1

I just want to know if this can be done in one command without any interactions in macOS. There's an interactive way to do this (I first switched to the user abc and then switched back so that abc had a hidden desktop):

(in sudo mode) login abc (type the password) screencapture <png-file-name>

In my test, this would take a screenshot of abc's hidden desktop and save it to the file. But the weird thing is that when I use -f option (only applicable in sudo mode) to eliminate the need of typing password, the screenshot becomes the current user's desktop, not abc's desktop:

(in sudo mode) login -f abc /usr/sbin/screencapture <png-file-name> OR login -f abc bash -c "/usr/sbin/screencapture <png-file-name>"

Both don't work as expected.

su or sudo also can't meet my requirements, because they also take the screenshots of current user's desktop.

You may wonder why I want that. In fact I don't want the screenshots, I want security. I want to make the shell of this another user completely isolated from the current user, so that any malicious code running in this shell will not be able to take screenshot of the current user.

Improve this question
2
  • Are you sure about the first assumption? screencapture grabs the currently visible screen, independent of the user logged in through Terminal. Which problem are you trying to solve here? Can you describe it without making assumptions about the solution yet? Commented Jun 20, 2017 at 12:54
  • Not assumptions. I've tested them. screencapture captures the other user's screen when in login, but captures the current visible screen in su -u, sudo -u, or login -f. But first you need to use UI to log in to that user then switch back (not quit) to make his desktop hidden. I've modified the description to clarify. Commented Jun 20, 2017 at 13:54

1 Answer 1

Reset to default
1

The desktop is managed by the WindowServer daemon.

The communication with WindowServer is guarded so that only root and the current console user can access WindowServer.

Because you're using sudo, you have root privileges to be able to communicate with WindowServer.

In addition to this the current namespace is used to determine, which desktop is "your desktop". A session namespace is created for each currently logged in user.

When you use the login command, you're asked to enter your password. This is actually handled by the PAM subsystem. As part of the standard PAM setup on macOS, you're transferred to the correct (your own) session namespace, when logging on with the right password.

Therefore when you use "login" and enter a password, you get a screenshot of that user's desktop because you're in the right namespace.

However, when you use "login -f" you're bypassing PAM. Therefore the PAM modules are never executed, and you stay in the same name space you were before.

Therefore when using "login -f" to take the screenshot, you're actually getting a screenshot of the currently logged in user - and not the "abc" user you want.

You can read more about this in technical note TN2083:

https://developer.apple.com/library/content/technotes/tn2083/_index.html#//apple_ref/doc/uid/DTS10003794-CH1-SUBSECTION14

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.