├── LICENSE.md └── README.md /LICENSE.md: -------------------------------------------------------------------------------- 1 | # License 2 | 3 | ```text 4 | The MIT License (MIT) 5 | 6 | Copyright (c) 2020 Kenneth Endfinger 7 | 8 | Permission is hereby granted, free of charge, to any person obtaining a copy 9 | of this software and associated documentation files (the "Software"), to deal 10 | in the Software without restriction, including without limitation the rights 11 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 12 | copies of the Software, and to permit persons to whom the Software is 13 | furnished to do so, subject to the following conditions: 14 | 15 | The above copyright notice and this permission notice shall be included in all 16 | copies or substantial portions of the Software. 17 | 18 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 19 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 20 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 21 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 22 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 23 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 24 | SOFTWARE. 25 | ``` 26 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # MacHack 2 | 3 | A list of built-in tools in macOS that you probably didn't know about. 4 | 5 | ## Table of Contents 6 | 7 | - [MacHack](#machack) 8 | - [Table of Contents](#table-of-contents) 9 | - [Commands](#commands) 10 | - [java_home](#java_home) 11 | - [dot_clean](#dot_clean) 12 | - [SafeEjectGPU](#safeejectgpu) 13 | - [sharing](#sharing) 14 | - [remotectl](#remotectl) 15 | - [brctl](#brctl) 16 | - [sysadminctl](#sysadminctl) 17 | - [ckksctl](#ckksctl) 18 | - [otctl](#otctl) 19 | - [spctl](#spctl) 20 | - [networksetup](#networksetup) 21 | - [systemsetup](#systemsetup) 22 | - [airport](#airport) 23 | - [AssetCacheLocatorUtil](#assetcachelocatorutil) 24 | - [AssetCacheManagerUtil](#assetcachemanagerutil) 25 | - [seedutil](#seedutil) 26 | - [kmutil](#kmutil) 27 | - [profiles](#profiles) 28 | - [bputil](#bputil) 29 | - [nscurl](#nscurl) 30 | - [taskinfo](#taskinfo) 31 | - [taskpolicy](#taskpolicy) 32 | - [asr](#asr) 33 | - [shortcuts](#shortcuts) 34 | - [networkQuality](#networkquality) 35 | 36 | ## Commands 37 | 38 | ### java_home 39 | 40 | This tool queries the available Java Virtual Machines from `/Library/Java/JavaVirtualMachines`. 41 | 42 | ```text 43 | $ /usr/libexec/java_home --help 44 | Usage: java_home [options...] 45 | Returns the path to a Java home directory from the current user's settings. 46 | 47 | Options: 48 | [-v/--version ] Filter versions (as if JAVA_VERSION had been set in the environment). 49 | [-a/--arch ] Filter architecture (as if JAVA_ARCH had been set in the environment). 50 | [-F/--failfast] Fail when filters return no JVMs, do not continue with default. 51 | [ --exec ...] Execute the $JAVA_HOME/bin/ with the remaining arguments. 52 | [-X/--xml] Print full JVM list and additional data as XML plist. 53 | [-V/--verbose] Print full JVM list with architectures. 54 | [-h/--help] This usage information. 55 | ``` 56 | 57 | An example usage of this tool: 58 | 59 | ```text 60 | $ /usr/libexec/java_home -v 11 -a x86_64 61 | /Library/Java/JavaVirtualMachines/adoptopenjdk-11.jdk/Contents/Home 62 | ``` 63 | 64 | ### dot_clean 65 | 66 | This is an extremely useful built-in utility to delete all useless dot files that macOS creates, such as ._MyFile. 67 | 68 | Just point it at a folder, and it wipes it free of the cruft! 69 | 70 | ```text 71 | $ /usr/sbin/dot_clean 72 | usage: dot_clean [-fmnpsv] [--keep=[mostrecent|dotbar|native]] [directory ...] 73 | ``` 74 | 75 | An example usage of the tool: 76 | 77 | ```text 78 | $ /usr/sbin/dot_clean /Volumes/Shared/MyFiles 79 | ``` 80 | 81 | ### SafeEjectGPU 82 | 83 | This is a utility for managing GPUs, especially eGPUs. This is what is behind 84 | the safe eject functionality of the eGPU in the System UI. 85 | 86 | It is useful for: 87 | 88 | - Listing GPUs on the system. 89 | - Determining what applications are using a particular GPU. 90 | - Ejecting an eGPU safely. 91 | - Launching an application on a specific GPU. 92 | - Switching an application from one GPU to another. 93 | 94 | ```text 95 | $ /usr/bin/SafeEjectGPU 96 | usage: SafeEjectGPU [Commands...] 