Imre kasutab arvutit - Kasutaja kaastöö [et]

Apple Container

2026-09-21T05:31:36Z

Imre: /* Uuendamine */

===Sissejuhatus===

Apple Container https://github.com/apple/container on MacOS töökohaarvutis kasutamiseks mõeldud virtualiseerimise lahendus.

===Tööpõhimõte===

TODO

Väited

* apple-container lahendus võimaldab kasutada amd64 ja arm64 virtuaalset arvutit
* virtuaalne arvuti võib esineda nii nö oci-konteineri kujul kui täielise virtuaalse arvuti kujul
* paigaldamine toimub kasutajana root
* container lahenduse käivitmaine toimub tavakasutajana

Lahenduse töötamist kirjeldab selline joonis

[[Fail:20260812-apple-container-02.png|800px]]

kus

* keskne komponent on container-apiserver - ühel pool teda on container haldusprogramm (klient) ja teisel pool pluginad - kõik kolm töötavad tavakasutaja privileegides
* pluginate abil käivitatakse virtuaalne arvuti ja selle külge kuuluv konteiner, seadistatakse võrk, tegeldaks tõmmistega jne
* pluginaid aitavad privilegeeritud helperid - helperite kätega tehakse nö kernel kihis muudatused (nt virtuaalse võrguliidese moodustamine ja bridge külge kinnitamine)
* privilegeerimata pluginad suhtlevad privilegeeritud helperitega üle nö xpc kanali ja kasutades macos iseloomulikke nn mach porte (see on teatud tüüpi ipc - interprocess communication)

Võrgujoonis

[[Fail:20260812-apple-container-03.png|1000px]]

kus

* TODO

===Paigaldamine===

TODO

Kopeerimiseks sobib öelda

<pre>
Imres-MacBook-Air:20260809 root# curl -L --output container-1.2.2-installer-signed.pkg https://github.com/apple/container/releases/download/1.2.2/container-1.2.2-installer-signed.pkg
</pre>

Kontrollimiseks

<pre>
Imres-MacBook-Air:20260809 root# pkgutil --check-signature /Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg
Package "container-1.2.2-installer-signed.pkg":
Status: signed by a developer certificate issued by Apple for distribution
Notarization: trusted by the Apple notary service
Signed with a trusted timestamp on: 2026-08-08 01:47:20 +0000
Certificate Chain:
1. Developer ID Installer: Apple Inc. - Containerization (UPBK2H6LZM)
Expires: 2030-06-04 16:44:29 +0000
SHA256 Fingerprint:
45 19 B4 3D 00 F5 5E C6 31 38 D4 03 DE 1F 3C 54 23 90 EA E3 D8 2E
59 C1 84 38 46 FB DF E1 4F 5B
------------------------------------------------------------------------
2. Developer ID Certification Authority
Expires: 2031-09-17 00:00:00 +0000
SHA256 Fingerprint:
F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F
D1 44 71 5F 35 06 43 D2 DF 3A
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
SHA256 Fingerprint:
B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
68 C5 BE 91 B5 A1 10 01 F0 24

Imres-MacBook-Air:20260809 root# spctl -a -t install -v /Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg
/Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg: accepted
source=Notarized Developer ID
</pre>

Paigaldamiseks

<pre>
Imres-MacBook-Air:20260809 root# installer -pkg container-1.2.2-installer-signed.pkg -target /
installer: Package name is container-1.2.2-installer-signed
installer: Installing at base path /
installer: The install was successful.
</pre>

Failisüsteemi tekivad

<pre>
imreoolberg@Imres-MacBook-Air ~ % pkgutil --pkgs | grep conta
com.apple.container-installer

imreoolberg@Imres-MacBook-Air ~ % pkgutil --files com.apple.container-installer --only-files
bin/container
bin/container-apiserver
bin/uninstall-container.sh
bin/update-container.sh
libexec/container/plugins/container-core-images/bin/container-core-images
libexec/container/plugins/container-core-images/config.toml
libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet
libexec/container/plugins/container-network-vmnet/config.toml
libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux
libexec/container/plugins/container-runtime-linux/config.toml
libexec/container/plugins/k8s/bin/k8s
libexec/container/plugins/k8s/config.toml
libexec/container/plugins/k8s/resources/kindnet.yaml
libexec/container/plugins/machine-apiserver/bin/machine-apiserver
libexec/container/plugins/machine-apiserver/config.toml
libexec/container/plugins/machine-apiserver/resources/create-user.sh
libexec/container/plugins/machine-apiserver/resources/init
</pre>

Logis

<pre>
# tail -f /var/log/install.log

...
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Referenced component packages (1) trustLevel=350
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFPKGDerivedDocument sortedPackageLocations]: result = (
"file://localhost"
)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: location = file://localhost
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Set authorization level to root for session
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Authorization is being checked, waiting until authorization arrives.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Administrator authorization granted.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Packages have been authorized for installation.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Will use PK session
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Using authorization level of root for IFPKInstallElement
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Starting installation:
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Configuring volume "Macintosh HD"
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Preparing disk for local booted install.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Free space on "Macintosh HD": 32.78 GB (32778833920 bytes).
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Create temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.78940FDpYBc"
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: IFPKInstallElement (1 packages)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/sbin/installer
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /bin/bash
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/bin/sudo
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/bin/sudo
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Adding client PKInstallDaemonClient pid=78940, uid=0 (/usr/sbin/installer)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: PackageKit: Enqueuing install with framework-specified quality of service (utility)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Set reponsibility for install to 1490
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Hosted team responsibility for install set to team:(UPBK2H6LZM)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: ----- Begin install -----
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: request=PKInstallRequest <1 packages, destination=/>
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: packages=(
"PKLeopardPackage <id=com.apple.container-installer, version=1.2.2, url=file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg>"
)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Extracting file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg (destination=/Library/InstallerSandboxes/.PKInstal
lSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox/Root/usr/local, uid=0)
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: prevent user idle system sleep
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: suspending backupd
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Using trashcan path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/PKInstallSandboxTrash/5C274BE5-0952-4A13-AEDC-87828C0B0E74.sandboxTrash
for sandbox /Library/InstallerSandboxes/.PKInstallSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Shoving /Library/InstallerSandboxes/.PKInstallSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox/Root (1 items) to /
2026-08-10 01:37:59+03 Imres-MacBook-Air install_monitor[78949]: Temporarily excluding: /Applications, /Library, /System, /bin, /private, /sbin, /usr
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Writing receipt for com.apple.container-installer to /
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: No Intel binaries to translate.
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: Installed "container-1.2.2-installer-signed" ()
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: Successfully wrote install history to /Library/Receipts/InstallHistory.plist
2026-08-10 01:37:59+03 Imres-MacBook-Air install_monitor[78949]: Re-included: /Applications, /Library, /System, /bin, /private, /sbin, /usr
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: releasing backupd
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: allow user idle system sleep
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: ----- End install -----
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: 1.5s elapsed install time
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Cleared responsibility for install from 78940.
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Hosted team responsible for install has been cleared.
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Running idle tasks
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Removing client PKInstallDaemonClient pid=78940, uid=0 (/usr/sbin/installer)
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Done with sandbox removals
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Removing temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.78940FDpYBc"
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Finalize disk "Macintosh HD"
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Notifying system of updated components
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: **** Summary Information ****
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Operation Elapsed time
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: -----------------------------
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: zero 0.00 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: disk 0.00 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: install 2.22 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: -total- 2.22 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:
</pre>

Linux kopeerimine jms

<pre>
imreoolberg@Imres-MacBook-Air ~ % container system start
Launching container-apiserver...
Testing access to container-apiserver...
Verifying machine API server is running...
No default kernel configured.
Install the recommended default kernel from [https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst]? [Y/n]:
Installing kernel...
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Tekivad neli protsessi

<pre>
imreoolberg 24167 0.0 0.1 435366080 11376 ?? S 11:21PM 0:00.03 /usr/local/libexec/container/plugins/container-core-images/bin/container-core-images start
imreoolberg 24166 0.0 0.1 435366160 11072 ?? S 11:21PM 0:00.03 /usr/local/libexec/container/plugins/machine-apiserver/bin/machine-apiserver start --resources /usr/local/libexec/container/plugins/machine-apiserver/resources
imreoolberg 24165 0.0 0.1 435359488 10784 ?? S 11:21PM 0:00.03 /usr/local/libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet start --id default --service-identifier com.apple.container.network.container-network-vmnet.default --mode nat
imreoolberg 24158 0.0 0.1 435377296 15264 ?? S 11:21PM 0:00.42 /usr/local/bin/container-apiserver start
</pre>

kus

* kõik protsessid on tavakasutajate privileegides - ka nt võrgundusega seotud
* võrgunduse seadistamiseks kasutatakse nn süsteemseid privilegeeritud helpereid (üle xpc vms)

Virtuaalsete arvutite failisüsteemidele vastavad ressursid asuvad kataloogis

<pre>
/Users/imreoolberg/Library/Application Support/com.apple.container
</pre>

Võrguressursid

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -nP -iUDP | grep conta
container 24564 imreoolberg 14u IPv4 0xd7912f836fb45a0a 0t0 UDP 127.0.0.1:2053
</pre>

Entitlements

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/bin/container-apiserver
Executable=/usr/local/bin/container-apiserver

imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet
Executable=/usr/local/libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet
[Dict]
[Key] com.apple.security.virtualization
[Value]
[Bool] true

imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux
Executable=/usr/local/libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux
[Dict]
[Key] com.apple.security.virtualization
[Value]
[Bool] true

imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/libexec/container/plugins/container-core-images/bin/container-core-images
Executable=/usr/local/libexec/container/plugins/container-core-images/bin/container-core-images
</pre>

kus

* entitlements on natuke setuid-bit sarnane nähtus - privileeg tuleneb programmi omadusest (mitte kasutajast omadusest, kes seda programmi kasutab)

===Seadistamine===

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container system property ls

[build]
cpus = 2
image = "ghcr.io/apple/container-builder-shim/builder:0.13.1"
memory = "2048mb"
rosetta = true

[container]
cpus = 4
memory = "1gb"

[dns]

[kernel]
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.15-186"
digest = "sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"

[machine]
cpus = 5
homeMount = "rw"
memory = "8gb"
virtualization = false

[network]

[registry]
domain = "docker.io"

[vminit]
image = "ghcr.io/apple/containerization/vminit:0.40.1"
</pre>

Kusjuures vaikimisi käivitatud konteineri sees paistab cpu arvu +1, peaks olema sellise mõtlemisega, et 4 on puhtalt konteineri workload jaoks ja 1 on süsteemne overhead

<pre>
imreoolberg@Imres-MacBook-Air ~ % container exec -ti cn_claude-code bash
node@cn_claude-code:/workspace$ free -m
total used free shared buff/cache available
Mem: 1112 227 435 0 465 884
Swap: 0 0 0

node@cn_claude-code:/workspace$ lscpu | grep CPU$s$
CPU(s): 5
On-line CPU(s) list: 0-4
NUMA node0 CPU(s): 0-4
</pre>

Default muutmiseks sobib kasutada ja kehtetamiseks öelda stop ja start

<pre>
imreoolberg@Imres-MacBook-Air ~ % mkdir .config/container
imreoolberg@Imres-MacBook-Air ~ % cat .config/container/config.toml
[container]
cpus = 2
memory = "3gb"
</pre>

kuid tagasipöördumiseks tehase defaultile tuleb tekitada tühi fail (ta tekitab .config faili alusel nö süsteemsema faili, mis ei ole kirjutatav)

<pre>
imreoolberg@Imres-MacBook-Air ~ % rm .config/container/config.toml
imreoolberg@Imres-MacBook-Air ~ % touch .config/container/config.toml

imreoolberg@Imres-MacBook-Air ~ % ls -ld ~/Library/Application\ Support/com.apple.container/config/config.toml
-r--r--r--@ 1 imreoolberg staff 0 Aug 12 10:08 /Users/imreoolberg/Library/Application Support/com.apple.container/config/config.tom
</pre>

===Kasutamine - tõmmise ehitamine===

====Machine image tekitamine====

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % cat Dockerfile
FROM ubuntu:24.04
ENV container container
RUN apt-get update && \
apt-get install -y \
dbus systemd openssh-server net-tools iproute2 iputils-ping curl wget vim-tiny man sudo && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* && \
yes | unminimize
RUN >/etc/machine-id
RUN >/var/lib/dbus/machine-id
RUN systemctl set-default multi-user.target
RUN systemctl mask \
dev-hugepages.mount \
sys-fs-fuse-connections.mount \
systemd-update-utmp.service \
systemd-tmpfiles-setup.service \
console-getty.service
RUN systemctl disable \
networkd-dispatcher.service
RUN sed -i -e 's/^AcceptEnv LANG LC_\*$/#AcceptEnv LANG LC_*/' /etc/ssh/sshd_config

imreoolberg@Imres-MacBook-Air 20260810 % container build -t local/ubuntu-machine:latest .
imreoolberg@Imres-MacBook-Air 20260810 % container machine create local/ubuntu-machine:latest --name dev
</pre>

Tõmmiste nimekirja esitamine

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container image list
NAME TAG DIGEST
alpine latest 28bd5fe8b56d
ubuntu 24.04 561618e2c15b
local/ubuntu-machine latest f470db19ef25
</pre>

====Konteiner tõmmise tekitamine====

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % cat Dockerfile
FROM node:24-trixie

RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
less \
git \
procps \
sudo \
fzf \
zsh \
man-db \
unzip \
gnupg2 \
gh \
iptables \
ipset \
iproute2 \
dnsutils \
aggregate \
jq \
nano \
vim \
openssh-client \
ripgrep \
bash \
fd-find \
bat \
tmux \
tree \
htop \
iputils-ping \
traceroute \
net-tools \
lsof \
python3-pip \
python3-venv \
zip \
rsync \
tshark \
&& apt-get clean && rm -rf /var/lib/apt/lists/*

RUN npm install -g @anthropic-ai/claude-code
WORKDIR /workspace
ENTRYPOINT ["claude"]
</pre>

Ehitamiseks sobib öelda

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container build -t local/trixie-claude-container:latest .
</pre>

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container image ls
NAME TAG DIGEST
alpine latest 28bd5fe8b56d
nginx latest 8541484afbc9
node 24-trixie 66bb8d36ae1d
nginxinc/nginx-unprivileged latest 0371d6f99f39
local/trixie-claude-container latest 09c7fd8b121f
</pre>

===Käsundamine===

<pre>
imreoolberg@Imres-MacBook-Air ~ % container ls
ID IMAGE OS ARCH STATE IP CPUS MEMORY STARTED
dc85cd18-cb6f-4e52-a675-dca8ace06bff docker.io/library/alpine:latest linux arm64 running 192.168.65.6/24 4 1024 MB 2026-08-10T06:14:40Z
5b4feb90-e8dd-4326-b6a8-809f50889b28 docker.io/library/alpine:latest linux arm64 running 192.168.65.3/24 4 1024 MB 2026-08-09T22:44:38Z
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % container run -it --name persisttest-5 ubuntu bash
</pre>

===Kasutamine - Claude Code CLI===

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % cat cn_claude-code.sh
container run --name cn_claude-code --rm --init --user node \
--volume /Users/imreoolberg/ac-cc/volume/workspace:/workspace \
--volume /Users/imreoolberg/ac-cc/volume/home/node:/home/node \
--volume "$SSH_AUTH_SOCK:/ssh-agent" \
--env SSH_AUTH_SOCK=/ssh-agent --env DISABLE_UPDATES=1 \
--workdir /workspace -it local/trixie-claude-container
</pre>

ja paketifiltri osa

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 192.168.1.240
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
192.168.1.240

Imres-MacBook-Air:~ root# tcpdump -nei pflog0 port 22
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), snapshot length 524288 bytes
09:47:51.308116 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135796140 ecr 0,nop,wscale 8], length 0
09:47:52.329182 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135797161 ecr 0,nop,wscale 8], length 0
09:47:53.352717 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135798185 ecr 0,nop,wscale 8], length 0
09:47:54.376537 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135799209 ecr 0,nop,wscale 8], length 0
</pre>

===Uuendamine===

<pre>
imreoolberg@Imres-MacBook-Air ~ % /usr/local/bin/update-container.sh
This script requires admin privileges to update files under /usr/local
Updating to latest version 1.4.1
Downloading package from: https://github.com/apple/container/releases/download/1.4.1/container-1.4.1-installer-signed.pkg...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 112M 100 112M 0 0 23.8M 0 0:00:04 0:00:04 --:--:-- 26.2M
Installing package to /usr/local...
Password:
Updated successfully
container CLI version 1.4.1 (build: release, commit: 9a8917c)
</pre>

ning logis

<pre>
imreoolberg@Imres-MacBook-Air ~ % tail -f /var/log/install.log
...

