   Tunnelblick                         0x000000010002b670 -[NSApplication(LoginItem) setupNewAutoLaunchOnLogin] + 281

                                                3   Tunnelblick                         0x000000010001c1dc -[MenuController applicationDidFinishLaunching:] + 211

                                                4   CoreFoundation                      0x00007fff915eebbc __CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12

                                                5   CoreFoundation                      0x00007fff915eeb4f ___CFXRegistrationPost_block_invoke + 63

                                                6   CoreFoundation                      0x00007fff915eeac7 _CFXRegistrationPost + 407

                                                7   CoreFoundation                      0x00007fff915ee832 ___CFXNotificationPost_block_invoke + 50

                                                8   CoreFoundation                      0x00007fff915ab5e2 -[_CFXNotificationRegistrar find:object:observer:enumerator:] + 1922

                                                9   CoreFoundation                      0x00007fff915aa835 _CFXNotificationPost + 693

                                                10  Foundation                          0x00007fff87ef2fda -[NSNotificationCenter postNotificationName:object:userInfo:] + 66

                                                11  AppKit                              0x00007fff91d24459 -[NSApplication _postDidFinishNotification] + 297

                                                12  AppKit                              0x00007fff91d241c3 -[NSApplication _sendFinishLaunchingNotification] + 203

                                                13  AppKit                              0x00007fff91bdee9d -[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 557

                                                14  AppKit                              0x00007fff91bde947 -[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 250

                                                15  Foundation                          0x00007fff87f4162d -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] + 290

                                                16  Foundation                          0x00007fff87f414a7 _NSAppleEventManagerGenericHandler + 102

                                                17  AE                                  0x00007fff85d4c261 _Z20aeDispatchAppleEventPK6AEDescPS_jPh + 531

                                                18  AE                                  0x00007fff85d4bfe8 _ZL25dispatchEventAndSendReplyPK6AEDescPS_ + 31

                                                19  AE                                  0x00007fff85d4bf04 aeProcessAppleEvent + 288

                                                20  HIToolbox                           0x00007fff9731daf9 AEProcessAppleEvent + 55

                                                21  AppKit                              0x00007fff91bda394 _DPSNextEvent + 2245

                                                22  AppKit                              0x00007fff91bd932a -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454

                                                23  AppKit                              0x00007fff91bcde84 -[NSApplication run] + 682

                                                24  AppKit                              0x00007fff91b9746c NSApplicationMain + 1176

                                                25  Tunnelblick                         0x0000000100001338 start + 52

                                                26  ???                                 0x0000000000000001 0x0 + 1

                                       )

2016-05-11 19:43:43 Tunnelblick[448] Warning: Unable to change permissions from 755 to 700 on /Users/USERNAME/Library/LaunchAgents

2016-05-11 19:43:43 Tunnelblick[448] open on /Users/USERNAME/Library/LaunchAgents/net.tunnelblick.tunnelblick.LaunchAtLogin.plist: Permission denied

It seems that this is the key: "You don’t have permission to save the file “LaunchAgents” in the folder “Library”
so it may not be a TB specific issue - though I haven't changed any user permissions and I'm not running into problems with other programs / apps.

Has anyone seen this problem before or have any suggestions?

Many thanks,

Martin

[jkbull...gmail.com]

Thanks for reporting this.

Tunnelblick is trying to put a file into the /Users/USERNAME/Library/LaunchAgents folder. To do that, it first looks at the ownership and permissions of the folder, and tries to change the ownership/permissions if they are not what Tunnelblick thinks they should be. It looks like the problem is that the permissions are not what Tunnelblick thinks they should be and OS X is not allowing Tunnelblick to change them. So what are the permissions that Tunnelblick doesn't like, and why won't OS X let Tunnelblick change them? To answer those questions, please:

1. Post the version of OS X you are using (I assume it is 10.11.something, since this is a new MacBook Air.)

2. Post whether you are logged in as a "Standard" user or an "Admin" user? ("Users & Groups" in "System Preferences" lists that under the name of the user.)