97 | Commands: 98 | gpuid # specify gpuid of following commands 99 | gpuids ,,... # specify list of gpuids for RelaunchPIDOnGPU command 100 | gpus # show all GPUs and their applicable properties 101 | apps # show all Apps on specified gpuid 102 | status # show status of all specified gpuid 103 | Eject # Eject (full eject sequence) on specified gpuid 104 | Initiate # Initiate eject sequence on specified gpuid 105 | Relaunch # Relaunch lingering AppKit apps on specified gpuid 106 | Finalize # Finalize eject sequence on specified gpuid 107 | Cancel # Cancel eject sequence on specified gpuid 108 | RelaunchPID # RelaunchPID can be used in app testing to send Relaunch stimulus in isolation 109 | RelaunchPIDOnGPU # Send Relaunch stimulus to an app with set of limited GPUs to select from, use gpuids 110 | LaunchOnGPU # Launch an app from given bundle path with set of limited GPUs, use gpuids 111 | zombies # show all zombies (apps holding reference to unplugged eGPU) 112 | zcount # show count of (unhidden) zombies 113 | Zkill # kill zombies 114 | Zrelaunch # relaunch zombies 115 | +fallbackGPUEjectPolicy # allow builtin fallbacks to take effect (default) 116 | -fallbackGPUEjectPolicy # deny builtin fallbacks 117 | 118 | Notes: 119 | Unspecified gpuid (==0) indicates all "removable" GPUs 120 | Capitalized commands may have system-wide effects 121 | Non-capitalized commands are informative only 122 | See description of Info.plist "SafeEjectGPUPolicy" key. Use values: 123 | "ignore", "wait", "relaunch", or "kill" for per-app policy 124 | +/-fallbackGPUEjectPolicy can appear multiple times on the commandline and applies to following commands 125 | ``` 126 | 127 | Example of the `gpus` command: 128 | 129 | ```text 130 | $ /usr/bin/SafeEjectGPU gpus 131 | gpus 132 | 2020-12-27 15:30:35.949 SafeEjectGPU[55941:9041424] Device PreExisted [00000001000008b2] AMD Radeon RX 570 133 | 2020-12-27 15:30:35.949 SafeEjectGPU[55941:9041424] Device PreExisted [00000001000008b5] AMD Radeon Pro 560X 134 | 2020-12-27 15:30:35.949 SafeEjectGPU[55941:9041424] Device PreExisted [0000000100000876] Intel(R) UHD Graphics 630 135 | gpuid 0x56ce - Intel® UHD Graphics 630 136 | registryID=0x0000000100000876 integrated 137 | location - BuiltIn 138 | locationNumber - 0 139 | maxTransferRate - 0 140 | gpuid 0x9f05 - AMD Radeon Pro 560X 141 | registryID=0x00000001000008b5 discrete 142 | location - BuiltIn 143 | locationNumber - 1 144 | maxTransferRate - 0 145 | gpuid 0x5d0e - AMD Radeon RX 570 146 | registryID=0x00000001000008b2 removable 147 | Razer Core X - enclosureRegistryID=0x0000000100000472 148 | location - External 149 | locationNumber - 1 150 | maxTransferRate - 5000000000 151 | ``` 152 | 153 | ### sharing 154 | 155 | This command gives information about File Sharing. It should look similar to the File Sharing section in the Sharing preference pane. 156 | 157 | ```bash 158 | $ /usr/sbin/sharing 159 | Usage: 160 | sharing -a [options] : create a sharepoint for directory specified by path 161 | sharing -e [options] : edit sharepoint named 162 | sharing -r : remove sharepoint with name 163 | sharing -l [-f json] : list existing sharepoints 164 | 165 | options: 166 | -A :use share point name for afp. Obsolete but left in for backwards compatibility. 167 | -F :use share point name for ftp. Obsolete but left in for backwards compatibility. 168 | -S :use share point name for smb. 169 | -s [] :enable sharing, restricted by flags if specified; 170 | flags = 000,001,010 ...111; 1 = share, 0 = do not share; 171 | with digits indicating afp (no longer supported), ftp (no longer supported) and smb in that order; 172 | default is 001 if -s is specified with no flags. 173 | -g [] :enable guest access, restricted by flags if specified; 174 | flags = 000,001,010 ...111; 1 = enabled, 0 = disabled; 175 | with digits indicating afp (no longer supported), ftp (no longer supported) and smb in that order; 176 | default 001 if -g is specified with no flags. 177 | -i [] :enable inherit privileges from parent (afp only). Obsolete but left in for backwards compatibility. 178 | -n :set record name to use (by default this is the directory name of the shared directory) 179 | -R <0/1> :make share read only for smb. 1 is enable, 0 is disable. 180 | -E <0/1> :make share encrypted for smb v3 and later. 1 is enable, 0 is disable. 