2026-09-21 08:27:08+03 Imres-MacBook-Air installd[48738]: installd: Starting
2026-09-21 08:27:08+03 Imres-MacBook-Air installd[48738]: installd: uid=0, euid=0
2026-09-21 08:27:08+03 Imres-MacBook-Air system_installd[48743]: installd: Starting
2026-09-21 08:27:08+03 Imres-MacBook-Air system_installd[48743]: installd: uid=0, euid=0
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Referenced component packages (1) trustLevel=350
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: -[IFPKGDerivedDocument sortedPackageLocations]: result = (
"file://localhost"
)
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: location = file://localhost
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: file://localhost/private/var/folders/5_/y68kvg_s6t76d1_d8hkxmh4m0000gn/T/tmp.Pslldx5C7x/container-1.4.1-installer-signed.pkg
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Set authorization level to root for session
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Authorization is being checked, waiting until authorization arrives.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Administrator authorization granted.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Packages have been authorized for installation.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Will use PK session
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Using authorization level of root for IFPKInstallElement
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Starting installation:
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Configuring volume "Macintosh HD"
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Preparing disk for local booted install.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Free space on "Macintosh HD": 14.29 GB (14291693568 bytes).
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Create temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.48733QDB45l"
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: IFPKInstallElement (1 packages)
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Current Path: /usr/sbin/installer
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Current Path: /usr/bin/sudo
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Current Path: /usr/bin/sudo
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Adding client PKInstallDaemonClient pid=48733, uid=0 (/usr/sbin/installer)
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: PackageKit: Enqueuing install with framework-specified quality of service (utility)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Set reponsibility for install to 5722
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Hosted team responsibility for install set to team:(UPBK2H6LZM)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: ----- Begin install -----
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: request=PKInstallRequest <1 packages, destination=/>
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: packages=(
"PKLeopardPackage <id=com.apple.container-installer, version=1.4.1, url=file://localhost/private/var/folders/5_/y68kvg_s6t76d1_d8hkxmh4m0000gn/T/tmp.Pslldx5C7x/container-1.4.1-installer-signed.pkg>"
)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Will do receipt-based obsoleting for package identifier com.apple.container-installer (prefix path=usr/local)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Extracting file://localhost/private/var/folders/5_/y68kvg_s6t76d1_d8hkxmh4m0000gn/T/tmp.Pslldx5C7x/container-1.4.1-installer-signed.pkg (destination=/Library/InstallerSandboxes/.PKInstallSandboxManager/C61F1BF4-D226-439B-B4C5-538F13D41645.activeSandbox/Root/usr/local, uid=0)
2026-09-21 08:27:10+03 Imres-MacBook-Air installd[48738]: PackageKit: prevent user idle system sleep
...
</pre>

Peale uuendamist on muu hulgas uuenenud (vrd. eelmise seisuga ülevalt poolt)

<pre>
imreoolberg@Imres-MacBook-Air ~ % container system property ls

[build]
cpus = 2
image = "ghcr.io/apple/container-builder-shim/builder:0.13.1"
memory = "2048mb"
rosetta = true

[container]
cpus = 4
memory = "1gb"

[dns]

[kernel]
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.35-197-debug"
digest = "sha256:8736c054d9223974735394f822000823baef509e1c33405ec798240fa9b6e4b5"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.32.0/kata-static-3.32.0-arm64.tar.zst"

[machine]
cpus = 5
homeMount = "rw"
memory = "8gb"
virtualization = false

[network]

[registry]
domain = "docker.io"

[vminit]
image = "ghcr.io/apple/containerization/vminit:0.45.0"
</pre>

===Probleemid===

20260824 ja ac v. 1.2.2 puhul kui kasutuse ajal liikuda '<-' (vasak nool) abil agent view juurde ja asuda valima erinevate converstation-jms üsna hõlpsasti ja korratavalt praktiliselt container kasutamine hangus, activity monitor näitas ebaloomulikku protesessori kasutust

[[Fail:20260824-macos-apple-container-01.png|800px]]

===Kasulikud lisamaterjalid===

* TODO

Apple Container

2026-09-21T05:29:45Z

Imre: /* Probleemid */

===Sissejuhatus===

Apple Container https://github.com/apple/container on MacOS töökohaarvutis kasutamiseks mõeldud virtualiseerimise lahendus.

===Tööpõhimõte===

TODO

Väited

* apple-container lahendus võimaldab kasutada amd64 ja arm64 virtuaalset arvutit
* virtuaalne arvuti võib esineda nii nö oci-konteineri kujul kui täielise virtuaalse arvuti kujul
* paigaldamine toimub kasutajana root
* container lahenduse käivitmaine toimub tavakasutajana

Lahenduse töötamist kirjeldab selline joonis

[[Fail:20260812-apple-container-02.png|800px]]

kus

* keskne komponent on container-apiserver - ühel pool teda on container haldusprogramm (klient) ja teisel pool pluginad - kõik kolm töötavad tavakasutaja privileegides
* pluginate abil käivitatakse virtuaalne arvuti ja selle külge kuuluv konteiner, seadistatakse võrk, tegeldaks tõmmistega jne
* pluginaid aitavad privilegeeritud helperid - helperite kätega tehakse nö kernel kihis muudatused (nt virtuaalse võrguliidese moodustamine ja bridge külge kinnitamine)
* privilegeerimata pluginad suhtlevad privilegeeritud helperitega üle nö xpc kanali ja kasutades macos iseloomulikke nn mach porte (see on teatud tüüpi ipc - interprocess communication)

Võrgujoonis

[[Fail:20260812-apple-container-03.png|1000px]]

kus

* TODO

===Paigaldamine===

TODO

Kopeerimiseks sobib öelda

<pre>
Imres-MacBook-Air:20260809 root# curl -L --output container-1.2.2-installer-signed.pkg https://github.com/apple/container/releases/download/1.2.2/container-1.2.2-installer-signed.pkg
</pre>

Kontrollimiseks

<pre>
Imres-MacBook-Air:20260809 root# pkgutil --check-signature /Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg
Package "container-1.2.2-installer-signed.pkg":
Status: signed by a developer certificate issued by Apple for distribution
Notarization: trusted by the Apple notary service
Signed with a trusted timestamp on: 2026-08-08 01:47:20 +0000
Certificate Chain:
1. Developer ID Installer: Apple Inc. - Containerization (UPBK2H6LZM)
Expires: 2030-06-04 16:44:29 +0000
SHA256 Fingerprint:
45 19 B4 3D 00 F5 5E C6 31 38 D4 03 DE 1F 3C 54 23 90 EA E3 D8 2E
59 C1 84 38 46 FB DF E1 4F 5B
------------------------------------------------------------------------
2. Developer ID Certification Authority
Expires: 2031-09-17 00:00:00 +0000
SHA256 Fingerprint:
F1 6C D3 C5 4C 7F 83 CE A4 BF 1A 3E 6A 08 19 C8 AA A8 E4 A1 52 8F
D1 44 71 5F 35 06 43 D2 DF 3A
------------------------------------------------------------------------
3. Apple Root CA
Expires: 2035-02-09 21:40:36 +0000
SHA256 Fingerprint:
B0 B1 73 0E CB C7 FF 45 05 14 2C 49 F1 29 5E 6E DA 6B CA ED 7E 2C
68 C5 BE 91 B5 A1 10 01 F0 24

Imres-MacBook-Air:20260809 root# spctl -a -t install -v /Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg
/Users/imreoolberg/Downloads/container-1.2.2-installer-signed.pkg: accepted
source=Notarized Developer ID
</pre>

Paigaldamiseks

<pre>
Imres-MacBook-Air:20260809 root# installer -pkg container-1.2.2-installer-signed.pkg -target /
installer: Package name is container-1.2.2-installer-signed
installer: Installing at base path /
installer: The install was successful.
</pre>

Failisüsteemi tekivad

<pre>
imreoolberg@Imres-MacBook-Air ~ % pkgutil --pkgs | grep conta
com.apple.container-installer

imreoolberg@Imres-MacBook-Air ~ % pkgutil --files com.apple.container-installer --only-files
bin/container
bin/container-apiserver
bin/uninstall-container.sh
bin/update-container.sh
libexec/container/plugins/container-core-images/bin/container-core-images
libexec/container/plugins/container-core-images/config.toml
libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet
libexec/container/plugins/container-network-vmnet/config.toml
libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux
libexec/container/plugins/container-runtime-linux/config.toml
libexec/container/plugins/k8s/bin/k8s
libexec/container/plugins/k8s/config.toml
libexec/container/plugins/k8s/resources/kindnet.yaml
libexec/container/plugins/machine-apiserver/bin/machine-apiserver
libexec/container/plugins/machine-apiserver/config.toml
libexec/container/plugins/machine-apiserver/resources/create-user.sh
libexec/container/plugins/machine-apiserver/resources/init
</pre>

Logis

<pre>
# tail -f /var/log/install.log

...
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Referenced component packages (1) trustLevel=350
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFPKGDerivedDocument sortedPackageLocations]: result = (
"file://localhost"
)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: location = file://localhost
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Set authorization level to root for session
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Authorization is being checked, waiting until authorization arrives.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Administrator authorization granted.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Packages have been authorized for installation.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Will use PK session
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Using authorization level of root for IFPKInstallElement
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Starting installation:
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Configuring volume "Macintosh HD"
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Preparing disk for local booted install.
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Free space on "Macintosh HD": 32.78 GB (32778833920 bytes).
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Create temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.78940FDpYBc"
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: IFPKInstallElement (1 packages)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/sbin/installer
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /bin/bash
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/bin/sudo
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: Current Path: /usr/bin/sudo
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Adding client PKInstallDaemonClient pid=78940, uid=0 (/usr/sbin/installer)
2026-08-10 01:37:58+03 Imres-MacBook-Air installer[78940]: PackageKit: Enqueuing install with framework-specified quality of service (utility)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Set reponsibility for install to 1490
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Hosted team responsibility for install set to team:(UPBK2H6LZM)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: ----- Begin install -----
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: request=PKInstallRequest <1 packages, destination=/>
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: packages=(
"PKLeopardPackage <id=com.apple.container-installer, version=1.2.2, url=file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg>"
)
2026-08-10 01:37:58+03 Imres-MacBook-Air installd[939]: PackageKit: Extracting file://localhost/private/var/root/20260809/container-1.2.2-installer-signed.pkg (destination=/Library/InstallerSandboxes/.PKInstal
lSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox/Root/usr/local, uid=0)
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: prevent user idle system sleep
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: suspending backupd
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Using trashcan path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/PKInstallSandboxTrash/5C274BE5-0952-4A13-AEDC-87828C0B0E74.sandboxTrash
for sandbox /Library/InstallerSandboxes/.PKInstallSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Shoving /Library/InstallerSandboxes/.PKInstallSandboxManager/5C274BE5-0952-4A13-AEDC-87828C0B0E74.activeSandbox/Root (1 items) to /
2026-08-10 01:37:59+03 Imres-MacBook-Air install_monitor[78949]: Temporarily excluding: /Applications, /Library, /System, /bin, /private, /sbin, /usr
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: Writing receipt for com.apple.container-installer to /
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: PackageKit: No Intel binaries to translate.
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: Installed "container-1.2.2-installer-signed" ()
2026-08-10 01:37:59+03 Imres-MacBook-Air installd[939]: Successfully wrote install history to /Library/Receipts/InstallHistory.plist
2026-08-10 01:37:59+03 Imres-MacBook-Air install_monitor[78949]: Re-included: /Applications, /Library, /System, /bin, /private, /sbin, /usr
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: releasing backupd
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: allow user idle system sleep
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: ----- End install -----
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: 1.5s elapsed install time
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Cleared responsibility for install from 78940.
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Hosted team responsible for install has been cleared.
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Running idle tasks
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Removing client PKInstallDaemonClient pid=78940, uid=0 (/usr/sbin/installer)
2026-08-10 01:38:00+03 Imres-MacBook-Air installd[939]: PackageKit: Done with sandbox removals
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Removing temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.78940FDpYBc"
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Finalize disk "Macintosh HD"
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Notifying system of updated components
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: **** Summary Information ****
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: Operation Elapsed time
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: -----------------------------
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: zero 0.00 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: disk 0.00 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: install 2.22 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]: -total- 2.22 seconds
2026-08-10 01:38:00+03 Imres-MacBook-Air installer[78940]:
</pre>

Linux kopeerimine jms

<pre>
imreoolberg@Imres-MacBook-Air ~ % container system start
Launching container-apiserver...
Testing access to container-apiserver...
Verifying machine API server is running...
No default kernel configured.
Install the recommended default kernel from [https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst]? [Y/n]:
Installing kernel...
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Tekivad neli protsessi

<pre>
imreoolberg 24167 0.0 0.1 435366080 11376 ?? S 11:21PM 0:00.03 /usr/local/libexec/container/plugins/container-core-images/bin/container-core-images start
imreoolberg 24166 0.0 0.1 435366160 11072 ?? S 11:21PM 0:00.03 /usr/local/libexec/container/plugins/machine-apiserver/bin/machine-apiserver start --resources /usr/local/libexec/container/plugins/machine-apiserver/resources
imreoolberg 24165 0.0 0.1 435359488 10784 ?? S 11:21PM 0:00.03 /usr/local/libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet start --id default --service-identifier com.apple.container.network.container-network-vmnet.default --mode nat
imreoolberg 24158 0.0 0.1 435377296 15264 ?? S 11:21PM 0:00.42 /usr/local/bin/container-apiserver start
</pre>

kus

* kõik protsessid on tavakasutajate privileegides - ka nt võrgundusega seotud
* võrgunduse seadistamiseks kasutatakse nn süsteemseid privilegeeritud helpereid (üle xpc vms)

Virtuaalsete arvutite failisüsteemidele vastavad ressursid asuvad kataloogis

<pre>
/Users/imreoolberg/Library/Application Support/com.apple.container
</pre>

Võrguressursid

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -nP -iUDP | grep conta
container 24564 imreoolberg 14u IPv4 0xd7912f836fb45a0a 0t0 UDP 127.0.0.1:2053
</pre>

Entitlements

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/bin/container-apiserver
Executable=/usr/local/bin/container-apiserver

imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet
Executable=/usr/local/libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet
[Dict]
[Key] com.apple.security.virtualization
[Value]
[Bool] true

imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux
Executable=/usr/local/libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux
[Dict]
[Key] com.apple.security.virtualization
[Value]
[Bool] true

imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - /usr/local/libexec/container/plugins/container-core-images/bin/container-core-images
Executable=/usr/local/libexec/container/plugins/container-core-images/bin/container-core-images
</pre>

kus

* entitlements on natuke setuid-bit sarnane nähtus - privileeg tuleneb programmi omadusest (mitte kasutajast omadusest, kes seda programmi kasutab)

===Seadistamine===

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container system property ls

[build]
cpus = 2
image = "ghcr.io/apple/container-builder-shim/builder:0.13.1"
memory = "2048mb"
rosetta = true

