rules-macos

killall Finder/Dock/SystemUIServer/WindowServer restarts core parts of the user's active GUI session — closing windows, dropping unsaved state, or logging the user out (WindowServer/loginwindow). Avoid restarting UI services on a machine in use; if a preference change needs to take effect, let the user relaunch the app themselves.

'defaults write -g / NSGlobalDomain' changes a preference for every application and the whole login session, not a single app. Scope the write to a specific bundle id (e.g. 'defaults write com.apple.dock <key>') so the change stays contained and reversible.

Tapping a third-party Homebrew repo from an arbitrary URL, installing a formula/cask directly from a URL or local .rb, or '--HEAD' builds run unreviewed install code outside the audited homebrew-core/homebrew-cask channels. This bypasses the formula review that protects against dependency tampering.

Committing .DS_Store leaks Finder window state and local folder structure into history and churns diffs for every collaborator. Add '.DS_Store' to a global gitignore (git config --global core.excludesfile ~/.gitignore_global) and stage files explicitly rather than with a wildcard.

Staging macOS code-signing material (.p12 identities, .mobileprovision/.provisionprofile, .cer, .certSigningRequest, exported keychains) writes private signing keys into git history, where they are effectively permanent and may reach a public remote. Keep signing assets out of the repo and reference them from the keychain or CI secrets.

Xcode per-user state (*.xcuserstate, xcuserdata/) is machine-local UI state, not source. Committing it produces noisy, conflict-prone diffs. Add 'xcuserdata/' and '*.xcuserstate' to .gitignore.

Uploading local files to an external host (curl -T / --upload-file / -F file=@, scp/rsync to a remote target, or AppleScript-driven curl POST) is a data-exfiltration pattern. Confirm the destination is a trusted, intended endpoint and that the data is authorized to leave this machine.

diskutil eraseDisk / deleteContainer / partitionDisk irreversibly destroys a volume or APFS container and every file on it. There is no undo and no Trash. Verify the target identifier (diskutil list) and confirm a backup exists before any erase.

Running 'installer -pkg' on a package from /tmp, ~/Downloads, /var/folders, or a URL executes its preinstall/postinstall scripts as root with no Gatekeeper notarization check. Trojanized .pkg installers are the top macOS supply-chain infection vector. Verify the package signature first: 'pkgutil --check-signature <pkg>'.

Browser cookie and login databases (Safari Cookies, Chrome Cookies / Login Data, Firefox cookies.sqlite) contain live session tokens and saved passwords. Reading them lets a session be hijacked without the password — a primary macOS infostealer objective.

Cloud and registry credential files (~/.aws/credentials, gcloud, ~/.npmrc, ~/.netrc, ~/.docker/config.json, ~/.kube/config) hold long-lived access tokens and API keys. Reading them exposes credentials that grant access to production infrastructure and private registries.

The AddressBook/Contacts store holds names, phone numbers, emails, and addresses of everyone the user knows. Reading it harvests third-party PII that those contacts never consented to share with an agent.

The macOS keychain files (~/Library/Keychains/login.keychain-db, /Library/Keychains/System.keychain) hold every saved password, certificate, and private key on the machine. Reading or copying these files wholesale is a credential-theft technique used by macOS stealers. Fetch one specific item with the 'security' CLI under user consent instead.

~/Library/Messages/chat.db is the full iMessage/SMS history — every conversation, phone number, and attachment. This is highly sensitive personal communication protected by TCC. Reading it is a surveillance / data-collection technique.

The Photos library (~/Pictures/Photos Library.photoslibrary, Photos.sqlite) contains personal images plus EXIF GPS location and face-recognition metadata. Reading it collects sensitive personal, location, and biometric data.

Safari browsing history (~/Library/Safari/History.db) and the Mail store (~/Library/Mail) reveal visited sites, searches, and private email content. This is personal activity data that an agent should not collect.

Reverse-shell patterns (an interactive shell over /dev/tcp, nc/ncat -e, mkfifo piped into nc) open an outbound connection that hands a remote host a live shell on this Mac. This is the canonical command-and-control and exfiltration foothold. Only proceed for an authorized, scoped penetration test.

Recursive force-delete of a macOS system root (/, /System, /Library, /Applications, /Users, ~/Library) destroys the OS or the user's entire app and preferences state. SIP protects some of these, but ~/Library and /Applications are not protected. Target a specific subdirectory, never the root.

Secure-erase tools (srm, rm -P, diskutil secureErase) overwrite data so it is unrecoverable even with forensic tooling. This is irreversible by design — a normal delete is recoverable from backups; a secure erase is not.

