Category Archives: Mac

在安装fir-cli时出现了如下错误：

$ gem install fir-cli

Fetching: thor-0.20.0.gem (100%)

ERROR: While executing gem ... (Gem::FilePermissionError)

You don't have write permissions for the /Library/Ruby/Gems/2.3.0 directory.

解决办法：


sudo gem install -n /usr/local/bin fir-cli


新的Mac OS 系统 High Sierra连ftp，Telnet等常用的命令都删除了。不可忍。

手动安装：

brew install inetutils


One of the core components of Mac OS X is launchd, and it turns out it can do some cool things.

I particularly like the idea of using QueueDirectories to monitor and act upon files dropped into a directory, without having to run any extra daemons. The files could be uploaded to S3, transcoded to a different video format, gzipped… anything.

Anyway, I recently fell into the launchd documentation, and came out with this write-up. Let me know if you find it useful.

Overview

The first thing that the Mac OS kernel runs on boot is launchd, which bootstraps the rest of the system by loading and managing various daemons, agents, scripts and other processes. The launchd man page clarifies the difference between a daemon and an agent:

In the launchd lexicon, a “daemon” is, by definition, a system-wide service of which there is one instance for all clients. An “agent” is a service that runs on a per-user basis. Daemons should not attempt to display UI or interact directly with a user’s login session. Any and all work that involves interacting with a user should be done through agents.

Daemons and agents are declared and configured by creating .plist files in various locations of the system:

~/Library/LaunchAgents         Per-user agents provided by the user.
/Library/LaunchAgents          Per-user agents provided by the administrator.
/Library/LaunchDaemons         System-wide daemons provided by the administrator.
/System/Library/LaunchAgents   Per-user agents provided by OS X.
/System/Library/LaunchDaemons  System-wide daemons provided by OS X.

Perhaps best of all, launchd is open source under the Apache License 2.0. You can currently find the latest source code on the Apple Open Source site.

launchd as cron

The Mac OS crontab man page says:

Although cron(8) and crontab(5) are officially supported under Darwin,
their functionality has been absorbed into launchd(8), which provides a
more flexible way of automatically executing commands.

Turns out launchd has a simple StartInterval <integer> property, which starts the job every N seconds. However the true cron-like power lies in StartCalendarInterval:

StartCalendarInterval <dictionary of integers or array of dictionary of integers>

This optional key causes the job to be started every calendar interval as
specified. Missing arguments are considered to be wildcard. The semantics
are much like crontab(5).  Unlike cron which skips job invocations when the
computer is asleep, launchd will start the job the next time the computer
wakes up.  If multiple intervals transpire before the computer is woken,
those events will be coalesced into one event upon wake from sleep.

     Minute <integer>
     The minute on which this job will be run.

     Hour <integer>
     The hour on which this job will be run.

     Day <integer>
     The day on which this job will be run.

     Weekday <integer>
     The weekday on which this job will be run (0 and 7 are Sunday).

     Month <integer>
     The month on which this job will be run.

Lets find the shortest example of this in action:

pda@paulbook ~ > grep -rl StartCalendarInterval \
                   /Library/Launch* /System/Library/Launch* | \
                   xargs wc -l | sort -n | head -n1 | awk '{print $2}' | xargs cat

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>com.apple.gkreport</string>
        <key>ProgramArguments</key>
        <array>
                <string>/usr/libexec/gkreport</string>
        </array>
        <key>StartCalendarInterval</key>
        <dict>
                <key>Minute</key><integer>52</integer>
                <key>Hour</key><integer>3</integer>
                <key>WeekDay</key><integer>5</integer>
        </dict>
</dict>
</plist>

Better than cron? Apart from better handling of skipped jobs after system wake, it also supports per-job environment variables, which can save writing wrapper scripts around your cron jobs:

EnvironmentVariables <dictionary of strings>

This optional key is used to specify additional environmental variables to
be set before running the job.

So, anything XML is obviously worse than 0 52 3 * 5 /path/to/command, but launchd is packing more features than cron, so it can pull it off.

launchd as a filesystem watcher

Apart from having an awesome daemon/agent manager, Mac OS X also has an excellent Mail Transport Agent called postfix. There’s a good chance your ISP runs the same software to handle millions of emails every day. We’ll be using it as an example of how launchd can start jobs based on filesystem changes.

Because your laptop isn’t, and shouldn’t be, a mail server, you don’t want postfix running all the time. But when messages are injected into it, e.g. by a script shelling out to /usr/sbin/sendmail or /usr/bin/mail, you want them to be delivered straight away.

Here’s how Mac OS X does it (/System/Library/LaunchDaemons/org.postfix.master.plist):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>org.postfix.master</string>
    <key>Program</key>
    <string>/usr/libexec/postfix/master</string>
    <key>ProgramArguments</key>
    <array>
        <string>master</string>
        <string>-e</string>
        <string>60</string>
    </array>
    <key>QueueDirectories</key>
    <array>
        <string>/var/spool/postfix/maildrop</string>
    </array>
    <key>AbandonProcessGroup</key>
    <true/>
</dict>
</plist>

We’ll start with the simple part. ProgramArguments passes -e 60 to postfix, described thusly:

-e exit_time
              Terminate the master process after exit_time seconds.
              Child processes terminate at their convenience.

So postfix is told to exit after running for 60 seconds. The mystery (to me, earlier today, at least) is how it gets started. It could be on a cron-like schedule, but (a) it isn’t, (b) that would suck, and (c) it would result in delayed mail delivery. It turns out the magic lies in QueueDirectory, which I initially overlooked thinking it was a postfix option. The launchd.plist man page says:

WatchPaths <array of strings>
This optional key causes the job to be started if any one of the listed
paths are modified.