[container]
cpus = 4
memory = "1gb"

[dns]

[kernel]
binaryPath = "opt/kata/share/kata-containers/vmlinux-6.18.15-186"
digest = "sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91"
url = "https://github.com/kata-containers/kata-containers/releases/download/3.28.0/kata-static-3.28.0-arm64.tar.zst"

[machine]
cpus = 5
homeMount = "rw"
memory = "8gb"
virtualization = false

[network]

[registry]
domain = "docker.io"

[vminit]
image = "ghcr.io/apple/containerization/vminit:0.40.1"
</pre>

Kusjuures vaikimisi käivitatud konteineri sees paistab cpu arvu +1, peaks olema sellise mõtlemisega, et 4 on puhtalt konteineri workload jaoks ja 1 on süsteemne overhead

<pre>
imreoolberg@Imres-MacBook-Air ~ % container exec -ti cn_claude-code bash
node@cn_claude-code:/workspace$ free -m
total used free shared buff/cache available
Mem: 1112 227 435 0 465 884
Swap: 0 0 0

node@cn_claude-code:/workspace$ lscpu | grep CPU$s$
CPU(s): 5
On-line CPU(s) list: 0-4
NUMA node0 CPU(s): 0-4
</pre>

Default muutmiseks sobib kasutada ja kehtetamiseks öelda stop ja start

<pre>
imreoolberg@Imres-MacBook-Air ~ % mkdir .config/container
imreoolberg@Imres-MacBook-Air ~ % cat .config/container/config.toml
[container]
cpus = 2
memory = "3gb"
</pre>

kuid tagasipöördumiseks tehase defaultile tuleb tekitada tühi fail (ta tekitab .config faili alusel nö süsteemsema faili, mis ei ole kirjutatav)

<pre>
imreoolberg@Imres-MacBook-Air ~ % rm .config/container/config.toml
imreoolberg@Imres-MacBook-Air ~ % touch .config/container/config.toml

imreoolberg@Imres-MacBook-Air ~ % ls -ld ~/Library/Application\ Support/com.apple.container/config/config.toml
-r--r--r--@ 1 imreoolberg staff 0 Aug 12 10:08 /Users/imreoolberg/Library/Application Support/com.apple.container/config/config.tom
</pre>

===Kasutamine - tõmmise ehitamine===

====Machine image tekitamine====

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % cat Dockerfile
FROM ubuntu:24.04
ENV container container
RUN apt-get update && \
apt-get install -y \
dbus systemd openssh-server net-tools iproute2 iputils-ping curl wget vim-tiny man sudo && \
apt-get clean && \
rm -rf /var/lib/apt/lists/* && \
yes | unminimize
RUN >/etc/machine-id
RUN >/var/lib/dbus/machine-id
RUN systemctl set-default multi-user.target
RUN systemctl mask \
dev-hugepages.mount \
sys-fs-fuse-connections.mount \
systemd-update-utmp.service \
systemd-tmpfiles-setup.service \
console-getty.service
RUN systemctl disable \
networkd-dispatcher.service
RUN sed -i -e 's/^AcceptEnv LANG LC_\*$/#AcceptEnv LANG LC_*/' /etc/ssh/sshd_config

imreoolberg@Imres-MacBook-Air 20260810 % container build -t local/ubuntu-machine:latest .
imreoolberg@Imres-MacBook-Air 20260810 % container machine create local/ubuntu-machine:latest --name dev
</pre>

Tõmmiste nimekirja esitamine

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container image list
NAME TAG DIGEST
alpine latest 28bd5fe8b56d
ubuntu 24.04 561618e2c15b
local/ubuntu-machine latest f470db19ef25
</pre>

====Konteiner tõmmise tekitamine====

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % cat Dockerfile
FROM node:24-trixie

RUN apt-get update && \
DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
less \
git \
procps \
sudo \
fzf \
zsh \
man-db \
unzip \
gnupg2 \
gh \
iptables \
ipset \
iproute2 \
dnsutils \
aggregate \
jq \
nano \
vim \
openssh-client \
ripgrep \
bash \
fd-find \
bat \
tmux \
tree \
htop \
iputils-ping \
traceroute \
net-tools \
lsof \
python3-pip \
python3-venv \
zip \
rsync \
tshark \
&& apt-get clean && rm -rf /var/lib/apt/lists/*

RUN npm install -g @anthropic-ai/claude-code
WORKDIR /workspace
ENTRYPOINT ["claude"]
</pre>

Ehitamiseks sobib öelda

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container build -t local/trixie-claude-container:latest .
</pre>

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % container image ls
NAME TAG DIGEST
alpine latest 28bd5fe8b56d
nginx latest 8541484afbc9
node 24-trixie 66bb8d36ae1d
nginxinc/nginx-unprivileged latest 0371d6f99f39
local/trixie-claude-container latest 09c7fd8b121f
</pre>

===Käsundamine===

<pre>
imreoolberg@Imres-MacBook-Air ~ % container ls
ID IMAGE OS ARCH STATE IP CPUS MEMORY STARTED
dc85cd18-cb6f-4e52-a675-dca8ace06bff docker.io/library/alpine:latest linux arm64 running 192.168.65.6/24 4 1024 MB 2026-08-10T06:14:40Z
5b4feb90-e8dd-4326-b6a8-809f50889b28 docker.io/library/alpine:latest linux arm64 running 192.168.65.3/24 4 1024 MB 2026-08-09T22:44:38Z
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % container run -it --name persisttest-5 ubuntu bash
</pre>

===Kasutamine - Claude Code CLI===

<pre>
imreoolberg@Imres-MacBook-Air 20260810 % cat cn_claude-code.sh
container run --name cn_claude-code --rm --init --user node \
--volume /Users/imreoolberg/ac-cc/volume/workspace:/workspace \
--volume /Users/imreoolberg/ac-cc/volume/home/node:/home/node \
--volume "$SSH_AUTH_SOCK:/ssh-agent" \
--env SSH_AUTH_SOCK=/ssh-agent --env DISABLE_UPDATES=1 \
--workdir /workspace -it local/trixie-claude-container
</pre>

ja paketifiltri osa

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 192.168.1.240
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
192.168.1.240

Imres-MacBook-Air:~ root# tcpdump -nei pflog0 port 22
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), snapshot length 524288 bytes
09:47:51.308116 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135796140 ecr 0,nop,wscale 8], length 0
09:47:52.329182 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135797161 ecr 0,nop,wscale 8], length 0
09:47:53.352717 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135798185 ecr 0,nop,wscale 8], length 0
09:47:54.376537 rule 0.ee.pri.auul.rul.1/0(match): block in on bridge101: 192.168.65.17.44988 > 192.168.1.240.22: Flags [S], seq 4055173142, win 64480, options [mss 1240,sackOK,TS val 1135799209 ecr 0,nop,wscale 8], length 0
</pre>

===Uuendamine===

<pre>
imreoolberg@Imres-MacBook-Air ~ % /usr/local/bin/update-container.sh
This script requires admin privileges to update files under /usr/local
Updating to latest version 1.4.1
Downloading package from: https://github.com/apple/container/releases/download/1.4.1/container-1.4.1-installer-signed.pkg...
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0
100 112M 100 112M 0 0 23.8M 0 0:00:04 0:00:04 --:--:-- 26.2M
Installing package to /usr/local...
Password:
Updated successfully
container CLI version 1.4.1 (build: release, commit: 9a8917c)
</pre>

ning logis

<pre>
imreoolberg@Imres-MacBook-Air ~ % tail -f /var/log/install.log
...

2026-09-21 08:27:08+03 Imres-MacBook-Air installd[48738]: installd: Starting
2026-09-21 08:27:08+03 Imres-MacBook-Air installd[48738]: installd: uid=0, euid=0
2026-09-21 08:27:08+03 Imres-MacBook-Air system_installd[48743]: installd: Starting
2026-09-21 08:27:08+03 Imres-MacBook-Air system_installd[48743]: installd: uid=0, euid=0
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Referenced component packages (1) trustLevel=350
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: -[IFPKGDerivedDocument sortedPackageLocations]: result = (
"file://localhost"
)
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: location = file://localhost
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: -[IFDInstallController(Private) _buildInstallPlanReturningError:]: file://localhost/private/var/folders/5_/y68kvg_s6t76d1_d8hkxmh4m0000gn/T/tmp.Pslldx5C7x/container-1.4.1-installer-signed.pkg
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Set authorization level to root for session
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Authorization is being checked, waiting until authorization arrives.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Administrator authorization granted.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Packages have been authorized for installation.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Will use PK session
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Using authorization level of root for IFPKInstallElement
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Starting installation:
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Configuring volume "Macintosh HD"
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Preparing disk for local booted install.
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Free space on "Macintosh HD": 14.29 GB (14291693568 bytes).
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Create temporary directory "/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//Install.48733QDB45l"
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: IFPKInstallElement (1 packages)
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Current Path: /usr/sbin/installer
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Current Path: /usr/bin/sudo
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: Current Path: /usr/bin/sudo
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Adding client PKInstallDaemonClient pid=48733, uid=0 (/usr/sbin/installer)
2026-09-21 08:27:09+03 Imres-MacBook-Air installer[48733]: PackageKit: Enqueuing install with framework-specified quality of service (utility)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Set reponsibility for install to 5722
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Hosted team responsibility for install set to team:(UPBK2H6LZM)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: ----- Begin install -----
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: request=PKInstallRequest <1 packages, destination=/>
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: packages=(
"PKLeopardPackage <id=com.apple.container-installer, version=1.4.1, url=file://localhost/private/var/folders/5_/y68kvg_s6t76d1_d8hkxmh4m0000gn/T/tmp.Pslldx5C7x/container-1.4.1-installer-signed.pkg>"
)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Will do receipt-based obsoleting for package identifier com.apple.container-installer (prefix path=usr/local)
2026-09-21 08:27:09+03 Imres-MacBook-Air installd[48738]: PackageKit: Extracting file://localhost/private/var/folders/5_/y68kvg_s6t76d1_d8hkxmh4m0000gn/T/tmp.Pslldx5C7x/container-1.4.1-installer-signed.pkg (destination=/Library/InstallerSandboxes/.PKInstallSandboxManager/C61F1BF4-D226-439B-B4C5-538F13D41645.activeSandbox/Root/usr/local, uid=0)
2026-09-21 08:27:10+03 Imres-MacBook-Air installd[48738]: PackageKit: prevent user idle system sleep
...
</pre>

===Probleemid===

20260824 ja ac v. 1.2.2 puhul kui kasutuse ajal liikuda '<-' (vasak nool) abil agent view juurde ja asuda valima erinevate converstation-jms üsna hõlpsasti ja korratavalt praktiliselt container kasutamine hangus, activity monitor näitas ebaloomulikku protesessori kasutust

[[Fail:20260824-macos-apple-container-01.png|800px]]

===Kasulikud lisamaterjalid===

* TODO

Windows 11 Pro

2026-09-20T16:49:01Z

Imre: /* Wireguard */

===Sissejuhatus===

TODO

===Mõisted===

* OOBE -
* winpe

===Tööpõhimõte===

TODO

===Ettevalmistamine===

Microsoft konto võib olla abiks

TODO

====Tarkvara kopeerimine====

virtio draiverid

imreoolberg@Imres-MacBook-Air ~ % curl -L --output virtio-win-20260829.iso https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso

Tarkvara kopeerimine

[[Fail:20260829-win-11-pro-03.png|900px]]

====Litsents====

Paistab, et litsentsi müüakse mitmetes kohtades, ehk usaldusväärsem

[[Fail:20260829-win-11-pro-02.png|900px]]

ja ehk kahtlasem

[[Fail:20260829-win-11-pro-01.png|900px]]

====Proxmox virtuaalse arvuti ettevalmistamine====

TODO

[[Fail:20260829-win-11-pro-05.png|800px]]

kus

* kasutusel on kaks .iso tõmmist - win 11 operatsioonisüsteem ja virtio draiverid

virtuaalse arvuti nö platvormi põhiosa (süsteem)

[[Fail:20260829-win-11-pro-06.png|800px]]

virtuaalse arvuti salvestus-osakond

[[Fail:20260829-win-11-pro-07.png|800px]]

virtuaalse arvuti protsessor

[[Fail:20260829-win-11-pro-10.png|800px]]

kus

* protsessori tüübiks on 'host' - mingist hetkest pve v. 9.x juures tekkisid pve host logisse muul juhul teatud mitte-olulised, aga siiski nö teated

virtuaalse arvuti mälu

[[Fail:20260829-win-11-pro-08.png|800px]]

kus

* mälu kokku - 8 G
* nö tagatud mälu - 6 G
* 2 G ulatuses toimetatakse nn ballooning tehnika abil

virtuaalse arvuti võrk

[[Fail:20260829-win-11-pro-08.png|800px]]

kus

* multiqueue suurus on võrdne cpu arvuga - 8
* ajutisel paigalduse ajal kasutatakse võrgukaardi mudelit e1000e
* firewall on parem välja lülitada kui mujal pve peal seada ei kasutata (on kogemus, et see muidu tekitab võrgus ebastabiilsust)

===Paigaldamine===

Installer cd pealt virtuaalse arvuti käivitamise esimene vaade on selline

[[Fail:20260829-win-11-pro-11.png|1100px]]

kus

* TODO

seejärel

[[Fail:20260829-win-11-pro-12.png|1100px]]

kus

* TODO

seejärel multi-installerist sobiva windows maitse valimine

[[Fail:20260829-win-11-pro-13.png|1100px]]

kus

* TODO

Peale paigaldamist paistab Microsoft veebikohas selline pilt

[[Fail:20260829-win-11-pro-04.png|900px]]

===Seadistamine===

====Windows update====

TODO

====Chrome rakendus====

TODO

====Users and Computers ...====

Esmalt tuleb dsa.msc rakendus paigaldada

TODO

ning seejärel saab kasutada

<pre>
PS C:\WINDOWS\system32> runas /netonly /user:AUUL\Administrator "mmc dsa.msc /domain=sise.moraal.ee /server=192.168.10.125"
Enter the password for AUUL\Administrator:
Attempting to start mmc dsa.msc /domain=sise.moraal.ee /server=192.168.10.125 as user "AUUL\Administrator" ...
PS C:\WINDOWS\system32>
</pre>

====RDP====

TODO

====OpenSSH====

TODO

===Kasutamine - Samba failiserver===

Väited

* UNC (Universal Naming Convention) abil failiserveri ressursi kasutamist (st \\192.168.3.13\)
* tehnika kasutamine ei eelda windows workgroup ega netbios name, domeeni vms muud nö infrastruktuuri - lihtsalt tavaline windows (standalone) ning tavaline samba (standalone)
* kasutaja peab teadma samba failiserveri kasutajanime ja parooli
* failiserveris peab olema mõni ressurss tema kasutajale ligipääsetav
* tulemusena saab faile üles ja alla laadida

Pressida Desktop peal paremale hiire klahivile ja valida ... Create shortcut

[[Fail:20260831-samba-fs-01.png|800px]]

seejärel ...

[[Fail:20260831-samba-fs-02.png|800px]]

seejärel ...

[[Fail:20260831-samba-fs-03.png|800px]]

kus

* katsetamisel vast mitte linnutada 'Remeber ..'
* tavalisel kasutama hakkamise linnutada 'Remeber ..' - siis ta ei küsi peale järgmist arvuti käivitamist kasutajanime ja parooli

seejärel ...

[[Fail:20260831-samba-fs-04.png|800px]]

seejärel ...

