Using the spctl Command in macOS (with examples)

The spctl command is a handy utility for managing the Gatekeeper feature in macOS. Gatekeeper is a security feature that helps protect your Mac from running malicious software by ensuring that only trusted applications from identified developers are allowed to run on your system. By using the spctl command, you can control and modify the Gatekeeper settings to suit your needs.

In this article, we will explore different use cases of the spctl command and provide code examples for each use case. We will cover turning off Gatekeeper, adding a rule to allow an application to run, turning on Gatekeeper, and listing all the rules on the system.

1: Turning Off Gatekeeper

To turn off Gatekeeper, use the following command:

spctl --master-disable

Motivation: You may want to turn off Gatekeeper temporarily to run an application from an unknown developer or source without any restrictions. This can be useful when testing or running software from a source that is not yet identified as a trusted developer.

Explanation: The --master-disable argument is used to disable Gatekeeper. This command allows all applications to run on your Mac, regardless of their developer or source.

Example Output:

Gatekeeper disabled.

2: Adding a Rule to Allow an Application to Run

To add a rule that allows an application to run, use the --add argument followed by the --label argument (optional) and the path to the file:

spctl --add --label rule_name path/to/file

Motivation: Sometimes, you may encounter an application that is blocked by Gatekeeper even though you trust its source. In such cases, you can add a rule to allow that specific application to run without disabling Gatekeeper entirely.

Explanation: The --add argument is used to add a rule to allow an application to run. The --label argument is optional and allows you to provide a name or label for the rule. The path/to/file argument should be replaced with the actual path to the application or file you want to allow.

Example Output:

Rule added for path/to/file.

3: Turning On Gatekeeper

To turn on Gatekeeper, use the following command:

spctl --master-enable

Motivation: After performing tasks that require turning off Gatekeeper temporarily, it is important to re-enable Gatekeeper to ensure the security of your Mac. By turning on Gatekeeper, you reinstate the protection provided by Gatekeeper and allow only trusted applications to run on your system.

Explanation: The --master-enable argument is used to enable Gatekeeper. Once turned on, Gatekeeper will enforce its security restrictions and only allow trusted applications to run on your Mac.

Example Output:

Gatekeeper enabled.

4: Listing All Rules on the System

To list all the rules currently set on your system, use the following command:

spctl --list

Motivation: It can be helpful to know which rules are currently in place on your system, especially if you have added custom rules to allow specific applications to run. Listing all the rules allows you to review and manage them if needed.

Explanation: The --list argument is used to display a list of all the rules set on your system. This command provides details about each rule, such as the rule’s label, source, and whether it allows or denies an application to run.

Example Output:

CustomRule1: allowed
CustomRule2: allowed
AppleRule1: denied

Now that we have explored the different use cases of the spctl command, you can leverage its functionality to manage the Gatekeeper settings according to your needs. Whether you want to temporarily turn off Gatekeeper, add custom rules, turn it back on, or review the existing rules, the spctl command provides the necessary flexibility to manage Gatekeeper with ease.