pudquick

brew is a bad neighbor

This isn't a guide about locking down homebrew so that it can't touch the rest of your system security-wise.

This guide doesn't fix the inherent security issues of a package management system that will literally yell at you if you try to do something about "huh, maybe it's not great my executables are writeable by my account without requiring authorization first".

But it absolutely is a guide about shoving it into its own little corner so that you can take it or leave it as you see fit, instead of just letting the project do what it likes like completely taking over permissions and ownership of a directory that might be in use by other software on your Mac and stomping all over their contents.

By following this guide you will:

• Never have to run sudo to forcefully change permissions of some directory to be owned by your account

homebysix

#!/usr/bin/env python3

"""Given the path to a Markdown-formatted change log, this script will update
the diff links for each version at the bottom of the document. For an example
of the diff links, see: https://keepachangelog.com

Currently only supports GitHub, GitLab, and Bitbucket diff links.
"""

pudquick

# https://developer.apple.com/documentation/corefoundation/3684868-cfbundleisarchitectureloadable?language=objc
# https://developer.apple.com/documentation/foundation/1495005-mach-o_architecture?language=occ
# https://developer.apple.com/documentation/foundation/1495005-mach-o_architecture/nsbundleexecutablearchitecturearm64?language=occ

from Foundation import NSBundle
import objc
CF = NSBundle.bundleWithPath_('/System/Library/Frameworks/CoreFoundation.framework')
f = [('CFBundleIsArchitectureLoadable', 'BQ')]
objc.loadBundleFunctions(CF, globals(), f)
NSBundleExecutableArchitectureARM64 = 0x0100000c

talkingmoose

#!/bin/sh

<<ABOUT_THIS_SCRIPT
-----------------------------------------------------------------------
	Written by: William Smith
	Professional Services Engineer
	Jamf
	[email protected]
	https://github.com/talkingmoose/Jamf-Scripts
	

erikng

seedutil

Enroll macOS Beta Seed without profile installation

Usage

$ sudo /System/Library/PrivateFrameworks/Seeding.framework/Versions/A/Resources/seedutil 
usage: seedutil enroll SEED_PROGRAM
    seedutil unenroll

seedutil current

pudquick

# This was all run from user space
# I haven't tested it with root
# ... but it didn't prompt for any permissions under userspace ^_^
# Tested on 10.11.5

import objc
from Foundation import NSBundle
EAP8021X_bundle = NSBundle.bundleWithPath_('/System/Library/PrivateFrameworks/EAP8021X.framework')
Security_bundle = NSBundle.bundleWithIdentifier_('com.apple.security')

erikng

import objc
from Foundation import NSBundle

IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')

functions = [("IOServiceGetMatchingService", b"II@"),
             ("IOServiceMatching", b"@*"),
             ("IORegistryEntryCreateCFProperty", b"@I@@I"),
            ]

feelinc

#!/usr/bin/python

import os
import sys
import boto3

# get an access token, local (from) directory, and S3 (to) directory
# from the command-line
local_directory, bucket, destination = sys.argv[1:4]

pudquick

#!/usr/bin/python

# As written, this requires the following:
# - OS X 10.6+ (may not work in 10.10, haven't tested)
# - python 2.6 or 2.7 (for collections.namedtuple usage, should be fine as default python in 10.6 is 2.6)
# - pyObjC (as such, recommended to be used with native OS X python install)

# Only tested and confirmed to work against 10.9.5
# Run with root