[[Fail:20260831-samba-fs-05.png|800px]]

Tulemusena avaneb ikooni peale topelt-pressides failiserveris kirjeldatud sharede nimekiri

[[Fail:20260831-samba-fs-06.png|800px]]

===Kasutamine - Outlook===

TODO

===Kasutamine - Thunderbird===

TODO

===Wireguard===

Tarkvara sobib kopeerida aadressilt https://www.wireguard.com/install/

[[Fail:20260920-wireguard-win11-01.png|900px]]

Installeri käivitamisel alguses küsitakse jaa vastust

[[Fail:20260920-wireguard-win11-02.png|500px]]

Peale programmi käivitamist esitatakse selline aken

[[Fail:20260920-wireguard-win11-03.png|900px]]

Valides 'Create empty tunnel ...' tekitatakse priv-pub võtmepaar

[[Fail:20260920-wireguard-win11-04.png|900px]]

kus

* tuleb anda sissekandele nimi, nt 'wg-asukohanimi'
* ta genereerib automaatselt priv-pub võtmed
* hallil taustal esitatakse public võti - see tuleb saata wireguard serveri pidajale (hwQTxMLj+d8z4t7KTx7QIoDOIxExW0x881p7Ehj3oAA=)
* valgel taustal tekstiaknas on vastav privaatne võti - see jätta enda teada ja alles siia juurde lisanduva kliendi seadistuse algusse

Kokkuvõttes võiks olla nt selline seadistus realistlik

[[Fail:20260920-wireguard-win11-05.png|900px]]

teksti kujul

<pre>
[Interface]
PrivateKey = yA3BflUnPWk754w5v2+W225UUgFv62XqQx2s8YOpBlM=
Address = 10.168.1.2/32

[Peer]
PublicKey = EB6ZpGDoHawX1Zw+0Yh7Dcck7AT5fTLovSLDc2vSwxg=
AllowedIPs = 192.168.1.63/32, 192.168.1.64/32, 192.168.1.109/32, 192.168.1.110/32, 192.168.1.111/32
Endpoint = 80.235.106.149:51820
PersistentKeepalive = 25
</pre>

Töötav tunnel paistab välja nii

[[Fail:20260920-wireguard-win11-06.png|900px]]

kus

* ping toimib

===Kasulikud lisamaterjalid===

* https://pve.proxmox.com/wiki/Windows_11_guest_best_practices
* https://pve.proxmox.com/wiki/Paravirtualized_Block_Drivers_for_Windows

Windows 11 Pro

2026-09-20T16:45:53Z

Imre: /* Wireguard */

===Sissejuhatus===

TODO

===Mõisted===

* OOBE -
* winpe

===Tööpõhimõte===

TODO

===Ettevalmistamine===

Microsoft konto võib olla abiks

TODO

====Tarkvara kopeerimine====

virtio draiverid

imreoolberg@Imres-MacBook-Air ~ % curl -L --output virtio-win-20260829.iso https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso

Tarkvara kopeerimine

[[Fail:20260829-win-11-pro-03.png|900px]]

====Litsents====

Paistab, et litsentsi müüakse mitmetes kohtades, ehk usaldusväärsem

[[Fail:20260829-win-11-pro-02.png|900px]]

ja ehk kahtlasem

[[Fail:20260829-win-11-pro-01.png|900px]]

====Proxmox virtuaalse arvuti ettevalmistamine====

TODO

[[Fail:20260829-win-11-pro-05.png|800px]]

kus

* kasutusel on kaks .iso tõmmist - win 11 operatsioonisüsteem ja virtio draiverid

virtuaalse arvuti nö platvormi põhiosa (süsteem)

[[Fail:20260829-win-11-pro-06.png|800px]]

virtuaalse arvuti salvestus-osakond

[[Fail:20260829-win-11-pro-07.png|800px]]

virtuaalse arvuti protsessor

[[Fail:20260829-win-11-pro-10.png|800px]]

kus

* protsessori tüübiks on 'host' - mingist hetkest pve v. 9.x juures tekkisid pve host logisse muul juhul teatud mitte-olulised, aga siiski nö teated

virtuaalse arvuti mälu

[[Fail:20260829-win-11-pro-08.png|800px]]

kus

* mälu kokku - 8 G
* nö tagatud mälu - 6 G
* 2 G ulatuses toimetatakse nn ballooning tehnika abil

virtuaalse arvuti võrk

[[Fail:20260829-win-11-pro-08.png|800px]]

kus

* multiqueue suurus on võrdne cpu arvuga - 8
* ajutisel paigalduse ajal kasutatakse võrgukaardi mudelit e1000e
* firewall on parem välja lülitada kui mujal pve peal seada ei kasutata (on kogemus, et see muidu tekitab võrgus ebastabiilsust)

===Paigaldamine===

Installer cd pealt virtuaalse arvuti käivitamise esimene vaade on selline

[[Fail:20260829-win-11-pro-11.png|1100px]]

kus

* TODO

seejärel

[[Fail:20260829-win-11-pro-12.png|1100px]]

kus

* TODO

seejärel multi-installerist sobiva windows maitse valimine

[[Fail:20260829-win-11-pro-13.png|1100px]]

kus

* TODO

Peale paigaldamist paistab Microsoft veebikohas selline pilt

[[Fail:20260829-win-11-pro-04.png|900px]]

===Seadistamine===

====Windows update====

TODO

====Chrome rakendus====

TODO

====Users and Computers ...====

Esmalt tuleb dsa.msc rakendus paigaldada

TODO

ning seejärel saab kasutada

<pre>
PS C:\WINDOWS\system32> runas /netonly /user:AUUL\Administrator "mmc dsa.msc /domain=sise.moraal.ee /server=192.168.10.125"
Enter the password for AUUL\Administrator:
Attempting to start mmc dsa.msc /domain=sise.moraal.ee /server=192.168.10.125 as user "AUUL\Administrator" ...
PS C:\WINDOWS\system32>
</pre>

====RDP====

TODO

====OpenSSH====

TODO

===Kasutamine - Samba failiserver===

Väited

* UNC (Universal Naming Convention) abil failiserveri ressursi kasutamist (st \\192.168.3.13\)
* tehnika kasutamine ei eelda windows workgroup ega netbios name, domeeni vms muud nö infrastruktuuri - lihtsalt tavaline windows (standalone) ning tavaline samba (standalone)
* kasutaja peab teadma samba failiserveri kasutajanime ja parooli
* failiserveris peab olema mõni ressurss tema kasutajale ligipääsetav
* tulemusena saab faile üles ja alla laadida

Pressida Desktop peal paremale hiire klahivile ja valida ... Create shortcut

[[Fail:20260831-samba-fs-01.png|800px]]

seejärel ...

[[Fail:20260831-samba-fs-02.png|800px]]

seejärel ...

[[Fail:20260831-samba-fs-03.png|800px]]

kus

* katsetamisel vast mitte linnutada 'Remeber ..'
* tavalisel kasutama hakkamise linnutada 'Remeber ..' - siis ta ei küsi peale järgmist arvuti käivitamist kasutajanime ja parooli

seejärel ...

[[Fail:20260831-samba-fs-04.png|800px]]

seejärel ...

[[Fail:20260831-samba-fs-05.png|800px]]

Tulemusena avaneb ikooni peale topelt-pressides failiserveris kirjeldatud sharede nimekiri

[[Fail:20260831-samba-fs-06.png|800px]]

===Kasutamine - Outlook===

TODO

===Kasutamine - Thunderbird===

TODO

===Wireguard===

Tarkvara sobib kopeerida aadressilt https://www.wireguard.com/install/

[[Fail:20260920-wireguard-win11-01.png|900px]]

Installeri käivitamisel alguses küsitakse jaa vastust

[[Fail:20260920-wireguard-win11-02.png|500px]]

Peale programmi käivitamist esitatakse selline aken

[[Fail:20260920-wireguard-win11-03.png|900px]]

Valides 'Create empty tunnel ...' tekitatakse priv-pub võtmepaar

[[Fail:20260920-wireguard-win11-04.png|900px]]

kus

* tuleb anda sissekandele nimi, nt 'wg-asukohanimi'
* hallil taustal esitatakse public võti - see tuleb saata wireguard serveri pidajale (hwQTxMLj+d8z4t7KTx7QIoDOIxExW0x881p7Ehj3oAA=)
* valgel taustal tekstiaknas on vastav privaatne võti - see jätta enda teada ja alles siia juurde lisanduva kliendi seadistuse algusse

Kokkuvõttes võiks olla nt selline seadistus realistlik

[[Fail:20260920-wireguard-win11-05.png|900px]]

teksti kujul

<pre>
[Interface]
PrivateKey = yA3BflUnPWk754w5v2+W225UUgFv62XqQx2s8YOpBlM=
Address = 10.168.1.2/32

[Peer]
PublicKey = EB6ZpGDoHawX1Zw+0Yh7Dcck7AT5fTLovSLDc2vSwxg=
AllowedIPs = 192.168.1.63/32, 192.168.1.64/32, 192.168.1.109/32, 192.168.1.110/32, 192.168.1.111/32
Endpoint = 80.235.106.149:51820
PersistentKeepalive = 25
</pre>

Töötav tunnel paistab välja nii

[[Fail:20260920-wireguard-win11-06.png|900px]]

kus

* ping toimib

===Kasulikud lisamaterjalid===

* https://pve.proxmox.com/wiki/Windows_11_guest_best_practices
* https://pve.proxmox.com/wiki/Paravirtualized_Block_Drivers_for_Windows

2026-09-16T18:57:33Z

Imre:

Fail:20260916-synology-firewall-01.png

2026-09-16T18:55:54Z

Imre:

Synology kasutamine

2026-09-16T18:55:44Z

Imre: /* Kasulikud lisamaterjalid */

===Sissejuhatus===

Synology http://www.synology.com/ ...

Käesolevas tekstis on Linux kliendina kasutatud Debian v. 7 Wheezy näidet.

===Riistvara===

* https://www.synology.com/en-us/compatibility aadressilt leiab seadmega ühilduvaid tooteid, eriti nt kõvakettaid

===Mõisted===

* DSM - DiskStation Manager

===Tööpõhimõte===

* Disk Group'ile vastab Synology kui Linux peal mdadm seade
* Kui Disk Group peale tekitada LUN'isid (iSCSI jaoks), siis neile vastavad vastava mdadm seadmele tehtud LVM VG köited
* Kõigi kõvaketaste partitsioonide 1 ja 2 abil on moodustatud vastavalt mdadm seadmed /dev/md0 ning /dev/md1; esimene on kasutuses Synology juurfailisüsteemina ning teine swap
* Disk Groupi'de, Volumede jms jaoks kasutatakse partitsiooni /dev/sda3 vms, paistab, et iga ketta puhul kasutatakse nii või teisiti ühte suurt partitsiooni

Andmesalvestuse ressurssi saab kasutada üsna erinevalt, tundub, et suhteliselt paindlik ja jätkusuutlik on moodustada kõigi füüsiliste ketaste alusel üks suur Disk Group (nt raid5 taoline redundantne lülitus)

syno-varundus-1> cat /proc/mdstat
Personalities : [linear] [raid0] [raid1] [raid10] [raid6] [raid5] [raid4]
md2 : active raid5 sdd5[3] sdc5[2] sdb5[1] sda5[0]
2916082944 blocks super 1.2 level 5, 64k chunk, algorithm 2 [4/4] [UUUU]

md1 : active raid1 sda2[0] sdb2[1] sdc2[2] sdd2[3]
2097088 blocks [4/4] [UUUU]

md0 : active raid1 sda1[0] sdb1[1] sdc1[2] sdd1[3]
2490176 blocks [4/4] [UUUU]

ning sellelt erinevateks vajadusteks kasutada tükke (millele vastavad LVM köited, VG nimega vg1 tekitatakse automaatselt)

syno-varundus-1> lvdisplay | grep Name
LV Name /dev/vg1/syno_vg_reserved_area
VG Name vg1
LV Name /dev/vg1/iscsi_0
VG Name vg1
LV Name /dev/vg1/iscsi_1
VG Name vg1
LV Name /dev/vg1/iscsi_2
VG Name vg1
LV Name /dev/vg1/iscsi_3
VG Name vg1
LV Name /dev/vg1/volume_1
VG Name vg1

LVM köidete kasutamisel tuleb arvestada, et neid saab vaid suurendada, mitte vähendada.

===Synology seadmele tarkvara paigaldamine===

Uuele Synology seadmele tarkvara paigaldamiseks on paar erinevat moodust

* Web Assistant - Synology DSM seade saab DHCP abil omale ip ja brauseriga saab pöörduda http://ip:5000/ (mac aadress on seadme korpusel kleebisel ja selle järgi otsida dhcp logist)

[[Pilt:Synology-3.gif]]

kus tuleb vajutada Install Now, seade käib korra reboodil ning seejärel küsitakse seadme nime, admin kasutaja parooli jne.

* Synology Assistant - Windows keskkonnas töötav programm leiab samast subnetist Synology

Seadme nime ja võrgu seadistamiseks tuleb avada

Control Panel -> Network -> General -> Server Name

===Kasutaja tekitamine===

Synology kasutaja tekitamiseks sobib haldusliideses valida

Control Panel -> Users -> Create -> Create User

Seejärel läbida dialoogid

* kasutajanimi, kirjeldus, eposti aadress ja parool
* vaikimisi gruppi kuuluvus
* ligipääsetavad ressursid
* ligipääsemise viisid (ftp, file station, network backup, webdav)

===NFS ressursi kasutamine===

CIFS ressursi kasutamine koosneb kahest tegevusest

* Synology seadmel ressursi ettevalmistamisest
* Kliendi poolel ressursi poole pöördumisest (nt töökohaarvutisse kataloogipuu külge monteerimine)

NFS ressursi kasutamist saab ei saa piirata kasutajanime ja parooli abil. Saab piirata kliendi ip aadressiga.

====Serveri ettevalmistamine====

Control Panel -> Shared Folder -> valida rida ja topeltklõps -> NFS privileges (paremal üleval)

ning valida sobivad privileegid, nt

* TODO

====Linux klient====

# cat /etc/fstab
...
192.168.2.10:/volume1/rsnapshot /srv/backup nfs defaults 0 0

===CIFS ressursi kasutamine===

CIFS ressursi kasutamine koosneb kahest tegevusest

* Synology seadmel ressursi ettevalmistamisest
* Kliendi poolel ressursi poole pöördumisest (nt töökohaarvutisse kataloogipuu külge monteerimine)

CIFS ressursi kasutamist saab piirata kasutajanime ja parooli abil.

====Serveri ettavalmistamine====

TODO

====Linux klient ja smbclient====

Linux töökohaarvutist Synology CIFS ressursi kasutamiseks tuleb töökohaarvutisse esmalt paigaldada smbclient pakett

# apt-get install smbclient

Kui seejärel pöörduda serveri poole saab tõenäoliselt vastuseks

# smbclient //192.168.2.10/dokumentatsioon "priiduparool" -U priit
Server requested LM password but 'client plaintext auth = no' or 'client ntlmv2 auth = yes'
session setup failed: SUCCESS - 0

Aitab lisada Samba seadistusfaili /etc/samba/smb.conf global sektsiooni read (seda seadistusfaili kasutab nii Samba kliendi kui server tarkvara)

..
[global]
...
client lanman auth = yes
client plaintext auth = yes
client ntlmv2 auth = no

Seejärel peaks töötama paremini

# smbclient //192.168.2.10/dokumentatsioon "priiduparool" -U priit
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.2.8]
smb: \>

Lisaks saab Synology ressursse uurida öeldes

# smbclient -L //192.168.2.10 -U priit
Enter piit's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.2.8]

Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service ()
...