3. Post the output from executing the following line in Terminal? (Terminal is in /Applications/Utilities):

ls -l ~ | grep 'Library' ; ls -l ~/Library | grep 'Launch'

(Change your username to "USERNAME".)

The output should look something like this:

drwx------@ 70 USERNAME  staff      2380 Mar 21 10:20 Library

drwx------    8 USERNAME  admin    272 May 12 01:00 LaunchAgents

Thanks.

On Thursday, May 12, 2016 at 8:30:13 AM UTC-4, Martin Veasey wrote:

I've just installed TunnelBlick on a new Macbook Air. The VPN connection process works well with no difficulty.

However, I get the following error message when I start the TB application:

" Tunnelblick could not be configured to automatically launch itself after you log in. See the Console log for details. "

and, consequently, the TB icon is not maintained in the top menu bar in between boots.

The Console Log has the following key entries:

<snip> 

[Martin Veasey]

Thanks for getting back so quickly - and for providing instructions on how to find the answers to the questions !

1. El Capitan 10.11.4

2. The user is an Admin - probably shouldn't be later but is for now (!)

3. The (obfuscated) output is as follows:

drwx------@ 55 USERNAME  staff  1870 11 May 17:53 Library

drwxr-xr-x    3 root           staff   102 10 May 16:47 LaunchAgents

Perhaps the 'root' is the problem? Would testing by changing the owner break other things?

[jkbull...gmail.com]

Thanks. The problem is definitely the ownership by "root". On all of my versions of OS X (10.4 - 10.11) it is owned by the user (USERNAME), so I don't think you should have a problem if you change it.

The change to being owned by root probably was done by either:

1. A bad installer (some apps have installers that incorrectly change ownership/permissions on folders they shouldn't);
   or
2. Some kind of security software that tries to "lock down" your installation of OS X.
   

I have seen evidence of bad installers change ownership/permissions of /Applications and other system folders (Tunnelblick checks for this sort of problem). I have never seen security software that would do this.

If you post the output from

ls -l ~/Library/LaunchAgents

we might be able to figure out what program's installer messed up the ownership. It would be good to report that problem to the authors of that program.

[Martin Veasey]

Thanks,

A simple 'sudo chown' has fixed the problem!

With regard to the question of what happened ... the ls within LaunchAgents turned this up:

-rw-r--r--  1 root           staff  451 10 May 16:52 com.lastpass.LastPassHelper.plist

I'll drop LastPass developers a note.

Thanks again for your help,

Martin

[jkbull...gmail.com]

Hmmm, LastPass is a password manager.

Maybe LastPass is doing this on purpose, trying to make the installation of LastPass "secure". Perhaps their .plist contains non-encrypted info or something that they are trying to protect, or they're trying to protect the .plist from being modified. If so, they are doing it the wrong way -- it is very unfriendly to the OS and to other programs, and there is a "correct" way to do what they want.

If they are doing it on purpose, then changing it back to the "normal" ownership may make your LastPass installation insecure. You should talk to LastPass about this.

However, once Tunnelblick has "installed" its .plist, it won't try to re-install it unless it changes, which doesn't happen very often. (It would only happen when you update Tunnelblick, and only when a new version of OS X requires a change. I think that last happened years ago, in the change from OS X 10.4 to 10.5.)

So if you change the ownership back to root after running Tunnelblick once, I think Tunnelblick should launch at login when appropriate, because the .plist will be there.

(Tunnelblick's LaunchAtLogin.plist simply starts a tiny program each time you log in. That program launches Tunnelblick if a Tunnelblick "preference" is set to do that, and then the program exits. So Tunnelblick controls whether or not to launch at login by changing the value of the "preference". It doesn't fiddle with the .plist file at all after it is originally set up unless the .plist contents need to change, as describe above.)

