Tunnelblick's Background Programs

On This Page
    What Are Background Programs
    Controlling Background Programs in System Settings
    Tunnelblick's Background Programs
    Why You Should Not Disallow Tunnelblick's Background Programs
    Bugs in current versions of Tunnelblick
    Apparent bug in some versions of macOS

What Are Background Programs

Background programs are programs or applications that run "in the background", that is, where you don't see them. They don't have windows (like Safari) and they don't appear on the menu bar (like the clock).

They are used for many purposes, and macOS itself runs more than 150 programs in the background to perform tasks such as Time Machine backups, synchronizing Photos among your devices, responding to changes in the Wi-Fi network, mounting the volumes on a thumb drive when is plugged into a USB port, etc.

Although background programs are said to be "running" in the background, that does not mean that they continuously use CPU time or memory. Most background programs are run only occasionally, on a schedule or when the situation that they are needed for happens. For example, Time Machine backups run automatically only once per hour, and Photos synchronizing between an iPhone and a Mac runs only at times such as when a new photograph is taken on your phone or a photo is deleted in Photos.

Controlling Background Programs in System Settings

Apple considers all programs that run in the background as "Login Items", even though some of them have nothing to do with being logged in, and might even be running before anyone is logged into a Mac and after everyone has logged out of a Mac.

In macOS Sonoma, Apple lets the user control background programs in System Settings >> General >> Login Items.

That panel divides programs into two categories:

Programs that "Open at Login"
Programs that you can "Allow in the Background"

Users can add or remove "Open at Login" programs, and can allow or disallow "Allow in the Background" programs. (Adding Tunnelblick as an "Open at Login" program is not recommended or necessary; see below.)

These two categories are misleading, however:

Programs that "Open at Login" include only those applications that are specified by a user to do so using the Dock's Options >> Open at Login feature.
Programs that you can "Allow in the Background" include programs that are run when a user logs in, when the computer starts, or in response to an event such as a network change or new USB device being plugged in. Programs appear in this section when they are specified by a program to be run as background programs. Typically, that is specified when a program is installed.

Tunnelblick's Background Programs

Tunnelblick includes two background programs that both appear in the "Allow in the Background" list:

tunnelblickd, which is set up to run when when needed as soon as the computer starts up. It runs as "root" (the "superuser") to perform actions that the Tunnelblick program is not allowed to do without special authorization. It does such things as start OpenVPN as root (so it can make changes to the network setup), or enable or disable network connections (to implement Tunnelblick's "kill switch" feature). This program is also used by Tunnelblick so a VPN can be connected without anyone being logged into a computer.
Tunnelblick Launcher, which is set up to run each time a user logs in. It runs as if it were the user. It is a very small program that only decides whether or not Tunnelblick should be launched, and launches it if necessary. Then the program quits and is not usually run again until a user logs in again, although it is also run when the user changes the System Settings to allow it to run in the background if the user had previously disallowed that. (Other names for the program that does this in older versions of Tunnelblick are "LaunchAtLogin" and "Tunnelblick-LaunchAtLogin".)

The first program is described by System Settings as "affects all users" and macOS requires a computer administrator's authorization to be disabled (because it runs as root).

The second program has no description and may be disabled and enabled by a user without any special authorization.

However…

Why You Should Not Disallow Tunnelblick's Background Programs

Tunnelblick's tunnelblickd background program is used by Tunnelblick to do things such as connect a VPN; if you disallow it you won't be able to do much of anything with Tunnelblick. Tunnelblick may refuse to launch if tunnelblickd is not allowed to run.

Tunnelblick's Tunnelblick Launcher program makes sure that Tunnelblick launches when you log in if it decides that Tunnelblick needs to make sure that you know about certain things, such as that a VPN is connecting or connected, or if the computer's network has been disabled by Tunnelblick's "kill switch" (you'll need Tunnelblick to re-enable it). Because it is important for the user to be aware of these situations, and because it runs, briefly, only once when you log in or allow it after having previously disallowed it, and because it takes a negligible amount of CPU time, memory, or disk activity, it is strongly recommended that you not disallow it.

For convenience, Tunnelblick Launcher also launches Tunnelblick if it was running when the user last logged out (or shut down or restarted the computer). If that's not convenient for you, you can disable it without preventing Tunnelblick from launching if the network is disabled or a VPN is connecting or connected.

Bugs in current versions of Tunnelblick

The Tunnelblick Launcher program in Tunnelblick 4.0.1 is not properly identified in System Settings >> General >> Login Items. macOS identifies the program as being from "Jonathan Bullard" rather than Tunnelblick. The Tunnelblick Launcher program in Tunnelblick 6.0beta03 and and higher are identified properly.

Apparent bug in some versions of macOS

There is a bug in some versions of macOS: Each time Tunnelblick is installed, it overrides the user not allowing tunnelblickd to run because it is required for Tunnelblick to function. However, System Settings >> General >> Login Items continues to show that it is not allowed even though it is allowed. The user can disallow, allow, and then disallow, and that will prevent again tunnelblickd from running until the next time Tunnelblick is installed. (Updating Tunnelblick may also override the user not allowing tunnelblickd to run; that has not been confirmed.)