====Linux klient ja mount.cifs====

Paigaldamiseks tuleb öelda

# apt-get install cifs-utils

Seejärel öelda, tundub, et sec suvandiga sarnast tulemust millegipärast ei saa

# echo 0x30030 > /proc/fs/cifs/SecurityFlags

vastasel korral tekib dmesg väljundisse

[501026.262542] CIFS VFS: Server requests plain text password but client support disabled
[501028.631428] Status code returned 0xc0000022 NT_STATUS_ACCES_DENIED
[501028.631435] CIFS VFS: Send error in SessSetup = -13
[501028.632478] CIFS VFS: cifs_mount failed w/return code = -13

ning monteerida käsurealt, nt

# mount -t cifs //192.168.2.10/dokumentatsioon -o username=priit,password=priiduparool /mnt/dokumentatsioon

või /etc/fstab abil

# cat /etc/fstab
...
//192.168.2.10/dokumentatsioon /mnt/dokumentatsioon cifs \
credentials=/etc/samba/credentials,iocharset=utf8,file_mode=0777,dir_mode=0777 0 0

kus

* /etc/samba/credentials failis on

# cat /etc/samba/credentials
username=priit
password=priiduparool
# chmod 0600 /etc/samba/credentials

* TODO

===WebDAV===

====Teenuse ettevalmistamine====

HTTPS kasutamiseks tuleb laadida sertifikaadid valides

Control Panel -> Web Services -> HTTP Service

====Kasutamine Linux GNOME keskkonnast====

Töökohaarvuti GNOME keskkonnast kasutamiseks sobib valida

Places -> Connect to Server -> WebDAV

ning avaneb sarnane pilt

[[Pilt:Synology-1.gif]]

kus

* TODO

Kasutamiseks sobib avada

Places -> Home

====Kasutamine Linux mount abil====

Paigaldamiseks öelda

# apt-get install davfs2

Ajutisi andmeid hoitakse kataloogis

/var/cache/davfs2

Kliendi seadistamiseks tuleb /etc/davfs2/secrets faili lisada rida

https://10.198.206.12/dokumentatsioon priit priiduparool

ning /etc/fstab faili rida

https://10.198.206.12/dokumentatsioon /mnt/dokumentatsioon davfs user,noauto,file_mode=600,dir_mode=700 0 1

ning öelda

# mount /mnt/dokumentatsioon

Tulemusena on WebDAV ressurss monteeritud kataloogipuu külge ja seda saab kasutada nö tavalisel viisil.

====Kasutamine Windowsist====

Kasutamiseks sobib NetDrive http://www.netdrive.net/ tarkvara, kasutamisel tuleb olla hoolikas ja valida vajadusel Advanced alt https juurde linnuke.

===Shellis töötamine===

Synology shell toimub suhteliselt sarnaselt nö Linuxi shelline

# cat /proc/mdstat
# pvdisplay
# top
# ifconfig
# ps
# route -n
# cat /proc/cpuinfo

===Seadistuste varundamine===

Synology seadistuste varundamiseks tuleb avalda

Backup and Restore -> Configuration Backup -> Back up configuration

===Tarkvara uuendamine===

Synology seadme arkvara koosneb üldiselt kahest osast ja neid uuendatakse eraldi

* süsteem - esmalt uuendada
* paketid - seejärel uuendada

Vähemalt alates 4.0 versioonist saab tarkvara uuendamiseks valida

Control Panel -> DSM Update

[[Fail:20260903-synology-update-01.png|900px]]

Kasulikud lisamaterjalid

* http://www.synology.com/en-global/releaseNote/model/RS2211+

===Remote folder===

Külge ühendamiseks peab olema esmalt midagi võrgu ettevalmistatud külge ühendamiseks (nt teises Synologis nn Samba share)

File Station -> Tools -> Mount Remote Folder

Protocol -> CIFS
Folder -> \\10.1.1.15\varu
Account name -> admin
Passwor -> parool
Map to -> /backup

Lahti ühendamiseks avada hiire parema nupuga hüpikmenüüd File Station liideses vastaval mount point kataloogil ning

Umount

või kustuda vastav rida

File Station -> Tools -> Connection list

===Remote syslog server kasutamine===

Log Center -> ...

===SSH kliendiga ja võtmega sisselogimine===

Tundub, et kunagi oli vaja kohendada /etc/ssh/sshd_config faili, aga 2015 aastal piisab tekitada root kasutaja kodukataloogi .ssh kataloog ning sinna sobiva sisuga authorized_keys fail

syno> pwd
/root
syno> mkdir .ssh
syno> vi .ssh/authorized_keys
..

Kasulikud lisamaterjalid

* http://forum.synology.com/enu/viewtopic.php?f=36&t=79651

===Failisüsteemi parandamine===

Vahel võib juhtuda, et plokkseadmete ja failisüsteemidega esinevad vead, nt dmesg väljundis

[2536057.398423] ata4.00: failed command: READ FPDMA QUEUED
[2536057.403751] ata4.00: cmd 60/08:e8:20:6c:4d/00:00:14:00:00/40 tag 29 ncq 4096 in
[2536057.403753] res 41/40:1c:10:23:0f/40:00:15:00:00/40 Emask 0x9 (media error)
[2536057.419144] ata4.00: status: { DRDY ERR }
[2536057.423341] ata4.00: error: { UNC }
[2536057.427017] ata4.00: failed command: READ FPDMA QUEUED
[2536057.432344] ata4.00: cmd 60/10:f0:60:47:64/00:00:14:00:00/40 tag 30 ncq 8192 in
[2536057.432346] res 41/40:1c:10:23:0f/40:00:15:00:00/40 Emask 0x9 (media error)
[2536057.447747] ata4.00: status: { DRDY ERR }
[2536057.451942] ata4.00: error: { UNC }
[2536057.455624] ata4: hard resetting link
[2536057.915072] ata4: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[2536057.965072] ata4.00: configured for UDMA/133
[2536057.969587] ata4: EH complete
[2595525.600038] EXT4-fs (dm-0): error count: 3
[2595525.604321] EXT4-fs (dm-0): initial error at 1397768956: ext4_mb_generate_buddy:742
[2595525.612173] EXT4-fs (dm-0): last error at 1401231977: ext4_mb_generate_buddy:742
[2682033.120019] EXT4-fs (dm-0): error count: 3
[2682033.124300] EXT4-fs (dm-0): initial error at 1397768956: ext4_mb_generate_buddy:742
[2682033.132155] EXT4-fs (dm-0): last error at 1401231977: ext4_mb_generate_buddy:742
[2768540.640014] EXT4-fs (dm-0): error count: 3
[2768540.644299] EXT4-fs (dm-0): initial error at 1397768956: ext4_mb_generate_buddy:742
[2768540.652165] EXT4-fs (dm-0): last error at 1401231977: ext4_mb_generate_buddy:742
[2855048.160019] EXT4-fs (dm-0): error count: 3
[2855048.164297] EXT4-fs (dm-0): initial error at 1397768956: ext4_mb_generate_buddy:742
[2855048.172155] EXT4-fs (dm-0): last error at 1401231977: ext4_mb_generate_buddy:742
[2941555.680038] EXT4-fs (dm-0): error count: 3
[2941555.684325] EXT4-fs (dm-0): initial error at 1397768956: ext4_mb_generate_buddy:742
[2941555.692179] EXT4-fs (dm-0): last error at 1401231977: ext4_mb_generate_buddy:742
[3028063.200081] EXT4-fs (dm-0): error count: 3
[3028063.204369] EXT4-fs (dm-0): initial error at 1397768956: ext4_mb_generate_buddy:742
[3028063.212218] EXT4-fs (dm-0): last error at 1401231977: ext4_mb_generate_buddy:742
[3042303.003724] EXT4-fs error (device dm-0): ext4_mb_generate_buddy:742: group 45955, \
1480 clusters in bitmap, 1440 in gd
[3042303.014584] JBD2: Spotted dirty metadata buffer (dev = dm-0, blocknr = 0). \
There's a risk of filesystem corruption in case of system crash.
[3114570.720052] EXT4-fs (dm-0): error count: 4
[3114570.724332] EXT4-fs (dm-0): initial error at 1397768956: ext4_mb_generate_buddy:742
[3114570.732188] EXT4-fs (dm-0): last error at 1404250311: ext4_mb_generate_buddy:742

Esmalt teha kindlaks, milliseid plokkseadmeid kuidas kasutatakse

RackStation> cat /proc/mdstat
Personalities : [linear] [raid0] [raid1] [raid10] [raid6] [raid5] [raid4]
md2 : active raid6 sda5[0] sdi5[8] sdh5[7] sdg5[9] sdf5[5] sde5[4] sdd5[3] sdc5[2] sdb5[1]
13641457536 blocks super 1.2 level 6, 64k chunk, algorithm 2 [9/9] [UUUUUUUUU]

md1 : active raid1 sda2[0] sdb2[1] sdc2[2] sdd2[3] sde2[4] sdf2[5] sdg2[6] sdh2[7] sdi2[8]
2097088 blocks [10/9] [UUUUUUUUU_]

md0 : active raid1 sda1[0] sdb1[1] sdc1[2] sdd1[3] sde1[4] sdf1[5] sdg1[6] sdh1[7] sdi1[8]
2490176 blocks [10/9] [UUUUUUUUU_]

ja kuhu on ühendatud

RackStation> df -h
Filesystem Size Used Available Use% Mounted on
/dev/md0 2.3G 623.8M 1.6G 27% /
/tmp 496.0M 60.0K 495.9M 0% /tmp
/dev/vg1000/lv 12.5T 3.4T 9.1T 28% /volume1
/volume1/@optware 12.5T 3.4T 9.1T 28% /opt

RackStation> lvdisplay
--- Logical volume ---
LV Name /dev/vg1000/lv
VG Name vg1000
LV UUID StKLOg-H3OT-5dKC-JnYI-vkGe-ixAk-z1C143
LV Write Access read/write
LV Status available
# open 1
LV Size 12.70 TB
Current LE 3330433
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 512
Block device 253:0

RackStation> fdisk /dev/sda -l

Disk /dev/sda: 2000.3 GB, 2000398934016 bytes
255 heads, 63 sectors/track, 243201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System
/dev/sda1 1 311 2490240 fd Linux raid autodetect
Partition 1 does not end on cylinder boundary
/dev/sda2 311 572 2097152 fd Linux raid autodetect
Partition 2 does not end on cylinder boundary
/dev/sda3 588 243201 1948788912 f Win95 Ext'd (LBA)
/dev/sda5 589 243201 1948780864 fd Linux raid autodetect

Seejärel lõpetada võimalikult paljude protsesside töö, v.a. ssh server

RackStation> syno_poweroff_task -d

Kuna lsof programm vaikimisi puudub, kontrollida vajadusel nii, millised failid takistavad lahti ühendamist

RackStation> ls -R -la /proc 2>&1 | grep volume1

Ühendada vajadusel raid kokku

RackStation> mdadm -A /dev/md2 /dev/sda5 /dev/sdi5 /dev/sdh5 /dev/sdg5 /dev/sdf5 \
/dev/sde5 /dev/sdd5 /dev/sdc5 /dev/sdb5
mdadm: /dev/md2 has been started with 9 drives.

LVM köite aktiivseks tegemiseks öelda

# vgchange -ay

Käivitada soovitavalt läbi screen peal käivitatud ssh kliendi failisüsteemi kontroll (ja parandus)

RackStation> fsck.ext4 -pv /dev/vg1000/lv
1.41.10-1594: Group descriptor 30236 has invalid unused inodes count 8099. FIXED.
1.41.10-1594: Group descriptor 30866 has invalid unused inodes count 8024. FIXED.
1.41.10-1594: Group descriptor 46365 has invalid unused inodes count 8089. FIXED.
1.41.10-1594 contains a file system with errors, check forced.
...
1.41.10-1594: Inodes that were part of a corrupted orphan linked list found.
1.41.10-1594: UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY.
(i.e., without -a or -p options)

Ja küllap sel juhul tuleb parem teha nagu öeldakse

RackStation> fsck.ext4 -v -C 0 /dev/vg1000/lv
e2fsck 1.42.6 (21-Sep-2012)
1.41.10-1594 contains a file system with errors, check forced.
Pass 1: Checking inodes, blocks, and sizes
1.41.10-1594: |====== \ 25.4%

Märkused

Alglaadimise käigus käivitatakse

# e2fsck -nq /dev/vg1000/lv

Kasulikud lisamaterjalid

* http://forum.synology.com/enu/viewtopic.php?f=7&t=83726&start=15
* http://boomkicker.wordpress.com/2013/02/14/scrub-synology-raid-disks/
* http://www.cyberciti.biz/faq/synology-complete-fsck-file-system-check-command/
* http://forum.synology.com/wiki/index.php/How_to_give_your_disks_and_files_a_health_check_and_repair_basic_faults
* http://www.naschenweng.info/2012/03/25/fixing-file-system-corruption-synology-nas/
* http://www.berthon.eu/2014/how-to-verify-your-synology-nas-hard-disks/
* http://forum.synology.com/enu/viewtopic.php?f=7&t=53431&p=256279

===XPEnology===

XPEnology lahenduseks nimetakakse sellist nö kohendust, mille abil saab tavalist arvutit kasutada nagu Synology seadet. Kuna tavaliselt Synology seadmeid ei ole kasutada nö üks rohkem kui reaalselt vaja, siis sobib XPEnology hästi Synology süsteemi tundmaõppimiseks (nt kuidas toimub plokkseadmete, volume'ite, teenuste jms haldamine).

====Tööpõhimõte====

Tundub, et Synology originaal-riistvaral on nö miski sees, mis peale seadme käivitamist teeb ta nähtavaks Synology Assistantile üle võrgu ja seejärel saavad nad omavahel suhelda. Muu hulgas teeb see suhtlemine võimaliuks paigaldada seadmesse Synology tarkvara. Selleks, et nö tavaline arvuti paistaks Synology Assistant jaoks nagu originaal Synology seade, tuleb see tavaline arvuti käivitada spetsiaalselt ettevalmistatud plokkseadmelt. Selliste plokkseadmete tõmmiseid on erinevaid

* gnoboot - eeliseks on ka asjaolu, et edasine töö toimub originaal Synology .pat arhiivga
* nanoboot - eeliseks on ka asjaolu, et edasine töö toimub originaal Synology .pat arhiivga

Tundub, et nanoboot on 2014 aasta suvel kõige edulisem variant.

====Paigaldamine QEMU-KVM keskkonda NanoBoot abil====

Tundub, et XPEnology õnnestub käivitada QEMU-KVM virtuaalsel arvutil

* disk 0 - IDE (.raw formaadis fail, nt 1G suurusega)
* disk 1, 2, 3 jne - SATA (vähemalt üks on tingimata vajalik)
* protsessor - qemu64
* võrgukaart - e1000

# cp /tmp/NB_x64_5031_DSM_50-4493_Xpenology_nl.img /var/lib/vz/images/126/vm-126-disk-1.raw

Seejärel arvuti käivitada, konsoolil näeb teateid, sh GRUB ning kui on käivitunud, saab pöörduda Synology Assistent abil ja edasi paigaldada Synology tarkvara tavalisel viisil. Paigaldatud v. 4493 peale v 4493 update 2 rakendamine toimub läbi veebiliidese, st midagi käsurealt või kuskilt kohendada pole tarvis.

