Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to automatically mount an EncFS volume by using login/logout hook scripts on Mac OS X. The scripts are run as root and automatically run user defined hooks as the user logging in or out. The main scripts are in /usr/local/sbin and are called loginhook and logouthook. Here is the login script:



if [ -e "$LOCAL_HOOK" ]
  su - $1 -c "bash $LOCAL_HOOK"

The script is registered to execute on login with:

sudo defaults write LoginHook /usr/local/sbin/loginhook

User defined .loginhook:

PWD=$(security find-generic-password -ga EncFS 2>&1 >/dev/null | cut -d'"' -f2)
echo $PWD | $ENCFS -S $HOME/.encrypted/Vault $HOME/Documents/Vault

The redirection for the security command is necessary since normal output goes to stdout but the password goes to stderr and looks like password: "mypass".

If I execute .localhook from my user account the script works fine, but if the script gets executed from the "parent" script (which runs as root) by using su I get a blank password.

Debugging with bash -x shows that everything runs as it should, but the env command reveals that the environment is not the same as when I log in despite using su - in the script. I suspect this is where the problem lies but I'm stumped as to what it is.

What am I doing wrong here?

Edit: LaunchAgent solution based on information from Gordon Davisson.



function cleanup {
  # Kill sleep command ($! is PID of last command launched in background)
  kill $!
  umount "$DECDIR"
trap cleanup 1 2 3 6 15

security find-generic-password -ga EncFS 2>&1 >/dev/null | cut -d'"' -f2 | "$ENCFS" -S "$ENCDIR" "$DECDIR"

# Wait for exit
while true; do
  # Sleeping ignores normal signals so start it in a subprocess and wait for it
  sleep 3600 &


<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "">
<plist version="1.0">
share|improve this question
up vote 1 down vote accepted

Login- and logouthook scripts run before & after (respectively) the user session, not within the session. I suspect that since your loginhook is running before the user session starts, the user's keychain hasn't been unlocked yet, so you can't recover passwords from it yet. A LaunchAgent might work better for this...

share|improve this answer
That was indeed the problem. I have made a LaunchAgent solution and will include the the details in the question. – Bjorn Ruud Oct 27 '10 at 20:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.