Vaughn Miller vmiller

Greetings, MacAdmins campers! 🏕️

You’ll find everything you need in these workshop resources. Keep this page handy!

Download a copy of the presentation slides and notes

Welcome!
What you’ll need for today

brew is a bad neighbor

This isn't a guide about locking down homebrew so that it can't touch the rest of your system security-wise.

This guide doesn't fix the inherent security issues of a package management system that will literally yell at you if you try to do something about "huh, maybe it's not great my executables are writeable by my account without requiring authorization first".

But it absolutely is a guide about shoving it into its own little corner so that you can take it or leave it as you see fit, instead of just letting the project do what it likes like completely taking over permissions and ownership of a directory that might be in use by other software on your Mac and stomping all over their contents.

By following this guide you will:

Never have to run sudo to forcefully change permissions of some directory to be owned by your account

	#!/usr/local/munki/munki-python

	import argparse
	import os
	import pathlib
	import plistlib
	import pprint
	import pwd
	import subprocess
	from time import sleep

	CC=gcc
	CFLAGS=
	SIGNINGIDENTITY="insert signing identity here"
	IDENTIFIER=com.someorg.fudo.changeme


	fudo: main.c
	$(CC) -o fudo main.c
	codesign -s $(SIGNINGIDENTITY) -i $(IDENTIFIER) fudo

	#!/bin/bash

	<<ABOUT_THIS_SCRIPT
	-----------------------------------------------------------------------

	Written by:William Smith
	Professional Services Engineer
	Jamf
	bill@talkingmoose.net
	https://gist.github.com/talkingmoose/9faf50deaaefafa9a147e48ba39bb4b0

	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
	<plist version="1.0">
	<dict>
	<key>OnDemand</key>
	<true/>
	<key>RestartAction</key>
	<string>RequireRestart</string>
	<key>_metadata</key>
	<dict>

	#!/usr/bin/python

	import platform
	import plistlib
	import subprocess
	from distutils.version import LooseVersion

	def get_os_version():
	'''Return OS version.'''
	return LooseVersion(platform.mac_ver()[0])

	'''Check MDM install status'''

	import subprocess
	import plistlib
	import sys

	def fact():
	'''Check MDM install status'''
	cmd = ['/usr/bin/profiles', '-C', '-o', 'stdout-xml']
	run = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

	#!/usr/bin/python

	"""
	Removes cached apple updates that are older than 24 hours
	"""

	import datetime
	import os
	import shutil
	import sys