Konsoolilt saab ka sisse logida, nt kasutaja root ja kasutaja admin parool

[[Pilt:Synology-2.gif]]

Kasulikud lisamaterjalid

* http://www.xpenology.nl/boot-images/
* http://www.xpenology.nl/installatie-dsm-5-0-4493-update-2/

====Paigaldamine QEMU-KVM keskkonda gnoboot abil====

Tundub, et XPEnology õnnestub käivitada QEMU-KVM virtuaalsel arvutil

* disk 0 - IDE (.raw formaadis fail, nt 1G suurusega)
* disk 1, 2, 3 jne - SATA (vähemalt üks on tingimata vajalik)
* protsessor - qemu64
* võrgukaart - e1000

# cp /tmp/gnoboot-alpha10.5-ext2.img /var/lib/vz/images/126/vm-126-disk-1.raw

Kasulikud lisamaterjalid

* TODO

====Kasulikud lisamaterjalid====

* http://www.robvanhamersveld.nl/2013/01/21/install-and-test-synology-dsm-in-a-virtual-machine/
* http://thedarkcloud.net/setting-gnoboot-synology-dsm-5-0-esxi-5-5-setup/
* http://cyanlabs.net/tutorials/install-xpenology-on-the-n54l-without-esxi
* http://www.wijngaard.org/synology-virtual-diskstation-5-0-with-virtualbox/

===iSCSI ressursi väljajagamine===

Väited

* CHAP kasutajanimi 8 märki ja parool 12 - 16, mis sisaldab [0-9,a-z,A-Z] märkidest igast komplektist vähemalt ühte ja mitte muid märke

====Synology iSCSI server====

Synology v. 7 webgui liideses toimub iscsi serveri poole seadistamine 'SAN Manager' rakenduse abil

[[Fail:20260406-synology-iscsi-01.png|800px]]

kus

* kuna synology kasutab btrfs failisüsteemi, siis on võimalik kasutada snapshottimist
* sektsioonis 'iscsi' asuvad iscsi target kirjeldused

Queue suurus, mida iscsi server publitseerib oma iscsi kliendile

[[Fail:20260406-synology-iscsi-02.png|800px]]

kliendi vaatest

<pre>
root@pve-npl-01:~# lsscsi -s
[18:0:0:2] disk SYNOLOGY Storage 4.0 /dev/sda 107GB
[N:0:0:1] disk MTFDKCC7T6TGP-1BK1JABYY__1 /dev/nvme0n1 7.68TB
[N:1:0:1] disk MTFDKCC7T6TGP-1BK1JABYY__1 /dev/nvme1n1 7.68TB

root@pve-npl-01:~# cat /sys/block/sda/queue/nr_requests
226

root@pve-npl-01:~# cat /sys/block/sda/device/queue_depth
64

root@pve-npl-01:~# iscsiadm -m node -T iqn.2000-01.com.synology:syno-02.Target-2.03a0d61e0a4 -p 10.0.20.51:3260 -o update -n node.session.queue_depth -v 64
</pre>

Selle suurusega on omajagu segane lugu, võib olla on mõistlik sättida synology poolelt vaikimisi 64 ja linux poolelt vaikimisi 32. Nelja kettaga syno puhul on füüsiliste ketaste queue length

<pre>
root@syno-02:~# cat /sys/block/sata*/device/queue_depth
31
31
31
31
</pre>

LUN seadistused

[[Fail:20260406-synology-iscsi-03.png|800px]]

kus

* TODO

[[Fail:20260406-synology-iscsi-04.png|800px]]

kus

* TODO

====Open-iSCSI Linux klient====

Tavalisel juhtumil paistab iscsi ressurssi kasutamine kliendi poolelt välja nt selliselt

<pre>
root@pve-npl-01:~# iscsiadm -m session -P 3
iSCSI Transport Class version 2.0-870
version 2.1.11
Target: iqn.2000-01.com.synology:syno-02.Target-2.03a0d61e0a4 (non-flash)
Current Portal: 10.0.20.51:3260,1
Persistent Portal: 10.0.20.51:3260,1
**********
Interface:
**********
Iface Name: default
Iface Transport: tcp
Iface Initiatorname: iqn.1993-08.org.debian:01:c533b1c12785
Iface IPaddress: 10.0.20.17
Iface HWaddress: default
Iface Netdev: default
SID: 36
iSCSI Connection State: LOGGED IN
iSCSI Session State: LOGGED_IN
Internal iscsid Session State: NO CHANGE
*********
Timeouts:
*********
Recovery Timeout: 120
Target Reset Timeout: 30
LUN Reset Timeout: 30
Abort Timeout: 15
*****
CHAP:
*****
username: <empty>
password: ********
username_in: <empty>
password_in: ********
************************
Negotiated iSCSI params:
************************
HeaderDigest: None
DataDigest: None
MaxRecvDataSegmentLength: 262144
MaxXmitDataSegmentLength: 262144
FirstBurstLength: 65536
MaxBurstLength: 262144
ImmediateData: Yes
InitialR2T: Yes
MaxOutstandingR2T: 1
************************
Attached SCSI devices:
************************
Host Number: 18 State: running
scsi18 Channel 00 Id 0 Lun: 2
Attached scsi disk sda State: running
</pre>

kus on eraldatud sektsioonid

Interface

* TODO

Timeouts

* TODO

CHAP

* TODO

Negotiated iSCSI params - vahel annavad asjaosalised üksteisele paindlikkust konkreetse väärtuse valimisel; vahel mitte, ja vahel ei õnnestugi suhtlemist kokku leppida (kui ühisosa puudub, nt kui üks ütleb, et teha header digest ja teine, et mitte teha)

* HeaderDigest
* DataDigest

Attached SCSI devices

* TODO

====provisioning_mode kliendi poolel====

Osutub, et uuemal ajal 2026 suve lõpus kättesaadavate synology mudelite ja v. 7 tarkvara puhul ütleb seade, et ta on võimeline unmap/samewrite_16/jms tegevusteks, aga tegelikult ei ole (eriti kui ta sisaldab pöörlevaid kettaid ning storage ressurss on think synology valikute mõttes). Probleemiks muutub see nt 3 TB plokkseadme st lun välja jagamisel linux kliendile ning ext4 failisüsteemi tekitamisel tavalisel viisil, võtab aega nii tund aega

<pre>
...
# mkfs.ext4 /dev/mapper/vg_remote_pbs_new-srv_pbs_new
</pre>

Taustal on näha suur discard tegevus iscsi kliendi arvutis

<pre>
# iostat -m -x 5 /dev/sda /dev/sdb
</pre>

Iseloomulik väljund on

<pre>
# lsblk -D /dev/sdb
NAME DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO
sdb 0 512B 2M 0
└─vg_remote_pbs_new-srv_pbs_new 0 512B 2M 0
</pre>

Käitumist saab muuta kliendi poolel konkreetse scsi seadme jaoks (mitte iscsi seadme jaoks)

<pre>
# lsscsi -s
[1:0:0:0] cd/dvd QEMU QEMU DVD-ROM 2.5+ /dev/sr0 1.07GB
[6:0:0:1] disk SYNOLOGY iSCSI Storage 4.0 /dev/sda 2.14TB
[7:0:0:1] disk SYNOLOGY Storage 4.0 /dev/sdb 3.29TB

# cat /sys/block/sdb/device/scsi_disk/7\:0\:0\:1/provisioning_mode
writesame_16

# echo "disabled" > /sys/block/sdb/device/scsi_disk/7\:0\:0\:1/provisioning_mode
</pre>

ning väidetavalt saab selle persistentiks udev abil

<pre>
# /etc/udev/rules.d/99-disable-unmap-synology-lun.rules
ACTION=="add", SUBSYSTEM=="scsi_disk", ATTRS{model}=="iSCSI Storage*", ATTR{provisioning_mode}="disabled"
</pre>

Alternatiiv on mkfs.ext4 puhul öelda, et ta ei teeks taustal discard'i

<pre>
# mkfs.ext4 -E nodiscard /dev/vg_remote_pbs_new/srv_pbs_new
</pre>

ext4 lähtestamisel on discard praktiline sellistel asjaoludel

* ressurss on üle iscsi välja jagatud thin viisil
* ressurssi on juba kasutatud, ja ta on nö kogukamaks paisunud
* kliendi poolel tehakse uuesti ext4 failisüsteem
* tulemusena antakse kliendi poolse tegevusega storage backend poolele mingisse pool'i ressurssi tagasi

Väited

* kliendi poolel on tegu ühe ja sama discard-trim-jms signaali saatmisega
* teine pool võib sõltuvalt tehnilisest lahendusest sellele signaalile reageerida erinevalt: 1. ssd puhul wearout teemaliselt, 2. thin provisioning puhul ruumi vabastamisega
* samewrite_16 kasutamine tegeleb kahe nähtusega: 1. unmap, 2. ettenähtud sisuga vabastatud ressursi üle kirjutamine

===Logimine syslog serverisse üle võrgu===

Logimine syslog serverisse üle võrgu

Main Menu -> Log Center -> Log Sending

===Märkused===

* RAID lülituse komponendi st füüsilise kõvaketta riknemisel võib süsteem hakata meeleheitlikult tegelema RAID lülituse parandamisega ja tulemuseks on kogu süsteemi IO aeglus. Tundub, et ajutise lahendusena võib olla lülitada seade shutdown'i või seadmel toide välja, seejärel probleemne kõvaketas eemaldada ning taas lülitada käima.

* Tundub, et Synology puhul on vaikimisi raid resync kiirus 10k/s, ja et seda saab sama sysctl -w parameetrile uue väärtusega muuta

RackStation> sysctl dev.raid.speed_limit_min
dev.raid.speed_limit_min = 10000

Samas peaks kaaluma, kas seda on mõistlik teha, resync saab kiiremini valmis, aga sel ajal on süsteemil vähem ressurssi nö teenuse pakkumiseks.

===Western Digital nn Green ketaste kasutamine===

Western Digital toodab Green märkega kettaid, nt mudel WD20EARS-00MVWB mis kasutan Intellipark tehnoloogiat. Vaikimisi läheb selline ketas 8 sekundi mitte-kasutuse järel teisse režiimi ja järgmisel kasutamisel tagasi, toimub Load Cycle ja suurendatakse SMART LCC (Load Cycle Count) väärtust. Spetsifikatsioon kõneleb, et WD20EARS-00MVWB kettad kannatab sellised tsükleid 300k tükki. Tegelikult ei ole WD20EARS-00MVWB kettad ametlikult Synology poolt toetatud, aga tundub, et praktiliselt saab neid siiski kasutada. Parasjagu kehtestatud seadistust saab küsida selliselt

RackStation> syno_disk_ctl --wd-idle -g /dev/sda
Get /dev/sda WD idle3 timer [0] successfully
RackStation> syno_disk_ctl --wd-idle -g /dev/sdb
Get /dev/sdb WD idle3 timer [0] successfully

kus

* [0] - kõnealuse ketta Intellipark featuur on välja lülitatud

Mõned allikad soovitavad lisaks rakendada suhteliselt pikka hibernation time väärtust, kuni väljalülitamiseni

Control Panel -> Hardware & Power -> HDD hibernation

Kasulikud lisamaterjalid

* http://forum.synology.com/enu/viewtopic.php?f=124&t=82215
* http://idle3-tools.sourceforge.net/
* http://blog.fosketts.net/2011/04/27/western-digital-intellipark-feature-design-flaw/
* http://www.wdc.com/wdproducts/library/SpecSheet/ENG/2879-701229.pdf
* http://wiki.nas4free.org/doku.php?id=faq:0148

===Synology ketaste kasutamine Linux keskkonnas===

Tundub, et üks Synology hea omadus seisneb selles, et andmesalvestuseks kasutatakse standardseid Linux vahendeid

* mdadm tarkvaraline raid
* LVM köitehaldus
* ext4 failisüsteem
* iSCSI

Nt Synology seadme riknemisel sobib paigutada kõvakettad tavalise Linux operatsioonisüsteemiga töötava arvuti külge ja saab andmetele ligi.

===Kõvaketaste asendamine suurematega===

* veenduda, et kasutatakse kõige uuemat Synology tarkvara
* veenduda, et raid1 ühendus on redundantne, st kettad on süngis
* shutdown ja asendada üks ketas suuremaga (pole vahet kumb)
* käivitada ja veenduda, et uus ketas on initsialiseerimata, aga muus osas ära tuntud; taustal on näha

<pre>
root@syno:~# cat /proc/mdstat
Personalities : [linear] [raid0] [raid1] [raid10] [raid6] [raid5] [raid4]
md2 : active raid1 sdb5[1]
971931264 blocks super 1.2 [2/1] [_U]

md1 : active raid1 sdb2[1]
2097088 blocks [2/1] [_U]

md0 : active raid1 sdb1[1]
2490176 blocks [2/1] [_U]

unused devices: <none>
</pre>

<pre>
root@syno:~# parted /dev/sda p
Error: /dev/sda: unrecognised disk label
Model: ATA ST4000VN008-2DR1 (scsi)
Disk /dev/sda: 4001GB
Sector size (logical/physical): 512B/512B
Partition Table: unknown
Disk Flags:
</pre>

* valida repair

Storage Manager -> Disk Group -> Manage -> Repair -> edasi jaatavalt -> Apply

taustal toimub mdadm raid1 sünkroniseerimine

<pre>
root@syno:~# cat /proc/mdstat
Personalities : [linear] [raid0] [raid1] [raid10] [raid6] [raid5] [raid4]
md2 : active raid1 sda5[2] sdb5[1]
971931264 blocks super 1.2 [2/1] [_U]
[>....................] recovery = 0.1% (1202688/971931264) finish=215.2min speed=75168K/sec

md1 : active raid1 sda2[0] sdb2[1]
2097088 blocks [2/2] [UU]

md0 : active raid1 sda1[0] sdb1[1]
2490176 blocks [2/2] [UU]

unused devices: <none>
</pre>

GUI liideses paistab progress selliselt

[[Pilt:Synology-4.gif|900px]]

Kasulikud lisamaterjalid

* https://originwww.synology.com/en-uk/knowledgebase/DSM/help/DSM/StorageManager/volume_diskgroup_expand_replace_disk

===L2TP/IPSec vpn kasutamine===

TODO

Kasulikud lisamaterjalid

* https://www.synology.com/en-global/knowledgebase/DSM/help/VPNCenter/vpn_setup

===2026 aasta alguse märkmed===

Mudel Synology RS822RP+ paigaldamine paistab selliselt

[[Fail:20260218-synology-01.png|900px]]

kus

* tarkvara versioon - 7.x

====Tööpõhimõte - andmesalvestus====

Seadistatud Synology andmesalvestuse osakond paistab nt selline

[[Fail:20260403-synology-storage-btrfs-01.png|900px]]

kus

* süsteemis on kaustusel 4 x 7.3 TB füüsilised hdd kettad
* neljast kettast on moodustatud 2-ketta redundantsusega lülitus - Synology Hybrid RAID (SHR)

Käsurealt uurides paistab selline lahendus, füüsised seadmed on partitsioneeritud ning moodustatud üks suur mdadm ressurss raid6 lülituses

<pre>
root@syno-02:~# cat /proc/mdstat
Personalities : [raid1] [raid6] [raid5] [raid4] [raidF1]
md2 : active raid6 sata3p5[0] sata2p5[3] sata1p5[2] sata4p5[1]
15606599168 blocks super 1.2 level 6, 64k chunk, algorithm 2 [4/4] [UUUU]

md1 : active raid1 sata3p2[0] sata2p2[3] sata1p2[2] sata4p2[1]
2097088 blocks [4/4] [UUUU]

md0 : active raid1 sata3p1[0] sata2p1[3] sata1p1[2] sata4p1[1]
8388544 blocks [4/4] [UUUU]

unused devices: <none>
</pre>

mdadm ressursile on moodustatud lvm volume group

<pre>
root@syno-02:~# vgdisplay
--- Volume group ---
VG Name vg1
System ID
Format lvm2
Metadata Areas 1
Metadata Sequence No 4
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 3
Open LV 2
Max PV 0
Cur PV 1
Act PV 1
VG Size 14.53 TiB
PE Size 4.00 MiB
Total PE 3810204
Alloc PE / Size 268291 / 1.02 TiB
Free PE / Size 3541913 / 13.51 TiB
VG UUID hrppbu-qIHS-ItrZ-keg9-SbKx-tP0O-Gdpnm0
</pre>

lvm volume group koosseisus on lvm volume'id

<pre>
root@syno-02:~# lvdisplay vg1
--- Logical volume ---
LV Path /dev/vg1/syno_vg_reserved_area
LV Name syno_vg_reserved_area
VG Name vg1
LV UUID YnNfms-F3hi-Z5Io-tSFg-tn61-mxiT-N2IBcr
LV Write Access read/write
LV Creation host, time ,
LV Status available
# open 0
LV Size 12.00 MiB
Current LE 3
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 512
Block device 248:0

