テーマ： macos
-
System Integrity Protection and the Signed System Volume: what they protect, and why not to disable them
SIP restricts even root from modifying protected system paths or protected processes; the Signed System Volume cryptographically seals the entire system volume and checks it at every boot. Together they explain why /usr/local is writable but /usr is not, and why disabling SIP is not a legitimate fix for a permissions error.
-
Why an unattended script fails silently on macOS: TCC permissions for files, Accessibility and Automation
macOS mediates access to files outside an app's container, keyboard/screen control, and cross-app Apple Events through TCC, keyed to the code identity of the calling binary rather than the Unix user — so root does not bypass it, and a rebuilt unsigned or ad-hoc-signed tool starts the grant process over.
-
Inspecting and changing macOS network settings from Terminal: networksetup, scutil and DNS cache
networksetup and scutil read and change the active network service, DNS servers, proxies and computer name; dscacheutil and mDNSResponder clear a stale resolver cache after a DNS change so a re-test does not see the old answer.
-
Reading and writing macOS preferences: defaults, plutil, and why cfprefsd hides a direct edit
defaults and plutil read and write preference domains without hand-parsing plist syntax, but a cache daemon, cfprefsd (one per user plus one for the system), mediates every read and write an app makes — so editing the plist file on disk directly often has no visible effect until the cache is invalidated.
-
Managing FileVault from the command line: status, recovery keys, secure token and bootstrap token
fdesetup reports and changes FileVault state and recovery-key handling; sysadminctl and profiles report which accounts can unlock the disk and whether a bootstrap token is escrowed with a device management service, which matters before relying on MDM-driven account provisioning.
-
Verifying that macOS software is signed, notarized and unmodified: spctl, codesign, stapler
Before running software obtained outside the App Store, spctl, codesign and xcrun stapler confirm it is code-signed, notarized by Apple, and unmodified since signing. Purely defensive verification: nothing here disables or bypasses these checks on software you do not trust.
-
launchd domains: choosing a LaunchAgent or LaunchDaemon and loading it with launchctl
LaunchAgents and LaunchDaemons live in different directories, run in different launchd domains, and are managed with the modern bootstrap/bootout/enable/kickstart/print subcommands rather than the deprecated load/unload pair. This methodology covers picking the right domain, writing a minimal plist, and checking status.
-
Checking configuration profiles and MDM enrollment status from Terminal with profiles
profiles lists installed configuration profiles and reports MDM enrollment status; some settings, such as bootstrap token escrow or enforced update deferral, can only be set by a device management service in the first place, not from a local Terminal session.
-
Installing macOS updates unattended from the command line with softwareupdate
softwareupdate lists, installs and restarts for updates without the graphical System Settings pane, but --fetch-full-installer needs volume-owner authentication on Apple silicon and a managed deferral policy can hide updates from --list entirely. This methodology covers both.
-
Clock sync compared: chrony, systemd-timesyncd, w32tm, macOS timed and AIX xntpd
A quick reference for checking whether a host's clock is actually synchronized, across the time daemons used by Linux, Windows, macOS and AIX — distinct from a deep dive on any single tool, since the check is the same shape everywhere: is a source configured, and is it currently in sync.
-
Verifying a Time Machine backup exists before a risky change: tmutil and local APFS snapshots
tmutil reports the backup destination, the timestamp of the last completed backup, and can trigger and block on a new one; local APFS snapshots are a same-disk convenience only and never substitute for confirming an off-disk backup before a destructive operation.
-
Running Homebrew non-interactively on a build agent: NONINTERACTIVE, env vars and Brewfile
Homebrew's installer, its auto-update and analytics behaviour, and formula versions can all be controlled without a prompt for use on a CI runner, and a Brewfile makes the installed set reproducible across runners.
-
Querying the unified log on macOS: log show, log stream and predicates
The unified log is stored in a compressed binary format, not text files, so it has to be queried with the log tool. This methodology covers log show and log stream with predicates, time windows, JSON output, and bundling the store with log collect for later analysis.
-
File permission models compared: POSIX bits, POSIX ACLs, NFSv4/ZFS ACLs, NTFS and macOS ACLs
POSIX mode bits, POSIX ACLs, the NFSv4/ZFS ACL model, NTFS ACLs and macOS ACLs each express access control differently, and almost none of it survives copying a file from one system to another. This reference lists the read/write commands for each and what gets silently dropped in transit.
機械可読： JSON