181 | -f :when listing shares, outputs in specified format. Formats supported: json 182 | ``` 183 | 184 | ### remotectl 185 | 186 | The Apple T2 security chip (a built-in ARM chip in newer Intel Mac models) communicates with your system with a modified HTTP/2 protocol. There is also a command-line interface for various functions of the chip. 187 | Note that this chip is merged with the Apple Silicon chips, and remotectl is no longer used on Apple Silicon Macs. 188 | 189 | ```text 190 | $ /usr/libexec/remotectl 191 | usage: remotectl list 192 | usage: remotectl show (name|uuid) 193 | usage: remotectl get-property (name|uuid) [service] property 194 | usage: remotectl dumpstate 195 | usage: remotectl browse 196 | usage: remotectl echo [-v service_version] [-d (name|uuid)] 197 | usage: remotectl echo-file (name|uuid) path 198 | usage: remotectl eos-echo 199 | usage: remotectl netcat (name|uuid) service 200 | usage: remotectl relay (name|uuid) service 201 | usage: remotectl loopback (attach|connect|detach|suspend|resume) 202 | usage: remotectl bonjour ((enable|enable-loopback interface_name)|(disable)) 203 | usage: remotectl convert-bridge-version plist-in-path bin-out-path 204 | usage: remotectl heartbeat (name|uuid) 205 | usage: remotectl trampoline [-2 fd] service_name command args ... [ -- [-2 fd] service_name command args ... ] 206 | ``` 207 | 208 | Example of the `list` command: 209 | 210 | ```text 211 | $ /usr/libexec/remotectl list 212 | MY_UUID localbridge iBridge2,3 J680AP 5.1 (18P3030/18.16.13030.0.0,0) - 213 | ``` 214 | 215 | Example of the `show` command: 216 | 217 | ```text 218 | $ /usr/libexec/remotectl show MY_UUID 219 | Found localbridge (bridge) 220 | State: connected (connectable) 221 | UUID: MY_UUID 222 | Product Type: iBridge2,3 223 | OS Build: 5.1 (18P3030) 224 | Messaging Protocol Version: 2 225 | Heartbeat: 226 | Last successful heartbeat sent 8.825s ago, received 8.822s ago (took 0.003s) 227 | 64402 heartbeats sent, 0 received 228 | Properties: { 229 | AppleInternal => false 230 | CPUArchitecture => arm64 231 | ChipID => 32786 232 | EffectiveProductionStatusSEP => true 233 | HWModel => J680AP 234 | HasSEP => true 235 | LocationID => MY_LOCATION_ID 236 | IsUIBuild => true 237 | RegionInfo => LL/A 238 | DeviceSupportsLockdown => false 239 | EffectiveSecurityModeAp => true 240 | SigningFuse => true 241 | BuildVersion => 18P3030 242 | OSVersion => 5.1 243 | BridgeVersion => 18.16.13030.0.0,0 244 | SensitivePropertiesVisible => true 245 | BoardRevision => 1 246 | Image4CryptoHashMethod => sha2-384 247 | ProductType => iBridge2,3 248 | SerialNumber => MY_SERIAL_NUMBER 249 | BootSessionUUID => MY_BOOT_SESSION_ID 250 | BoardId => 11 251 | DeviceColor => black 252 | EffectiveProductionStatusAp => true 253 | EffectiveSecurityModeSEP => true 254 | UniqueChipID => MY_UNIQUE_CHIP_ID 255 | UniqueDeviceID => MY_UNIQUE_DEVICE_ID 256 | RemoteXPCVersionFlags => MY_XPC_VERSION_FLAGS 257 | CertificateProductionStatus => true 258 | CertificateSecurityMode => true 259 | DeviceEnclosureColor => black 260 | ModelNumber => Z0V16LL/A 261 | RegionCode => LL 262 | SecurityDomain => 1 263 | OSInstallEnvironment => false 264 | InterfaceIndex => 4 265 | HardwarePlatform => t8012 266 | Image4Supported => true 267 | } 268 | Services: 269 | com.apple.nfcd.relay.uart 270 | com.apple.bridgeOSUpdated 271 | com.apple.videoprocessingd.encode.remote 272 | com.apple.corespeech.xpc.remote.record 273 | com.apple.bootpolicyd.remote.internal 274 | com.apple.icloud.findmydeviced.bridge 275 | com.apple.xpc.remote.mobile_obliteration 276 | com.apple.bootpolicyd.remote 277 | com.apple.eos.BiometricKit 278 | com.apple.osanalytics.logTransfer 279 | com.apple.internal.xpc.remote.kext_audit 280 | com.apple.xpc.remote.multiboot 281 | com.apple.powerchime.remote 282 | com.apple.aveservice 283 | com.apple.recoverylogd.bridge 284 | com.apple.sysdiagnose.stackshot.remote 285 | com.apple.corespeech.xpc.remote.control 286 | com.apple.RestoreRemoteServices.restoreserviced 287 | com.apple.corecaptured.remoteservice 288 | com.apple.nfcd.relay.control 289 | com.apple.mobileactivationd.bridge 290 | com.apple.sysdiagnose.remote 291 | com.apple.CoreKDL.remoteXPC 292 | com.apple.eos.LASecureIO 293 | com.apple.multiverse.remote.bridgetime 294 | com.apple.lskdd 295 | com.apple.private.avvc.xpc.remote 296 | ``` 297 | 298 | ### brctl 299 | 300 | This is a utility related to "CloudDocs", also know as iCloud Drive. 