QueueDirectories <array of strings>
Much like the WatchPaths option, this key will watch the paths for
modifications. The difference being that the job will only be started if
the path is a directory and the directory is not empty.

The Launchd Wikipedia page actually goes into more detail:

QueueDirectories
Watch a directory for new files. The directory must be empty to begin with,
and must be returned to an empty state before QueueDirectories will launch
its task again.

So launchd can monitor a directory for new files, and then trigger an agent/daemon to consume them. In this case, the postfix sendmail(1) man page tells us that “Postfix sendmail(1) relies on the postdrop(1) command to create a queue file in the maildrop directory”, and the man page for postdrop(1) tells us that /var/spool/postfix/maildrop is the maildrop queue. launchd sees new mail there, fires up postfix, and then stops it after 60 seconds. This might cause deferred mail to stay deferred for quite some time, but again; your laptop isn’t a mail server.

launchd as inetd

Tranditionally the inetd and later xinetd “super-server daemon” were used to listen on various ports (e.g. FTP, telnet, …) and launch daemons on-demand to handle in-bound connection, keeping them out of memory at other times. Sounds like something launchd could do…

Lets create a simple inetd-style server at ~/Library/LaunchAgents/my.greeter.plist:

<plist version="1.0">
<dict>
  <key>Label</key><string>my.greeter</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/bin/ruby</string>
    <string>-e</string>
    <string>puts "Hi #{gets.match(/(\w+)\W*\z/)[1]}, happy #{Time.now.strftime("%A")}!"</string>
  </array>
  <key>inetdCompatibility</key><dict><key>Wait</key><false/></dict>
  <key>Sockets</key>
  <dict>
    <key>Listeners</key>
    <dict>
      <key>SockServiceName</key><string>13117</string>
    </dict>
  </dict>
</dict>
</plist>

Load it up and give it a shot:

pda@paulbook ~ > launchctl load ~/Library/LaunchAgents/my.greeter.plist
pda@paulbook ~ > echo "My name is Paul." | nc localhost 13117
Hi Paul, happy Friday!

launchd as god!

You can use launchd to ensure a process stays alive forever using <key>KeepAlive</key><true/>, or stays alive under the following conditions.

• SuccessfulExit — the previous run exited successfully (or if false, unsuccessful exit).
• NetworkState — network (other than localhost) is up (or if false, down).
• PathState — list of file paths exists (or if false, do not exist).
• OtherJobEnabled — the other named job is enabled (or if false, disabled).

These can be combined with various other properties, for example:

• WorkingDirectory
• EnvironmentVariables
• Umask
• ThrottleInterval
• StartOnMount
• StandardInPath
• StandardOutPath
• StandardErrorPath
• SoftResourceLimits and HardResourceLimits
• Nice

More?

There’s some more information at developer.apple.com, and the launchd and launchd.plist man pages are worth reading.

link: http://paul.annesley.cc/2012/09/mac-os-x-launchd-is-cool/

打开终端(Terminal)，把下面这行命令贴进去，回车。

这个命令的作用就是在证书验证缓存数据库里面清除globalsign下发的缓存。运行结束重启chrome就可以了。
sqlite3 ~/Library/Keychains/*/ocspcache.sqlite3 ‘DELETE FROM responses WHERE responderURI LIKE “tp://%.globalsign.com/%”;’

安装macOS Sierra后，会发现系统偏好设置的“安全与隐私”中默认已经去除了允许“任何来源”App的选项，无法运行一些第三方应用。

如果需要恢复允许“任何来源”的选项，即关闭Gatekeeper，请在终端中使用spctl命令：

久违的“任何来源”回来了：

需要说明的是，如果在系统偏好设置的“安全与隐私”中重新选中允许App Store 和被认可的开发者App，即重新打开Gatekeeper后，允许“任何来源”App的选项会再次消失，可运行上述命令再次关闭Gatekeeper。

更新了 Mac OS X 11后发现，MacVim 不再能够通过Terminal用命令打开了。

mvim hello.txt

于是尝试将 mvim 重新复制到/usr/bin/中去

sudo cp -f mvim /usr/bin/

然而出现了权限问题：

cp: /usr/bin/mvim: Operation not permitted

搜索之后发现，是El Capitan 加入了Rootless机制，不再能够随心所欲的读写很多路径下了。设置 root 权限也不行。

Rootless机制将成为对抗恶意程序的最后防线

于是尝试关闭 Rootless。重启按住 Command+R，进入恢复模式，打开Terminal。

csrutil disable

重启即可。如果要恢复默认，那么

csrutil enable

附录:

csrutil命令参数格式：

csrutil enable [–without kext | fs | debug | dtrace | nvram][–no-internal]

禁用：csrutil disable

（等同于csrutil enable –without kext –without fs –without debug –without dtrace –without nvram）

其中各个开关，意义如下：

• B0: [kext] 允许加载不受信任的kext（与已被废除的kext-dev-mode=1等效）
• B1: [fs] 解锁文件系统限制
• B2: [debug] 允许task_for_pid()调用
• B3: [n/a] 允许内核调试 （官方的csrutil工具无法设置此位）
• B4: [internal] Apple内部保留位（csrutil默认会设置此位，实际不会起作用。设置与否均可）
• B5: [dtrace] 解锁dtrace限制
• B6: [nvram] 解锁NVRAM限制
• B7: [n/a] 允许设备配置（新增，具体作用暂时未确定）

link: http://www.jianshu.com/p/22b89f19afd6

MAC下显示系统隐藏目录和文件

终端输入：

sudo chflangs nohidden [文件名或目录名]

要恢复隐藏属性：

sudo chflags hidden [文件名或目录名]