[Martin Veasey]

Reverting the LaunchAgents directory ownership to root does seem to preserve the "on if previously on" behaviour of TB, but the warning window I originally referenced does come back, so I'm sticking with USERNAME ownership for now and relying on the root ownership of the Lastpass plist.

I'm bouncing emails back and forth with Lastpass, so will let you know if something important comes up.

Cheers

Martin

[pordes...@gmail.com]

Martin,

Did you ever figure this problem out? I'm getting the same error message, and I also have Lastpass installed.

Thanks,

[Tunnelblick developer]

The problem, after investigation, was that the LastPass installer program created the /User/USERNAME/Library/LaunchAgents folder with an ownership by root, instead of by the user.

The last I heard (in private emails with Martin), LastPass agreed that this was their problem, and in a support response they said on 2016-05-16 "this has been fixed and will be available in the next release."

[Martin Veasey]

That's right - I fixed the symptom by hand. I haven't heard further from Lastpass and didn't need to reinstall, so I don't know whether they fixed the problem in a subsequent release.

However, I would expect that changing ownership manually would still work.

-- 
Martin Veasey
mar...@veasey.org

[Tunnelblick developer]

It may be that LastPass fixed the problem partially, so that new installations set the folder to the correct permissions, but didn't do anything about existing installations when LastPass is updated.

To fix the problem manually:

First, be sure you are comfortable using the command line. It is possible to mess up your computer using the command line so badly that you would lose your data and need to reinstall OS X! Do not add or remove spaces from the commands shown below. When possible, copy/paste instead of using the keyboard.

Second, make sure you are an "admin user" and not a "standard user". If you don't know what those are, don't worry about it because you are an admin user. (A small number of people specifically set up their computer to be a "standard user"; you would know if you have done that.)

1. Verify that you have the same problem by copy/pasting the following command into /Applications/Utilities/Terminal:

cd  ~/Library  ;  ls  -l  -d  LaunchAgents

If all is well, the output you see should be something like:

drwx------  7 UUUUUU  admin  238 Oct 28 01:01 LaunchAgents

where "UUUUUU" will be your "short username" (usually your full name in all lower case and with spaces removed).

If you have this problem, the "UUUUUU" will be "root", and instead of "admin" you might see "staff". The "drwx---------" and "LaunchAgents" you see should be the same, but the "7", "238", and the date and time may be different.

2. Assuming that you have the same problem, you can correct it by typing (very carefully!) the following command:

sudo  chown  UUUUUU:admin  ~/Library/LaunchAgents

• Don't type "UUUUUU", instead, type in your "short username" from the earlier output.
  
  
• The ":" character is a colon; on US keyboards it is to the right of the letter "L" key and you need to hold down a "shift" key to enter it.
  
  
• The "~" character is a tilde; on US keyboards it is to the left of the numeral "1" key and you need to hold down a "shift" key to enter it.

You will be asked for your password; type in your password and press the return key. (Nothing, not even asterisks, will show up as you type.)

3. Verify that the problem is fixed by repeating the earlier command (copy/paste it):

cd  ~/Library  ;  ls  -l  -d  LaunchAgents

If all is well, the output you see should be something like what was shown earlier:

drwx------  7 UUUUUU  admin  238 Oct 28 01:01 LaunchAgents

Again, it is the "UUUUUU" and "admin" that are important.

Good luck! And if you are not comfortable using the command line, get a friend, relative, co-worker, etc. who is comfortable using the command line to help you.

On Friday, October 28, 2016 at 4:22:25 AM UTC-4, Martin Veasey wrote:

That's right - I fixed the symptom by hand. I haven't heard further from Lastpass and didn't need to reinstall, so I don't know whether they fixed the problem in a subsequent release.

However, I would expect that changing ownership manually would still work.

-- 
Martin Veasey
<>

[Malcolm Pordes]

Thanks for your replies. I doubt whether Lastpass have fixed the problem as this is the problem I'm seeing. I will try your manual solution.