301 | 302 | ```text 303 | $ /usr/bin/brctl 304 | Usage: brctl [command-options and arguments] 305 | 306 | -h,--help show this help 307 | 308 | COMMANDS 309 | 310 | diagnose [options] [--doc|-d ] [] 311 | diagnose and collect logs 312 | 313 | -M,--collect-mobile-documents[=] (default: all containers) 314 | -s,--sysdiagnose Do not collect what's already part of sysdiagnose 315 | -t,--uitest Collect logs for UI tests 316 | -n,--name= Change the device name 317 | -f,--full Do a full diagnose, including server checks 318 | -d,--doc= 319 | Collect additional information about the document at that path. 320 | Helps when investigating an issue impacting a specific document. 321 | -e,--no-reveal Do not reveal diagnose in the Finder when done 322 | [] 323 | Specifies the output path of the diagnosis; -n becomes useless. 324 | 325 | log [options] [] 326 | 327 | -a,--all Show all system logs 328 | -p,--predicate Additional predicate (see `log help predicates`) 329 | -x,--process Filter events from the specified process 330 | -d,--path= Use instead of default 331 | -S,--start="YYYY-MM-DD HH:MM:SS" Start log dump from a specified date 332 | -E,--end="YYYY-MM-DD HH:MM:SS" Stop log dump after a specified date 333 | -b Only show CloudDocs logs 334 | -f Only show FileProvider related logs 335 | -F Only show FruitBasket related logs 336 | -g Only show Genstore related logs 337 | -i Only show SQL and CloudDocs logs 338 | -z,--local-timezone Display timestamps within local timezone 339 | 340 | dump [options] [] 341 | dump the CloudDocs database 342 | 343 | -o,--output= 344 | redirect output to 345 | -d,--database-path= 346 | Use the database at 347 | -i,--itemless 348 | Don't dump items from the db 349 | -u,--upgrade 350 | Upgrade the db if necessary before dumping 351 | 352 | [] the container to be dumped 353 | 354 | status [] 355 | Prints items which haven't been completely synced up / applied to disk 356 | 357 | [] the container to be dumped 358 | 359 | quota 360 | Displays the available quota in the account 361 | 362 | monitor [options] [ ...] 363 | monitor activity 364 | -g dump global activity of the iCloud Drive 365 | -i dump changes incrementally 366 | -S,--scope= 367 | restrict the NSMetadataQuery scope to docs, data, external or a combination 368 | 369 | [ ...] list of containers to monitor, ignored when -g is used 370 | ``` 371 | 372 | A pretty cool command here is a utility to get the quota left on your iCloud Drive: 373 | 374 | ```text 375 | $ /usr/bin/brctl quota 376 | 2098962726220 bytes of quota remaining 377 | ``` 378 | 379 | ### sysadminctl 380 | 381 | Basically an all around useful tool for managing users, as well as manage full-disk encryption (FileVault). 382 | 383 | ```text 384 | $ /usr/sbin/sysadminctl 385 | Usage: sysadminctl 386 | -deleteUser [-secure || -keepHome] (interactive || -adminUser -adminPassword ) 387 | -newPassword -oldPassword [-passwordHint ] 388 | -resetPasswordFor -newPassword [-passwordHint ] (interactive] || -adminUser -adminPassword ) 389 | -addUser [-fullName ] [-UID ] [-GID ] [-shell ] [-password ] [-hint ] [-home ] [-admin] [-roleAccount] [-picture ] (interactive] || -adminUser -adminPassword ) 390 | -secureTokenStatus 391 | -secureTokenOn -password (interactive || -adminUser -adminPassword ) 392 | -secureTokenOff -password (interactive || -adminUser -adminPassword ) 393 | -guestAccount 394 | -afpGuestAccess 395 | -smbGuestAccess 396 | -automaticTime 397 | -filesystem status 398 | -screenLock -password 399 | 400 | Pass '-' instead of password in commands above to request prompt. 401 | '-adminPassword' used mostly for scripted operation. Use '-' or 'interactive' to get the authentication string interactively. This preferred for security reasons 402 | 403 | *Role accounts require name starting with _ and UID in 200-400 range. 404 | ``` 405 | 406 | A pretty useful command in this tool is to check if FileVault is enabled: 407 | 408 | ```text 409 | $ sudo sysadminctl -filesystem status 410 | 2019-10-13 10:16:41.266 sysadminctl[61797:3404423] Boot volume CS FDE: NO 411 | 2019-10-13 10:16:41.298 sysadminctl[61797:3404423] Boot volume APFS FDE: YES 412 | ``` 413 | 414 | ### ckksctl 415 | 416 | CloudKit controls, probably useful for some advanced users. 