Category: Tricks And Tips

  • To install macOS Mojave, or not to?

    InstallMojave

    Just the other day macOS Mojave was released and now the armies of Macs armed only with the AppStore are silently downloading the installer and ready to upgrade. You can’t hurry too fast to be on the bleeding edge, hurry faster!

    Just in case you don’t want everyone to install macOS 10.14.0 (dot zero!) in the first week of its release here’s a way to slow down the upgrade hordes using Erik Berglund’s AppBlocker script. Erik Berglund is also the author of ProfileCreator (for creating profiles) and the author of many other great scripts.

    Note: for true binary whitelisting check out Google’s Santa project and Upvote (and Moroz and Zentral, two other Santa sync servers).

    Step 1. Get it

    Clone or download the AppBlocker project from GitHub

    AppleBlockerProject.png

    Step 2. Do it

    Edit the AppBlocker.py script with the Bundle Identifier of your app to block, in this case for the Mojave installer from the AppStore it is:

    com.apple.InstallAssistant.Mojave

    You can also edit the alert message, and the icon that is shown, as well as decide if the blocked app should be deleted or not. The script is easy to edit in BBEdit, or nano (in Terminal). Use whatever your favorite text editor is to make the necessary changes.

    # List of all blocked bundle identifiers. Can use regexes.
    blockedBundleIdentifiers = ['com.apple.InstallAssistant.Mojave']
    
    # Whether the blocked application should be deleted if launched
    deleteBlockedApplication = False
    
    # Whether the user should be alerted that the launched applicaion was blocked
    alertUser = True
    
    # Message displayed to the user when application is blocked
    alertMessage = "The application \"{appname}\" has been blocked by IT"
    alertInformativeText = "Contact your administrator for more information"
    
    # Use a custom Icon for the alert. If none is defined here, the Python rocketship will be shown.
    alertIconPath = "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/Actions.icns"

    UPDATED NOTE:

    To determine the Bundle identifier of other applications you can use osascript

    osascript -e 'id of app "iTunes"'
    com.apple.iTunes

    If you want to block more than one app use a comma separated list in the AppBlocker.py script:

    ['com.apple.InstallAssistant.Mojave','com.apple.iTunes']

     

    Step 3. Run it

    Put the script where you want to run it. The default location as defined in the launchd plist included with the app is “/usr/local/bin”. Put the launchd.plist in “/Library/LaunchDaemons/” and start up your launchd to block your apps!

    launchctl load /Library/LaunchDaemons/com.github.erikberglund.AppBlocker.plist

    Step 4. Automate it

    For bonus points we automate! Bundle it all up in a package with munkipkg, then distribute it with Munki to all your clients.

    Using munkipkg is easy. Create the folder using munkipkg

    ./munkipkg --create AppBlocker
    
    munkipkg: Created new package project at AppBlocker

    Then you fill the payload folders with those items you downloaded from the AppBlocker project. LauchD plist in the LaunchDaemons folder and AppBlocker.py in the “usr local bin” (create each nested folder).

    AppBlocker-Munkipkg3.png

    And finally create a post install script (no “.sh”) with the launchctl action to start your plist.

    AppBlocker-Munkipkg4.png

    Last but not least add this package to your Munki repo as an unattended managed install  that everyone gets. Of course, only do this after testing your package locally somewhere to verify that it works properly. Remember the saying: “You may not test very often, but when you do it’s always in production.” Be very careful with your testing but always automate all the things.

    Updated after the initial blog post to explain how to add more than one app to block, and how to use osascript to determine the bundle identifier.

     

     

     

  • Screen recording and other tricks

    QuickTime has a neat little trick that some may not know about, it can record your screen.

    QT-ScreenRecord

    Use it to record a how-to video how to navigate System Preferences, or how to use Final Cut Pro, or record a MacDevOps:YVR talk.

    The first two MacDevOps:YVR conferences needed to be converted to a suitable format for YouTube and using QuickTime screen recording + Soundflower is the way I chose to do it.

    Note: Soundflower is needed to redirect the audio to QuickTime. Screenrecording with QuickTime does not capture the audio without Soundflower.

    MacDevOps Screen recording steps

    1. Install Soundflower (Soundflower-2.0b2.dmg)

    https://github.com/mattingalls/Soundflower/releases/tag/2.0b2

    1. Set audio output to SoundFlower 2chSoundFlower
    2. Set QT screen recording to Soundflower audio QT-ScreenRecord-SoundFlower-2ch
    3. Start screen recording (select screen area)
    4. Play website audio / video (Safari / Other )
    5. Stop both. Edit and trim QT video as needed
    6. Upload to YouTube
    7. Tag video (mdoyvr, yvr, MacDevOps, MacAdmin, MacIT), put in proper playlist
    8. Publish

    Addendum:

    I own Rogue Amoeba’s excellent Audio Hijack application and have used this app for audio capture (podcast interviews, etc), but I couldn’t get it to work in this case. It might have also required their Rogue Amoeba’s Loopback app which I did not own. Since I’ve used Soundflower previously I used it here in this case.

     

  • Umask fixes in Yosemite aka OS X 10.10.3 and shared storage

    Finally!

    Yes, Apple has restored the ability to set a user and system umask in OS X 10.10.3. This is a huge fix for users of shared storage. Xsan and all SANs where users want to be able to share files, projects and all things without using ACLs or any LDAP directory. This is great. I am jumping up and down. So happy. So many people wanted this. Anyone using shared storage have been demanding this since the upgrade to Yosemite. 10.10.3 is out today and we will be happy.

    Reference: https://support.apple.com/en-us/HT201684

    tl;dr

    sudo launchctl config user umask nnn

    and

    sudo launchctl config system umask nnn