--- Logical volume ---
LV Path /dev/vg1/volume_1
LV Name volume_1
VG Name vg1
LV UUID rNuz8K-fgQF-81fa-FaMt-cuHQ-QQsC-6nOFfy
LV Write Access read/write
LV Creation host, time ,
LV Status available
# open 1
LV Size 1.00 TiB
Current LE 262144
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 512
Block device 248:1

--- Logical volume ---
LV Path /dev/vg1/volume_2
LV Name volume_2
VG Name vg1
LV UUID v1vtmT-upig-YKN1-iUjY-A0Er-2LiC-iHkLq2
LV Write Access read/write
LV Creation host, time ,
LV Status available
# open 1
LV Size 24.00 GiB
Current LE 6144
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 512
Block device 248:3
</pre>

lvm volumite nö ette on rakendatud lvm cache (mõeldud ssd ketastest ja hdd ketastest koosneva lahenduse valmisolekuks), aga praegu on see placeholder (cache mode DUMMY)

<pre>
root@syno-02:~# dmsetup ls --tree
vg1-syno_vg_reserved_area (248:0)
└─ (9:2)
cachedev_1 (248:4)
└─vg1-volume_2 (248:3)
└─ (9:2)
cachedev_0 (248:2)
└─vg1-volume_1 (248:1)
└─ (9:2)

root@syno-02:~# dmsetup table cachedev_0
0 2147483648 flashcache-syno conf:
ssd dev (none), disk dev (/dev/vg1/volume_1) cache mode(DUMMY)
capacity(0M), associativity(0), data block size(0K)
skip sequential thresh(0K)
total blocks(0), cached blocks(0), cache percent(0)
nr_queued(0) save meta only(0)
split-io(0) support pin file(0) version(0)
Size Hist:
bits_all=0 bits_used=0
</pre>

lvm volume cache device on aluseks btrfs failisüsteemile (single device režiimis)

<pre>
root@syno-02:~# btrfs fi show
Label: '2026.02.18-23:51:50 v86009' uuid: a92b6590-a8d3-449d-9648-969f37c56fcb
Total devices 1 FS bytes used 66.66MiB
devid 1 size 1.00TiB used 12.02GiB path /dev/mapper/cachedev_0

Label: '2026.04.03-12:14:30 v86009' uuid: 22ce1c49-e583-4764-81ab-91e46228327e
Total devices 1 FS bytes used 280.00KiB
devid 1 size 24.00GiB used 536.00MiB path /dev/mapper/cachedev_1
</pre>

tulemus paistab selline

<pre>
root@syno-02:~# df -h -T -t btrfs
Filesystem Type Size Used Avail Use% Mounted on
/dev/mapper/cachedev_0 btrfs 984G 82M 983G 1% /volume1
/dev/mapper/cachedev_1 btrfs 24G 18M 24G 1% /volume2
</pre>

Väited

* btrfs ei ole kasutusel volume halduse vms redundantse jaoks - ainult failisüsteem
* füüsiliste seadmete redundantsusega tegeleb mdadm
* Synology ime seisneb btrfs ja mdadm integratsioonis - kui btrfs avastab kontrollsummamise abil vea, siis ta saadab signaali mdadm osakonda ja mdadm nö proovib paremini (kaustab raid lülituse teist komponenti)
* mdadm lülituseks on mitte raid10 aga raid6 - mõttega, et nii võib kokku rikneda kaks suvalist füüsilist ketast ning andmed on veel alles

====Tööpõhimõte - võrk====

Antud juhul kasutatakse 10/25 Gbit/s Broadcom võrguseadet

Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter

<pre>
root@syno-02:~# lspci -vvv
...

01:00.0 Class 0200: Device 14e4:16d7 (rev 01)
Subsystem: Device 7053:100c
Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
Latency: 0
Interrupt: pin A routed to IRQ 338
Region 0: Memory at 81210000 (64-bit, prefetchable) [size=64K]
Region 2: Memory at 81100000 (64-bit, prefetchable) [size=1M]
Region 4: Memory at 812a2000 (64-bit, prefetchable) [size=8K]
Expansion ROM at 81f00000 [disabled] [size=512K]
Capabilities: [48] Power Management version 3
Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold-)
Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=1 PME-
Capabilities: [50] Vital Product Data
Product Name: Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter
Read-only fields:
[PN] Part number: BCM957414A4142CC
[MN] Manufacture ID: 14E4
[V0] Vendor specific: 222.1.68.0
[V1] Vendor specific: 222.0.137.0
[V3] Vendor specific: 222.0.138.0
[V6] Vendor specific: 222.0.137.0
[V7] Vendor specific: 222.0.137.0
[V8] Vendor specific: 222.0.138.0
[V9] Vendor specific: 222.0.137.0
[VA] Vendor specific: 222.0.138.0
[VB] Vendor specific: REV005DEV001DEV002DEV003DEV004DEV005
[SN] Serial number: 2550VQRPJP8P4000
[RV] Reserved: checksum good, 126 byte(s) reserved
End
Capabilities: [58] MSI: Enable- Count=1/8 Maskable- 64bit+
Address: 0000000000000000 Data: 0000
Capabilities: [a0] MSI-X: Enable+ Count=74 Masked-
Vector table: BAR=4 offset=00000000
PBA: BAR=4 offset=000004a0
Capabilities: [ac] Express (v2) Endpoint, MSI 00
DevCap: MaxPayload 512 bytes, PhantFunc 0, Latency L0s <4us, L1 <64us
ExtTag+ AttnBtn- AttnInd- PwrInd- RBE+ FLReset+ SlotPowerLimit 0.000W
DevCtl: CorrErr+ NonFatalErr+ FatalErr+ UnsupReq+
RlxdOrd+ ExtTag+ PhantFunc- AuxPwr+ NoSnoop+ FLReset-
MaxPayload 512 bytes, MaxReadReq 512 bytes
DevSta: CorrErr+ NonFatalErr- FatalErr- UnsupReq+ AuxPwr- TransPend-
LnkCap: Port #0, Speed 8GT/s, Width x8, ASPM not supported
ClockPM+ Surprise- LLActRep- BwNot- ASPMOptComp+
LnkCtl: ASPM Disabled; RCB 64 bytes Disabled- CommClk+
ExtSynch- ClockPM- AutWidDis- BWInt- AutBWInt-
LnkSta: Speed 8GT/s (ok), Width x4 (downgraded)
TrErr- Train- SlotClk+ DLActive- BWMgmt- ABWMgmt-
DevCap2: Completion Timeout: Range ABCD, TimeoutDis+, LTR+, OBFF Via WAKE#
AtomicOpsCap: 32bit- 64bit- 128bitCAS-
DevCtl2: Completion Timeout: 50us to 50ms, TimeoutDis-, LTR-, OBFF Disabled
AtomicOpsCtl: ReqEn-
LnkCtl2: Target Link Speed: 2.5GT/s, EnterCompliance- SpeedDis-
Transmit Margin: Normal Operating Range, EnterModifiedCompliance- ComplianceSOS-
Compliance De-emphasis: -6dB
LnkSta2: Current De-emphasis Level: -3.5dB, EqualizationComplete+, EqualizationPhase1+
EqualizationPhase2+, EqualizationPhase3+, LinkEqualizationRequest-
...
</pre>

ning

<pre>
root@syno-02:~# ethtool -i eth5
driver: bnxt_en
version: 1.10.2-222.0.142.0
firmware-version: 222.1.81.32002/pkg N/A
expansion-rom-version:
bus-info: 0000:01:00.1
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
supports-priv-flags: yes

root@syno-02:~# ethtool eth5
Settings for eth5:
Supported ports: [ FIBRE ]
Supported link modes: 25000baseCR/Full
10000baseCR/Full
Supported pause frame use: Symmetric Receive-only
Supports auto-negotiation: Yes
Supported FEC modes: Not reported
Advertised link modes: 25000baseCR/Full
10000baseCR/Full
Advertised pause frame use: Symmetric
Advertised auto-negotiation: Yes
Advertised FEC modes: Not reported
Speed: 25000Mb/s
Duplex: Full
Port: Direct Attach Copper
PHYAD: 1
Transceiver: internal
Auto-negotiation: on
Supports Wake-on: g
Wake-on: d
Current message level: 0x000020c1 (8385)
drv rx_err tx_err hw
Link detected: yes
</pre>

===Synology account===

Võib olla on asjakohane pidada synology accounti ja seade registreerida

[[Fail:20260403-synology-storage-account-01.png|900px]]

kus

* TODO

===Synology insight===

Võib olla on asjakohane pidada synology accounti ja seade registreerida ning lisaks tekitada active insight subscription tasuta ning seal seade registreerida

[[Fail:20260403-synology-storage-insight-01.png|900px]]

kus

* TODO

===Package Center===

Uuendamine

[[Fail:20260903-synology-package-center-01.png|900px]]

kus

* TODO

===Tulemüür===

TODO

===Kasulikud lisamaterjalid===

* http://forum.synology.com/wiki
* http://en.wikipedia.org/wiki/Synology_Inc.
* http://blog.wrgms.com/recovering-a-failed-synology-diskstation-ds2xx-serial/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-09-16T18:25:06Z

Imre: /* Force quit application */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta paigaldamine===

<pre>
$ softwareupdate --install-rosetta
</pre>

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-09-16T18:24:17Z

Imre: /* Force quit application */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta paigaldamine===

<pre>
$ softwareupdate --install-rosetta
</pre>

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Cmd+Opt+Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-09-16T18:24:09Z

Imre: /* Force quit application */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta paigaldamine===

<pre>
$ softwareupdate --install-rosetta
</pre>

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Cmd+Opt+Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|300px]]

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-09-16T18:24:03Z

Imre: /* Force quit application */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta paigaldamine===

<pre>
$ softwareupdate --install-rosetta
</pre>

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Cmd+Opt+Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|600px]]

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

Fail:20260916-macos-force-quit-01.png

2026-09-16T18:23:41Z

Imre:

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-09-16T18:23:27Z

Imre: /* Kasulikud lisamaterjalid */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta paigaldamine===

<pre>
$ softwareupdate --install-rosetta
</pre>

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Cmd+Opt+Esc

ja paistab selline pilt

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

Claude Desktop - MacOS

2026-09-16T18:11:36Z

Imre: /* Playwright kasutamine */

===Sissejuhatus===

Väited

* Claude tähistab üldiselt tootja Anthropic ühte toodete komplekti - keelemudel, teenus, klienttarkavara, protokoll jne
* käesolev tekst keskendub Claude abil agentse lahenduse kasutamisele - st eesmärgiks on, et inimene istub koos agendiga samas aruvutis ja nad koos teevad midagi aktiivselt (nt paigaldavad arvutisse tarkvara, analüüsivad arvutis toimuvaid protsesse jne (jutt ei ole inimese töökohaarvutist, aga mingist muust arvutist, nt serverist)
* Claude agentset kasutamist tähistatakse 'Claude Code'
* Claude Code kasutamiseks on tingimata tarvis paigaldada kas töökohaarvutisse või serverisse Claude agendi tarkvara
* Claude Code kasutamiseks on tingimata tarvis kasutada sobivat kommerts teenust (nt Pro taseme subscription abil)
* kuigi käesolev tekst soovib keskenduda agentsele kasutamisele on Claude Desktop rakendus praktiliselt nii Chat, Code ja Cowork funktsioonidega
* Claude rakenduse Chat funktsioon on analoogne veebikoha https://claude.ai/ kasutamisele
* Claude Desktop app ei sisalda otseselt käsurea kasutamise st terminalis töötamise võimalust (nii, et visuaalselt on prompt kasutada)

Misc

* https://claude.com/ - korporatiivne veebikoht (info kasutajaks saamise kohta, tarkvara allalaadimine, kasutusjuhised jne)
* https://claude.ai/ - online chat teenus

===Tööpõhimõte===

====Claude Chat režiim====

Claude Desktop App kasutamine Chat režiimis paistab välja selline

[[Fail:20260717-cc-app-macos-03.png|800px]]

kus

* TODO

====Claude Code režiim====

Claude Desktop App kasutamine Code režiimis paistab välja selline

[[Fail:20260717-cc-app-macos-04.png|800px]]

kus

* käsundamine toimub selles operatsioonisüsteemis, kus claude desktop protsess töötab st macos operatsioonisüsteemis enda (mitte mõnes virtuaalses arvutis)

Tegevustega seotud tulemused asuvad kaustas (mis esmakordsel käivitamisel saab rakendusele ütlelda, st et toimetagu '/Users/imreoolberg/cc-01' kaustas ja sealt edasi

<pre>
imreoolberg@Imres-MacBook-Air cc-01 % pwd
/Users/imreoolberg/cc-01

imreoolberg@Imres-MacBook-Air cc-01 % find . -ls
123993344 0 drwxr-xr-x 3 imreoolberg staff 96 Jul 17 14:04 .
123993560 0 drwxr-xr-x 4 imreoolberg staff 128 Jul 17 14:13 ./imre-test-01
123995650 8 -rw-r--r-- 1 imreoolberg staff 822 Jul 17 14:13 ./imre-test-01/random.auul.pri.ee.cert.pem
123995649 8 -rw-r--r-- 1 imreoolberg staff 227 Jul 17 14:13 ./imre-test-01/random.auul.pri.ee.key.pem
</pre>

====Claude Cowork režiim====

Väited

* cowork režiim on turvalisem kui claude-code režiim, sest tegevused toimuvad eraldi abistavas virtuaalses arvutis
* cowork virtuaalne arvuti ei saa tavalises mõttes võrku (tcp/ip mõttes) - suhtlemine ümbrusega toimub connectorite abil
* abistavad vahendid on plugins, connectors ja skills (plugin kombineerib hulga skille ja konnektoreid)

Cowork režiimis esmalt moodustatakse projekt ning seostada folderiga

[[Fail:20260721-cc-app-macos-03.png|450px]]

seejärel palve midagi teha, nt 'please create self-signed x509 certificate for dns name p-cowork-03.auul.pri.ee, rsa crypto, 2048 bit and 1 year expiration, save certificate and key in this project associated shared folder'

[[Fail:20260721-cc-app-macos-04.png|1100px]]

seejärel palve tulemust esitada nimekirja kujul, kui tulemus paluda salvestada faili, siis saab seda esitada eraldi paremal olevas kolmandas paneelis

[[Fail:20260721-cc-app-macos-05.png|1100px]]

ja lõpuks palve midagi väljendada enda keskkonna kohta - siis saab kinnituse, et tegu on macos peal töötava ajutise abistama Ubuntu v. 22.04 virtuaalse arvutiga

[[Fail:20260721-cc-app-macos-06.png|1100px]]

Lõpuks on kogunenud projekti kataloogi sellised failid, macos poolelt vaadates

<pre>
imreoolberg@Imres-MacBook-Air ~ % find p-cowork-03-fld-01 -type f -ls
124551478 8 -rw------- 1 imreoolberg staff 1704 Jul 21 15:22 p-cowork-03-fld-01/p-cowork-03.auul.pri.ee.key
124551676 8 -rw-r--r-- 1 imreoolberg staff 386 Jul 21 15:24 p-cowork-03-fld-01/cat-os-release.txt
124551477 8 -rw------- 1 imreoolberg staff 1200 Jul 21 15:22 p-cowork-03-fld-01/p-cowork-03.auul.pri.ee.crt
124551577 8 -rw-r--r-- 1 imreoolberg staff 484 Jul 21 15:23 p-cowork-03-fld-01/find-ls.txt
</pre>

Komponent joonis (claude.ai tehtud)

[[Fail:20260721-cc-app-macos-02.png|900px]]

kus

* Claude Desktop ja Claude Code kasutamisel osa tegevusi toimub taustal töötavas virtuaalses arvutis - MacOS puhul VZ virtuaalses arvutis