417 | 418 | ```text 419 | $ /usr/sbin/ckksctl 420 | usage: ckksctl [-p] [-j] [-s] [-v arg] [status] [fetch] [push] [resync] [reset] [reset-cloudkit] [ckmetric] 421 | 422 | Control and report on CKKS 423 | 424 | positional arguments: 425 | 426 | optional arguments: 427 | -p, --perfcounters Print CKKS performance counters 428 | -j, --json Output in JSON format 429 | -s, --short Output a short format 430 | -v arg, --view arg Operate on a single view 431 | 432 | optional commands: 433 | status Report status on CKKS views 434 | fetch Fetch all new changes in CloudKit and attempt to process them 435 | push Push all pending local changes to CloudKit 436 | resync Resync all data with what's in CloudKit 437 | reset All local data will be wiped, and data refetched from CloudKit 438 | reset-cloudkit All data in CloudKit will be removed and replaced with what's local 439 | ckmetric Push CloudKit metric 440 | ``` 441 | 442 | ### otctl 443 | 444 | This is the Octagon Trust utility. It's a pretty neat view of the underlying trust network being used by your Apple Devices. 445 | 446 | ```text 447 | $ /usr/sbin/otctl 448 | usage: otctl [-s arg] [-e arg] [-r arg] [-j] [-i arg] [-E] [-P] [--altDSID arg] [--entropy arg] [--appleID arg] [--dsid arg] [--container arg] [--radar arg] [start] [sign-in] [sign-out] [status] [resetoctagon] [resetProtectedData] [user-controllable-views] [allBottles] [recover] [depart] [er-trigger] [er-status] [er-reset] [er-store] [health] [ckks-policy] [taptoradar] [fetchEscrowRecords] [fetchAllEscrowRecords] [recover-record] [recover-record-silent] 449 | 450 | Control and report on Octagon Trust 451 | 452 | positional arguments: 453 | 454 | optional arguments: 455 | -s arg, --secret arg escrow secret 456 | -e arg, --bottleID arg bottle record id 457 | -r arg, --skipRateLimiting arg enter values YES or NO, option defaults to NO, This gives you the opportunity to skip the rate limiting check when performing the cuttlefish health check 458 | -j, --json Output in JSON 459 | -i arg, --recordID arg recordID 460 | -E, --enable Enable something (pair with a modification command) 461 | -P, --pause Pause something (pair with a modification command) 462 | --altDSID arg altDSID (for sign-in/out) 463 | --entropy arg escrowed entropy in JSON 464 | --appleID arg AppleID 465 | --dsid arg DSID 466 | --container arg CloudKit container name 467 | --radar arg Radar number 468 | 469 | optional commands: 470 | start Start Octagon state machine 471 | sign-in Inform Cuttlefish container of sign in 472 | sign-out Inform Cuttlefish container of sign out 473 | status Report Octagon status 474 | resetoctagon Reset and establish new Octagon trust 475 | resetProtectedData Reset ProtectedData 476 | user-controllable-views Modify or view user-controllable views status (If one of --enable or --pause is passed, will modify status) 477 | allBottles Fetch all viable bottles 478 | recover Recover using this bottle 479 | depart Depart from Octagon Trust 480 | er-trigger Trigger an Escrow Request request 481 | er-status Report status on any pending Escrow Request requests 482 | er-reset Delete all Escrow Request requests 483 | er-store Store any pending Escrow Request prerecords 484 | health Check Octagon Health status 485 | ckks-policy Trigger a refetch of the CKKS policy 486 | taptoradar Trigger a TapToRadar 487 | fetchEscrowRecords Fetch Escrow Records 488 | fetchAllEscrowRecords Fetch All Escrow Records 489 | recover-record Recover record 490 | recover-record-silent Silent record recovery 491 | ``` 492 | 493 | Run the following command to list your peers: 494 | 495 | ```text 496 | $ /usr/sbin/otctl status 497 | ... Lots of Useful Output ... 498 | ``` 499 | 500 | ### spctl 501 | 502 | This is the System Policy management utility. You can enable and disable Gatekeeper and other code-signing features this way. 503 | 504 | ```text 505 | $ /usr/sbin/spctl 506 | System Policy Basic Usage: 507 | spctl --assess [--type type] [-v] path ... # assessment 508 | spctl --add [--type type] [--path|--requirement|--anchor|--hash] spec ... # add rule(s) 509 | spctl [--enable|--disable|--remove] [--type type] [--path|--requirement|--anchor|--hash|--rule] spec # change rule(s) 510 | spctl --status | --master-enable | --master-disable # system master switch 511 | 512 | Developer Mode Usage: 513 | spctl developer-mode 514 | enable-terminal 515 | Add Terminal as a developer tool. 516 | Kernel Extension User Consent Usage: 517 | spctl kext-consent ** Modifications only available in Recovery OS ** 518 | status 519 | Print whether kernel extension user consent is enabled or disabled. 