Querying or copying the personal-data SQLite stores (chat.db, History.db, AddressBook, Photos.sqlite, Cookies) via the shell extracts private messages, browsing history, contacts, or photo metadata. This is a data-collection technique.

Installing global packages as root (sudo gem/pip/npm -g) runs each dependency's arbitrary install scripts as root and writes into the system Ruby/Python/Node that macOS itself depends on. A single malicious transitive dependency gets root. Use a user-space version manager (rbenv, pyenv/venv, nvm/Volta) instead of sudo.

Homebrew must never run under sudo — it chowns /opt/homebrew (or /usr/local) to root and breaks every later non-sudo 'brew' command; Homebrew itself refuses to run as root. Run 'brew' as the normal user. A formula that needs elevation will request it itself.

tmutil delete / deletelocalsnapshots permanently removes Time Machine backups and local APFS snapshots — destroying the recovery point a user would rely on after data loss. Deleting backups is a ransomware-style inhibit-recovery technique.

allow-jit and allow-unsigned-executable-memory weaken W^X enforcement in the Hardened Runtime. Only enable for genuine JIT engines (JavaScriptCore/V8); otherwise leave false to block shellcode execution.

Broad Apple Events / automation entitlements let the app script Finder, Mail, and other apps — the exact surface exploited by CVE-2025-43530 VoiceOver TCC bypass. Prefer a narrowly scoped NSAppleEventsUsageDescription and target-specific com.apple.security.scripting-targets.

Disabling app-sandbox removes the primary macOS application isolation layer. Setting get-task-allow=true enables code injection for debugging but must never ship in production.

csrutil disable turns off System Integrity Protection (SIP), which prevents modification of protected system files and kernel extensions. Never disable SIP in production — it is the primary macOS rootkit defense.

Piping curl/wget output directly to a shell executes unverified remote code — a prevalent macOS infostealer (AMOS, Odyssey) infection vector in 2025. Download to a file, inspect/verify checksum, then execute.

Disabling the macOS application firewall or packet filter exposes all ports to network access. Keep the firewall enabled, especially on untrusted networks.

Disabling library validation or executable page protection defeats the Hardened Runtime and enables dylib hijacking / code injection (CVE-2024-44243-class). Ship only with these entitlements false; if a plugin host truly needs them, scope narrowly and notarize.

Disabling Gatekeeper allows execution of unsigned and unnotarized apps from anywhere, removing Apple's code signing verification. Keep Gatekeeper enabled and use Developer ID signing for trusted apps.

Modifying /etc/hosts to redirect Apple or iCloud domains blocks security updates, certificate validation, and Apple services. This can prevent critical system updates from installing.

Exporting the full keychain or extracting passwords via security CLI dumps sensitive credentials including certificates, private keys, and passwords.

Writing a LaunchDaemon/LaunchAgent in /Library/ installs persistence that runs for all users or as root at boot. This is a common macOS malware persistence technique.

Unloading macOS security LaunchDaemons (trustd, syspolicyd, Quarantine) disables critical security services. These should never be unloaded in production environments.

Clearing NVRAM or setting insecure boot-args (-s single user, -x safe mode) can bypass security policies set at firmware level. This requires a reboot and affects startup security.

osascript 'do shell script ... with administrator privileges' prompts for credentials and runs commands as root — a common macOS privilege escalation technique. Use sudo with proper authorization instead.

NSAllowsArbitraryLoads disables ATS (App Transport Security) and allows insecure HTTP connections. This is rejected by App Store review and exposes data in transit. Remove this key or use specific domain exceptions.

LaunchAgent/Daemon plists with world-writable permissions or scripts from /tmp are common local privilege escalation vectors. Use mode 644 for plists owned by root.

Stripping com.apple.quarantine bypasses Gatekeeper's notarization and malware scan on downloaded binaries — Apple flags this as a standard malware install step. Only remove quarantine after verifying the binary's signature with 'codesign --verify'.

Enabling Remote Login (SSH) exposes the Mac to network-based credential attacks and is a common post-exploitation foothold. Leave SSH disabled unless required and restrict via pf/firewall if enabled.

Injecting network/reverse-shell commands into shell profiles (.zshrc/.bash_profile) is a ChillyHell backdoor persistence pattern. Shell rc files should only contain aliases, env vars, and PATH — not network calls.

tccutil reset clears all Transparency, Consent, and Control (TCC) privacy permissions — camera, microphone, location, contacts, etc. This affects all apps and requires users to re-grant permissions.

Per-user LaunchAgents in ~/Library/LaunchAgents are the top macOS persistence technique used by AMOS, ChillyHell, and Odyssey stealers in 2025. Confirm this persistence is legitimate and documented.