Manage Gatekeeper from the Command Line in Mountain Lion

Gatekeeper is the new feature of OS X that controls what types of apps can be opened. To configure Gatekeeper, open the Security & Privacy System Preference pane. Click on the General tab and unlock to make changes. Here, you’ll see “Allow applications downloaded from:” along with the following 3 options:
  • Mac App Store: Only apps downloaded from the App Store can be opened.
  • “Mac App Store and identified developers”: Only apps downloaded from the App Store and those signed can be opened.
  • Anywhere: Any app can be opened.
Configuring Gatekeeper in Mountain Lion
Configuring Gatekeeper is as easy as selecting one of these options. Now, under the hood, the state of Gatekeeper is kept in /var/db/SystemPolicy-prefs.plist. There’s only one option there, though: enabled. So you could try and run defaults to disable Gatekeeper: defaults write /var/db/SystemPolicy-prefs enabled no. However, doing so is not really going to provide all the options available in the GUI. To configure the options, Apple has provided spctl, a command line tool used to manage Gatekeeper. In it’s simplest form, Gatekeeper can be enabled using the –master-enable and –master-disable options, which are pretty straight forward. Use –master-enable to enable Gatekeeper: spctl --master-enable And then use –master-disable to disable Gatekeeper: spctl --master-disable Whether Gatekeeper (assessments) is enabled or disabled can be returned using the –status option: spctl --status The -a option is used to assess an application to see if it will open or not: spctl -a /Applications/ If an application passes and has a rule available then you’ll get no response. If there’s no rule for the application, you’ll get a response that: /Applications/ unknown error 99999=1869f You add rules about apps using the –add option. Each app gets a label, defined with the –label option. For example, to add GitHub: spctl --add --label "GitHub" /Applications/ To then enable access to GitHub: spctl --enable --label "GitHub" Or disable: spctl --disable --label "GitHub" As with most things, there’s actually a rub. spctl doesn’t always work. I’ve had more than a few issues with getting the labels to apply just right. Sometimes the -a will report back that an app is rejected and it will still open. I think this is first gen technology and that prior to relying on it that it would be a really good idea to test very thoroughly before deploying.

Notification Center, Mountain Lion and Me

I love Notification Center on my phone. I think it’s great to receive a simple list of items that have changed since the last time I looked at the phone.  I can also quickly dismiss the screen so the fact that there’s often 20 or more items in the list when I’ve been sitting at my computer for 10 minutes and not looking at the phone doesn’t really bum me out much. In Mountain Lion, Notification Center comes to the Mac. What I’ve grown to love on the iPhone, I’m not sold on for OS X. You see, the alerts that pop up on the screen are great for a phone, because if you’re looking at your phone (hopefully not while driving) then you’re likely multitasking. Since most mobile solutions are so great for multi-tasking, many of us have gotten used to multi-tasking on our mobile devices and then plugging into a keyboard when we need to do something that requires focus. Or at least that’s my workflow. By default, Notification Center assumes the same level of multi-tasking is done on desktops as on mobile devices.  But with some tuning, Notification Center can be even more useful. For example, when I’m writing I like to cut down the distractions. Doing so helps me to stay focused. And when I’m trying to keep the distractions down, there are certain things that should still jar me out of my otherwise focused state. By default, Notification Center pops up alerts on my screen that tell me that things have happened with some of my apps, such as I got an email, a calendar event is prompting or there was a tweet about me. But Notification Center allows me to configure what kinds of alerts I want to see. For example, I might want an alert about a Reminder to come through and not have tweets pop up on my screen while I’m writing. To disable one of the applications allowed to pop up an alert on the screen, open the Notifications System Preference pane and find the application in the list provided. Then select None to disable notifications. The default setting for each app is to provide what is known as a Banner. A Banner is a prompt that informs users that an event has occurred with a supported app and then goes away. You can also set each app to provide an Alert, which is a banner that doesn’t go away on its own but must be clicked on to disappear. You can also configure options that make Notifications a little more useful. These are configured per app and include the following:
  • Show in Notification Center: Indicates the number of items for each app that are shown in the Notification Center at a time. The default is 5 and this shows you, for example, the subject, sender and first few lines of emails or the name and sender of Tweets that have information about you.
  • Badge app icon: Removes the red indicator for each app. For example, when unchecked for mail you’ll no longer see how many unread emails you have.
  • Play sound when receiving notifications: Enables an audible alert (ding, ding) that a notification is waiting for you.
Overall, I think it’s really awesome that I now have a feature that is very iOS-centric sitting right here on my Mac. I do think it’s a bit verbose by default, but then, that’s my workflow – the developers are probably targeting the people who feel multi-tasking is healthy on every single computing device you touch. I don’t necessarily agree, but I dig it anyway. So me and my 2 apps that still have notifications enable are going to use this feature, if a bit less verbosely than most!