520 | enable 521 | Enable requiring user consent for kernel extensions. 522 | disable 523 | Disable requiring user consent for kernel extensions. 524 | add 525 | Insert a new Team Identifier into the list allowed to load kernel extensions without user consent. 526 | list 527 | Print the list of Team Identifiers allowed to load without user consent. 528 | remove 529 | Remove a Team Identifier from the list allowed to load kernel extensions without user consent. 530 | ``` 531 | 532 | A useful command is to view the status of the system policy assesments: 533 | 534 | ```text 535 | $ /usr/sbin/spctl --status 536 | assessments enabled 537 | ``` 538 | 539 | ### networksetup 540 | 541 | Network setup is pretty much everything network-related minus some wireless stuff. 542 | 543 | ```text 544 | $ /usr/sbin/networksetup 545 | networksetup Help Information 546 | ------------------------------- 547 | Usage: networksetup -listnetworkserviceorder 548 | Display services with corresponding port and device in order they are tried for connecting 549 | to a network. An asterisk (*) denotes that a service is disabled. 550 | 551 | Usage: networksetup -listallnetworkservices 552 | Display list of services. An asterisk (*) denotes that a network service is disabled. 553 | 554 | Usage: networksetup -listallhardwareports 555 | Display list of hardware ports with corresponding device name and ethernet address. 556 | 557 | Usage: networksetup -detectnewhardware 558 | Detect new network hardware and create a default network service on the hardware. 559 | 560 | Usage: networksetup -getmacaddress 561 | Display ethernet (or Wi-Fi) address for hardwareport or device specified. 562 | 563 | Usage: networksetup -getcomputername 564 | Display the computer name. 565 | 566 | Usage: networksetup -setcomputername 567 | Set the computer's name (if valid) to . 568 | 569 | Usage: networksetup -getinfo 570 | Display IPv4 address, IPv6 address, subnet mask, 571 | router address, ethernet address for . 572 | 573 | Usage: networksetup -setmanual 574 | Set the TCP/IP configuration to manual with IP address set to ip, 575 | Subnet Mask set to subnet, and Router address set to router. 576 | 577 | Usage: networksetup -setdhcp [clientid] 578 | Set the TCP/IP configuration to DHCP. You can set the 579 | DHCP client id to the optional [clientid]. Specify "Empty" for [clientid] 580 | to clear the DHCP client id. 581 | 582 | Usage: networksetup -setbootp 583 | Set the TCP/IP configuration to BOOTP. 584 | 585 | Usage: networksetup -setmanualwithdhcprouter 586 | Set the TCP/IP configuration to manual with DHCP router with IP address set 587 | to ip. 588 | 589 | Usage: networksetup -getadditionalroutes 590 | Get additional IPv4 routes associated with 591 | Usage: networksetup -setadditionalroutes [ ]* 592 | Set additional IPv4 routes associated with 593 | by specifying one or more [ ] tuples. 594 | Remove additional routes by specifying no arguments. 595 | If is "", the route is direct to the interface 596 | Usage: networksetup -setv4off 597 | Turn IPv4 off on . 598 | 599 | Usage: networksetup -setv6off 600 | Turn IPv6 off on . 601 | 602 | Usage: networksetup -setv6automatic 603 | Set the service to get its IPv6 info automatically. 604 | 605 | Usage: networksetup -setv6LinkLocal 606 | Set the service to use its IPv6 only for link local. 607 | 608 | Usage: networksetup -setv6manual

609 | Set the service to get its IPv6 info manually. 610 | Specify

and . 611 | 612 | Usage: networksetup -getv6additionalroutes 613 | Get additional IPv6 routes associated with 614 | Usage: networksetup -setv6additionalroutes [ ]* 615 | Set additional IPv6 routes associated with 616 | by specifying one or more [ ] tuples. 617 | Remove additional routes by specifying no arguments. 618 | If is "", the route is direct to the interface 619 | Usage: networksetup -getdnsservers 620 | Display DNS info for . 621 | 622 | Usage: networksetup -setdnsservers [dns2] [...] 623 | Set the DNS servers to [dns2] [...]. Any number of dns servers can be 624 | specified. Specify "Empty" for to clear all DNS entries. 625 | 626 | Usage: networksetup -getsearchdomains 627 | Display Domain Name info for . 628 | 629 | Usage: networksetup -setsearchdomains [domain2] [...] 630 | Set the Domain Name servers to [domain2] [...]