[HOWTO] iSightCapture Command Line Security Workaround

[ScottW]

Starting in 10.4.10, Apple put in some security restrictions that made using utilities like isightcapture unusable to anyone but the console user. This limited the ability to remotely log into a system and capture video from an iSight camera through the command line. In addition, it stopped you from being able to setup a cron to run every so often because the isightcapture application was not run by the console user, but by root or crond. This broke the ability of people running their own little scripts running on a local machine.

Common errors:

FATAL: setting data channel failed - cam busy/not connected ?
open requires the user to be logged in at the console to launch applications.

It took some trial and error, but I finally managed a way to overcome this under Leopard 10.5.1 and I assume it will work under Tiger 10.4 was well. The method involves using Applescript. While you can run the isightcapture utility remotely via SSH it requires using the GUI side Applescript, not the command line side. This means that visual feedback will happen when the application is launched. The Applescript icon will show up in the dock, the application will move to the foreground and run then quit. It happens pretty quick and short of your dock expand and contracting you'd never know it was running.

For those setting up their own scripts on their own computer or managed computers for whatever purpose, this is probably not a problem. For those wishing to take snapshots secretly on remote machines, this won't help you out unless it's your computer and the screen saver is running or monitor is off. Granted, that is what Apple was doing when it started blocking access and while running the same script via osascript renders errors. In addition, it won't work if the user it is running under is not the active logged in user session.

I am sure there is something I have missed, but this should get things going again for most people.

Open Script Editor and type in:

do shell script "/your/path/isightcapture imagename"

Modify the code to your liking and setup above. Then save the script as an application to a location and name of your choice, but for this example I will use isightscript.app.

Open up Terminal and type "crontab -e" and hit return. This probably will bring up an empty listing, but whether it is empty or you have entries already, go to the end of any listings and on a new line type:

* * * * * open /path/to/isightscript.app

The above code will execute your script every minute 24/7. If you only wish to run it every hour on the hour:

0 * * * * open /path/to/isightscript.app

Anyhow, standard crontab practice applies to entries. You can define certain time ranges, certain days of the week, etc.

To try out your code without using crontab or if you are logged in remotely via SSH, you can just type "open /path/to/isightscript.app" in terminal and you should see the script load, it will take a picture and return.

Plus, since your using Applescript, you can do all sorts of fun things like sending an email of the output to you or uploading it to a remote web server. Imagine if you are away from your machine and you wanted to take a picture, you could send a email message with certain text to your account, when Mail.app sees this incoming email, based on a defined rule, it could launch this Applescript and take a picture then send the resulting image back to you. While I have not included the code to do all that above, you get the idea. Using Automator would get you on the right track.

[ScottW]

I have attached it for those who can't seem to find it anywhere.

[Raveneye]

"This means that visual feedback will happen when the application is launched. The Applescript icon will show up in the dock, the application will move to the foreground and run then quit. It happens pretty quick and short of your dock expand and contracting you'd never know it was running."

You can get rid of the visual feedback by saving the applescript as an application bundle and editing the Info.plist inside of the package contents. Add the following lines with a text editor:

<key>NSUIElement</key>
<string>1</string>

This will prevent your application from popping up on the dock when it runs.

[james_342]

I have setup the app and it works when I run it in the terminal but I cannot seem to get the cron to work. I have also tried launchd without success. Any ideas?

[DrDavid]

This did not work for me. Let me give a few details.

I am using the scripts from MacOSXHints to take a picture on wake from sleep and post to a web page.

http://www.macosxhints.com/article.p...70126214841550

This was working fine, but somewhere around the end of March this stopped working (perhaps when Apple issued an update?). The symptoms are that on wake from sleep, the light on my iSight goes on for a short while as it should, indicating it is taking a picture. But no picture is saved. When I use the Activity monitor, I see that the program iSightCapture is still running. It looks like it gets stuck after taking the picture. So, rather than not being able to access the iSight camera, it looks like something gets stuck after taking the picture.

I tried the work around from this article (I'm running Mac OS 10.4.11). I created the script application as directed, and when I double click on it, it works fine. But, when I put the path to the script application in my .wakeup file, I continue to get the same behavior - on wakeup, the camera light goes on for a short while, but the iSightCapture program never exits and no picture is saved.

By the way, one consequence of this problem is that Skype and other programs can not access the iSight program. The stuck iSightCapture program continues to hold exclusive access to the camera until I reboot the computer or kill the process. This is what originally led me to investigate the issue.

[Virtual1]

Thank you for the helpful information. I was adding support for sending pictures from my laptop to my server and was getting this error, only when the script ran by cron of course, which was really annoying. I had to implement the applescript solution, and unfortunately this requires a user to be logged into the computer for the script to work but I don't think there's a better solution. This was probably done very much on purpose by Apple and they may not even approve of this workaround. (so lets hope they don't find this thread or this work-around may get worked-around...)

It's been my experience that the "open" command runs under the context of whatever user is using Finder, (specifically whichever user is "frontmost" when fast user switching is in use) and that dictates what rights will be available to isightcapture, so be sure that wherever isightcapture is placing files is writable by all Finder users on your machine, even if your cron job is running as root.

I could've swore I had this working earlier under 10.5. I wonder if they neglected to get this security fix right in 10.5.0 or 10.5.1? But it certainly is affecting 10.5.2 here.

The plist hack to keep it out of the dock is another handy trick I'll have to remember. I suppose I can use that the other way too (remove it) to get things into the dock that like to run invisibly.

Background: in case anyone's wondering what it's used for here, my laptop is set to detect its IP address (WAN as well as LAN) once an hour and ssh it to my server if available. If a script is waiting on the server for it, it downloads and runs it.

I recently found isightcapture, and so added another cron job (that runs once a minute) to take a picture once a minute and scp it back to the server if a file exists, and so I can leave it a one liner command to touch that file to turn on the minutely picture capture. Or the script can do anything else necessary if my laptop is stolen.

How much you want to bet there's an undocumented way to turn on the isight without turning on the green light?