. Any number of Domain Name 631 | servers can be specified. Specify "Empty" for to clear all Domain Name entries. 632 | 633 | Usage: networksetup -create6to4service 634 | Create a 6 to 4 service with name . 635 | 636 | Usage: networksetup -set6to4automatic 637 | Set the service to get its 6 to 4 info automatically. 638 | 639 | Usage: networksetup -set6to4manual 640 | Set the service to get its 6 to 4 info manually. 641 | Specify for the relay address. 642 | 643 | Usage: networksetup -getftpproxy 644 | Display FTP proxy (server, port, enabled value) info for . 645 | 646 | Usage: networksetup -setftpproxy 647 | Set FTP proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on. 648 | 649 | Usage: networksetup -setftpproxystate 650 | Set FTP proxy to either or . 651 | 652 | Usage: networksetup -getwebproxy 653 | Display Web proxy (server, port, enabled value) info for . 654 | 655 | Usage: networksetup -setwebproxy 656 | Set Web proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on. 657 | 658 | Usage: networksetup -setwebproxystate 659 | Set Web proxy to either or . 660 | 661 | Usage: networksetup -getsecurewebproxy 662 | Display Secure Web proxy (server, port, enabled value) info for . 663 | 664 | Usage: networksetup -setsecurewebproxy 665 | Set Secure Web proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on. 666 | 667 | Usage: networksetup -setsecurewebproxystate 668 | Set SecureWeb proxy to either or . 669 | 670 | Usage: networksetup -getstreamingproxy 671 | Display Streaming proxy (server, port, enabled value) info for . 672 | 673 | Usage: networksetup -setstreamingproxy 674 | Set Streaming proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on. 675 | 676 | Usage: networksetup -setstreamingproxystate 677 | Set Streaming proxy to either or . 678 | 679 | Usage: networksetup -getgopherproxy 680 | Display Gopher proxy (server, port, enabled value) info for . 681 | 682 | Usage: networksetup -setgopherproxy 683 | Set Gopher proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on. 684 | 685 | Usage: networksetup -setgopherproxystate 686 | Set Gopher proxy to either or . 687 | 688 | Usage: networksetup -getsocksfirewallproxy 689 | Display SOCKS Firewall proxy (server, port, enabled value) info for . 690 | 691 | Usage: networksetup -setsocksfirewallproxy 692 | Set SOCKS Firewall proxy for with and . Turns proxy on. Optionally, specify or for to enable and disable authenticated proxy support. Specify and if you turn authenticated proxy support on. 693 | 694 | Usage: networksetup -setsocksfirewallproxystate 695 | Set SOCKS Firewall proxy to either or . 696 | 697 | Usage: networksetup -getproxybypassdomains 698 | Display Bypass Domain Names for . 699 | 700 | Usage: networksetup -setproxybypassdomains [domain2] [...] 701 | Set the Bypass Domain Name Servers for to [domain2] [...]. Any number of 702 | Domain Name servers can be specified. Specify "Empty" for to clear all 703 | Domain Name entries. 704 | 705 | Usage: networksetup -getproxyautodiscovery 706 | Display whether Proxy Auto Discover is on or off for . 707 | 708 | Usage: networksetup -setproxyautodiscovery 709 | Set Proxy Auto Discovery to either or . 710 | 711 | Usage: networksetup -getpassiveftp 712 | Display whether Passive FTP is on or off for . 713 | 714 | Usage: networksetup -setpassiveftp 715 | Set Passive FTP to either or . 716 | 717 | Usage: networksetup -setautoproxyurl 718 | Set proxy auto-config to url for and enable it. 719 | 720 | Usage: networksetup -getautoproxyurl 721 | Display proxy auto-config (url, enabled) info for . 722 | 723 | Usage: networksetup -setautoproxystate 724 | Set proxy auto-config to either or . 725 | 726 | Usage: networksetup -getairportnetwork 727 | Display current Wi-Fi Network for . 728 | 729 | Usage: networksetup -setairportnetwork [password] 730 | Set Wi-Fi Network to for . 731 | If a password is included, it gets stored in the keychain. 732 | 733 | Usage: networksetup -getairportpower 734 | Display whether Wi-Fi power is on or off for . 735 | 736 | Usage: networksetup -setairportpower 737 | Set Wi-Fi power for to either or . 738 | 739 | Usage: networksetup -listpreferredwirelessnetworks 740 | List the preferred wireless networks for . 741 | 742 | Usage: networksetup -addpreferredwirelessnetworkatindex [password] 743 | Add wireless network named to preferred list for at . 744 | For security type, use OPEN for none, WPA for WPA Personal, WPAE for WPA Enterprise, 745 | WPA2 for WPA2 Personal, WPA2E for WPA2 Enterprise, WEP for plain WEP, and 8021XWEP for 802.1X WEP. 746 | If a password is included, it gets stored in the keychain. 747 | 748 | Usage: networksetup -removepreferredwirelessnetwork 749 | Remove from the preferred wireless network list for . 750 | 751 | Usage: networksetup -removeallpreferredwirelessnetworks 752 | Remove all networks from the preferred wireless network list for . 753 | 754 | Usage: networksetup -getnetworkserviceenabled 755 | Display whether a service is on or off (enabled or disabled). 756 | 757 | Usage: networksetup -setnetworkserviceenabled 758 | Set to either or (enabled or disabled). 759 | 760 | Usage: networksetup -createnetworkservice 761 | Create a service named on port . The new service will be enabled by default. 762 | 763 | Usage: networksetup -renamenetworkservice 764 | Rename to . 765 | 766 | Usage: networksetup -duplicatenetworkservice 767 | Duplicate and name it with . 768 | 769 | Usage: networksetup -removenetworkservice 770 | Remove the service named . Will fail if this is the only service on the hardware port that is on. 771 | 772 | Usage: networksetup -ordernetworkservices <...> 773 | Order the services in order specified. Use "-listnetworkserviceorder" to view service order. 774 | Note: use quotes around service names which contain spaces (ie. "Built-in Ethernet"). 775 | 776 | Usage: networksetup -setMTUAndMediaAutomatically 777 | Set hardwareport or device specified back to automatically setting the MTU and Media. 778 | 779 | Usage: networksetup -getMTU 780 | Get the MTU value for hardwareport or device specified. 781 | 782 | Usage: networksetup -setMTU 783 | Set MTU for hardwareport or device specified. 784 | 785 | Usage: networksetup -listvalidMTUrange 786 | List the valid MTU range for hardwareport or device specified. 787 | 788 | Usage: networksetup -getmedia 789 | Show both the current setting for media and the active media on hardwareport or device specified. 790 | 791 | Usage: networksetup -setmedia [option1] [option2] [...] 792 | Set media for hardwareport or device specified to subtype. Specify optional [option1] and additional options depending on subtype. Any number of valid options can be specified. 793 | 794 | Usage: networksetup -listvalidmedia 795 | List valid media options for hardwareport or device name. Enumerates available subtypes and options per subtype. 796 | 797 | Usage: networksetup -createVLAN 798 | Create a VLAN with name over device with unique tag . A default network service will be created over the VLAN. 799 | 800 | Usage: networksetup -deleteVLAN 801 | Delete the VLAN with name over the parent device with unique tag . If there are network services running over the VLAN they will be deleted. 802 | 803 | Usage: networksetup -listVLANs 804 | List the VLANs that have been created. 805 | 806 | Usage: networksetup -listdevicesthatsupportVLAN 807 | List the devices that support VLANs. 808 | 809 | Usage: networksetup -isBondSupported 810 | Return YES if the specified device can be added to a bond. NO if it cannot. 811 | 812 | Usage: networksetup -createBond <...> 813 | Create a new bond and give it the user defined name. Add the specified devices, if any, to the bond. 814 | 815 | Usage: networksetup -deleteBond 816 | Delete the bond with the specified device-name. 817 | 818 | Usage: networksetup -addDeviceToBond 819 | Add the specified device to the specified bond. 820 | 821 | Usage: networksetup -removeDeviceFromBond 822 | Remove the specified device from the specified bond 823 | 824 | Usage: networksetup -listBonds 825 | List all of the bonds. 826 | 827 | Usage: networksetup -showBondStatus 828 | Display the status of the specified bond. 829 | 830 | Usage: networksetup -listpppoeservices 831 | List all of the PPPoE services in the current set. 832 | 833 | Usage: networksetup -showpppoestatus 834 | Display the status of the specified PPPoE service. 835 | 836 | Usage: networksetup -createpppoeservice [pppoe service name] 837 | Create a PPPoE service on the specified device with the service name specified. 838 | The "pppoe service name" is optional and may not be supported by the service provider. 839 | 840 | Usage: networksetup -deletepppoeservice 841 | Delete the PPPoE service. 842 | 843 | Usage: networksetup -setpppoeaccountname