Kasulikud lisamaterjalid

* https://aaddrick.com/blog/claude-desktop-cowork-mode-vm-architecture-analysis

===Claude teenusele ligipääs===

Claude teenusele ligipääsu ostmine toimub https://claude.com/ veebikohas

[[Fail:20260722-cc-app-macos-01.png|900px]]

kus

* realistliku toimetamise jaoks võiks olla sobiv Pro ligipääs

===Paigaldamine - Claude Desktop App===

Claude app kasutamiseks tuleb tarkvara kopeerida tootja veebikohast

[[Fail:20260717-cc-app-macos-02.png|800px]]

kus

* navigeerides 'https://claude.com/ -> Meet Claude -> Claude Code'
* või navigeerides 'https://claude.com/ -> Meet Claude -> Claude Cowork'
* tundub, et kõigil juhtudel pakutakse alla laadida sama Claude.dmg fail (320 MBait)

Paigaldamine toimub nö tavaliselt .dmg viisil

[[Fail:20260717-cc-app-macos-01.png|800px]]

kus

* TODO

===Käivitamine ja seadistamine===

Esmakordsel käivitamisel küsitakse autentimist isandaga, nt Google kaudu

[[Fail:20260717-cc-app-macos-05.png|800px]]

kus

* TODO

Tulemusena saab rakenduse käivitada ja paistab Tööpõhimõte punktis esitatud pilt, arvutis töötavad sellised protsessid

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i claude | grep -v grep
imreoolberg 21245 0.1 1.4 1951100112 230368 ?? S 1:02PM 0:02.89 /Applications/Claude.app/Contents/MacOS/Claude
imreoolberg 21278 0.0 0.4 1949258624 65536 ?? S 1:02PM 0:00.09 /Applications/Claude.app/Contents/Frameworks/Claude Helper.app/Contents/MacOS/Claude Helper --type=utility --utility-sub-type=node.mojom.NodeService ...
...
</pre>

kus

* saab aimu, et tegu on javascript vms põhise lahendusega

nt logitakse sellistesse failidesse

<pre>
imreoolberg@Imres-MacBook-Air cc-01 % lsof -p 21245 -P -n | grep log
Claude 21245 imreoolberg 36w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 37w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 42w REG 1,20 6944 124005039 /Users/imreoolberg/Library/Application Support/Claude/Local Storage/leveldb/000183.log
Claude 21245 imreoolberg 47w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 48w REG 1,20 68 123983932 /Users/imreoolberg/Library/Application Support/Claude/Partitions/cowork-file-preview/Local Storage/leveldb/000003.log
Claude 21245 imreoolberg 51w REG 1,20 68 123983933 /Users/imreoolberg/Library/Application Support/Claude/Partitions/launch-preview-static/Local Storage/leveldb/000003.log
Claude 21245 imreoolberg 67w REG 1,20 30 123983949 /Users/imreoolberg/Library/Application Support/Claude/Partitions/launch-preview-static/Session Storage/000003.log
Claude 21245 imreoolberg 84w REG 1,20 9994 123984082 /Users/imreoolberg/Library/Application Support/Claude/Session Storage/000003.log
Claude 21245 imreoolberg 89w REG 1,20 224 123984215 /Users/imreoolberg/Library/Logs/Claude/ssh.log
Claude 21245 imreoolberg 90w REG 1,20 626 123984216 /Users/imreoolberg/Library/Logs/Claude/cowork_vm_node.log
Claude 21245 imreoolberg 92w REG 1,20 1032 123987914 /Users/imreoolberg/Library/Logs/Claude/unknown-window.log
Claude 21245 imreoolberg 97w REG 1,20 2012 123984251 /Users/imreoolberg/Library/Logs/Claude/claude.ai-web.log
Claude 21245 imreoolberg 98w REG 1,20 231448 123984147 /Users/imreoolberg/Library/Application Support/Claude/IndexedDB/https_claude.ai_0.indexeddb.leveldb/000003.log
</pre>

===Tarkvara uuendamine===

Claude Desktop tarkvara uuendamiseks sobib

[[Fail:20260722-cc-app-macos-02.png|800px]]

kus

* pressida ühte või teist Update nuppu

===Misc===

Claude teenuse erinevatest komponentidest annab aimu avalik https://status.claude.com/

[[Fail:20260719-cc-app-macos-01.png|700px]]

kus töökohaarvutil puudub võrguühndus, siis Desktop app ei tööta

[[Fail:20260720-cc-app-macos-01.png|700px]]

===Claude Code CLI - kasutaja õigustes===

Claude Code CLI paigaldamine MacOS peale on võimalik mitmel viisil

* tarkvara paigaldatakse nö ülesüsteemselt
* tarkvara paigaldatakse kasutaja kodukataloogi

Käesoleval juhtumil kirjeldatakse paigaldamist kodukataloogi kuna tuleb paigaldada kaks tarkvara, ja nad kumbki ei ole väga naturaalselt macos jaoks ettevalmistatud (st pole nö visuaalset vms installerit, ametlik juhend soovitab lausa pimedalt shellida, 'curl -fsSL https://claude.ai/install.sh | bash'

* node
* node moodul-pakett-jne - claude

====Tarkvara kopeerimine, paigaldamine ja käivitamine====

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % cp -a Downloads/node-v24.19.0-darwin-arm64 .local/node
imreoolberg@Imres-MacBook-Air ~ % ./.local/node/bin/node -v
v24.19.0

imreoolberg@Imres-MacBook-Air ~ % export PATH="$HOME/.local/node/bin:$PATH"
imreoolberg@Imres-MacBook-Air ~ % npm install -g cowsay

imreoolberg@Imres-MacBook-Air ~ % ./.local/node/bin/cowsay -y "hello world"
_____________
< hello world >
-------------
\ ^__^
\ (..)\_______
(__)\ )\/\
||----w |
|| ||

imreoolberg@Imres-MacBook-Air ~ % npm list -g
/Users/imreoolberg/.local/node/lib
├── corepack@0.35.0
├── cowsay@1.6.0
└── npm@11.17.0

imreoolberg@Imres-MacBook-Air ~ % cd /tmp
imreoolberg@Imres-MacBook-Air /tmp %
imreoolberg@Imres-MacBook-Air ~ % npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code
imreoolberg@Imres-MacBook-Air /tmp % cd ~

imreoolberg@Imres-MacBook-Air ~ % mkdir cc-local
imreoolberg@Imres-MacBook-Air ~ % cd cc-local

imreoolberg@Imres-MacBook-Air ~ % claude

imreoolberg@Imres-MacBook-Air cc-local % claude daemon status
pid: 8316
version: 2.1.240
uptime: 3008s
origin: transient — started on-demand by `claude` (pid 82547) in /Users/imreoolberg/cc-local
config: /Users/imreoolberg/.claude/daemon.json
log: /Users/imreoolberg/.claude/daemon.log

bg sessions:
sock dir: /tmp/cc-daemon-501/c67e4872
control.sock: reachable
bg workers: 5 running (control.sock), 5 in roster.json
roster.json: updated 77s ago
daemon.log: 8.8KB at /Users/imreoolberg/.claude/daemon.log

holding this daemon open:
5 bg workers running (daemon waits for them to settle)

to let it idle-exit: wait for (or cancel) bg workers and close any `claude agents`
imreoolberg@Imres-MacBook-Air cc-local %
</pre>

====Playwright kasutamine====

Playwright võimaldab nö visuaalset kontakti veebirakendusega (ehk natuke sarnane Selenium lahendusega).

<pre>
imreoolberg@Imres-MacBook-Air ~ % mkdir ~/playwright-mcp
imreoolberg@Imres-MacBook-Air ~ % cd ~/playwright-mcp
imreoolberg@Imres-MacBook-Air playwright-mcp % npm init -y
imreoolberg@Imres-MacBook-Air playwright-mcp % npm install playwright
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright install chromium
imreoolberg@Imres-MacBook-Air playwright-mcp % npm install -D @playwright/test
</pre>

Sessiooni salvestamine

<pre>
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright codegen -o my-jenkins-flow.spec.js https://jenkins.auul.pri.ee/
</pre>

Ja taasesitamine

<pre>
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright test --headed my-jenkins-flow.spec.js
</pre>

Teine võimalik kasutusala on Claude Code CLI programmile öelda nt, et palun tekita kolm kasutajat aadressile https://gitlab.auul.pri.ee/

====Kasutamine====

TODO

===Kasulikud lisamaterjalid===

* https://www.auul.pri.ee/wiki/LiteLLM

Claude Desktop - MacOS

2026-09-16T18:10:04Z

Imre: /* Tarkvara kopeerimine, paigaldamine ja käivitamine */

===Sissejuhatus===

Väited

* Claude tähistab üldiselt tootja Anthropic ühte toodete komplekti - keelemudel, teenus, klienttarkavara, protokoll jne
* käesolev tekst keskendub Claude abil agentse lahenduse kasutamisele - st eesmärgiks on, et inimene istub koos agendiga samas aruvutis ja nad koos teevad midagi aktiivselt (nt paigaldavad arvutisse tarkvara, analüüsivad arvutis toimuvaid protsesse jne (jutt ei ole inimese töökohaarvutist, aga mingist muust arvutist, nt serverist)
* Claude agentset kasutamist tähistatakse 'Claude Code'
* Claude Code kasutamiseks on tingimata tarvis paigaldada kas töökohaarvutisse või serverisse Claude agendi tarkvara
* Claude Code kasutamiseks on tingimata tarvis kasutada sobivat kommerts teenust (nt Pro taseme subscription abil)
* kuigi käesolev tekst soovib keskenduda agentsele kasutamisele on Claude Desktop rakendus praktiliselt nii Chat, Code ja Cowork funktsioonidega
* Claude rakenduse Chat funktsioon on analoogne veebikoha https://claude.ai/ kasutamisele
* Claude Desktop app ei sisalda otseselt käsurea kasutamise st terminalis töötamise võimalust (nii, et visuaalselt on prompt kasutada)

Misc

* https://claude.com/ - korporatiivne veebikoht (info kasutajaks saamise kohta, tarkvara allalaadimine, kasutusjuhised jne)
* https://claude.ai/ - online chat teenus

===Tööpõhimõte===

====Claude Chat režiim====

Claude Desktop App kasutamine Chat režiimis paistab välja selline

[[Fail:20260717-cc-app-macos-03.png|800px]]

kus

* TODO

====Claude Code režiim====

Claude Desktop App kasutamine Code režiimis paistab välja selline

[[Fail:20260717-cc-app-macos-04.png|800px]]

kus

* käsundamine toimub selles operatsioonisüsteemis, kus claude desktop protsess töötab st macos operatsioonisüsteemis enda (mitte mõnes virtuaalses arvutis)

Tegevustega seotud tulemused asuvad kaustas (mis esmakordsel käivitamisel saab rakendusele ütlelda, st et toimetagu '/Users/imreoolberg/cc-01' kaustas ja sealt edasi

<pre>
imreoolberg@Imres-MacBook-Air cc-01 % pwd
/Users/imreoolberg/cc-01

imreoolberg@Imres-MacBook-Air cc-01 % find . -ls
123993344 0 drwxr-xr-x 3 imreoolberg staff 96 Jul 17 14:04 .
123993560 0 drwxr-xr-x 4 imreoolberg staff 128 Jul 17 14:13 ./imre-test-01
123995650 8 -rw-r--r-- 1 imreoolberg staff 822 Jul 17 14:13 ./imre-test-01/random.auul.pri.ee.cert.pem
123995649 8 -rw-r--r-- 1 imreoolberg staff 227 Jul 17 14:13 ./imre-test-01/random.auul.pri.ee.key.pem
</pre>

====Claude Cowork režiim====

Väited

* cowork režiim on turvalisem kui claude-code režiim, sest tegevused toimuvad eraldi abistavas virtuaalses arvutis
* cowork virtuaalne arvuti ei saa tavalises mõttes võrku (tcp/ip mõttes) - suhtlemine ümbrusega toimub connectorite abil
* abistavad vahendid on plugins, connectors ja skills (plugin kombineerib hulga skille ja konnektoreid)

Cowork režiimis esmalt moodustatakse projekt ning seostada folderiga

[[Fail:20260721-cc-app-macos-03.png|450px]]

seejärel palve midagi teha, nt 'please create self-signed x509 certificate for dns name p-cowork-03.auul.pri.ee, rsa crypto, 2048 bit and 1 year expiration, save certificate and key in this project associated shared folder'

[[Fail:20260721-cc-app-macos-04.png|1100px]]

seejärel palve tulemust esitada nimekirja kujul, kui tulemus paluda salvestada faili, siis saab seda esitada eraldi paremal olevas kolmandas paneelis

[[Fail:20260721-cc-app-macos-05.png|1100px]]

ja lõpuks palve midagi väljendada enda keskkonna kohta - siis saab kinnituse, et tegu on macos peal töötava ajutise abistama Ubuntu v. 22.04 virtuaalse arvutiga

[[Fail:20260721-cc-app-macos-06.png|1100px]]

Lõpuks on kogunenud projekti kataloogi sellised failid, macos poolelt vaadates

<pre>
imreoolberg@Imres-MacBook-Air ~ % find p-cowork-03-fld-01 -type f -ls
124551478 8 -rw------- 1 imreoolberg staff 1704 Jul 21 15:22 p-cowork-03-fld-01/p-cowork-03.auul.pri.ee.key
124551676 8 -rw-r--r-- 1 imreoolberg staff 386 Jul 21 15:24 p-cowork-03-fld-01/cat-os-release.txt
124551477 8 -rw------- 1 imreoolberg staff 1200 Jul 21 15:22 p-cowork-03-fld-01/p-cowork-03.auul.pri.ee.crt
124551577 8 -rw-r--r-- 1 imreoolberg staff 484 Jul 21 15:23 p-cowork-03-fld-01/find-ls.txt
</pre>

Komponent joonis (claude.ai tehtud)

[[Fail:20260721-cc-app-macos-02.png|900px]]

kus

* Claude Desktop ja Claude Code kasutamisel osa tegevusi toimub taustal töötavas virtuaalses arvutis - MacOS puhul VZ virtuaalses arvutis

Kasulikud lisamaterjalid

* https://aaddrick.com/blog/claude-desktop-cowork-mode-vm-architecture-analysis

===Claude teenusele ligipääs===

Claude teenusele ligipääsu ostmine toimub https://claude.com/ veebikohas

[[Fail:20260722-cc-app-macos-01.png|900px]]

kus

* realistliku toimetamise jaoks võiks olla sobiv Pro ligipääs

===Paigaldamine - Claude Desktop App===

Claude app kasutamiseks tuleb tarkvara kopeerida tootja veebikohast

[[Fail:20260717-cc-app-macos-02.png|800px]]

kus

* navigeerides 'https://claude.com/ -> Meet Claude -> Claude Code'
* või navigeerides 'https://claude.com/ -> Meet Claude -> Claude Cowork'
* tundub, et kõigil juhtudel pakutakse alla laadida sama Claude.dmg fail (320 MBait)

Paigaldamine toimub nö tavaliselt .dmg viisil

[[Fail:20260717-cc-app-macos-01.png|800px]]

kus

* TODO

===Käivitamine ja seadistamine===

Esmakordsel käivitamisel küsitakse autentimist isandaga, nt Google kaudu

[[Fail:20260717-cc-app-macos-05.png|800px]]

kus

* TODO

Tulemusena saab rakenduse käivitada ja paistab Tööpõhimõte punktis esitatud pilt, arvutis töötavad sellised protsessid

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i claude | grep -v grep
imreoolberg 21245 0.1 1.4 1951100112 230368 ?? S 1:02PM 0:02.89 /Applications/Claude.app/Contents/MacOS/Claude
imreoolberg 21278 0.0 0.4 1949258624 65536 ?? S 1:02PM 0:00.09 /Applications/Claude.app/Contents/Frameworks/Claude Helper.app/Contents/MacOS/Claude Helper --type=utility --utility-sub-type=node.mojom.NodeService ...
...
</pre>

kus

* saab aimu, et tegu on javascript vms põhise lahendusega

nt logitakse sellistesse failidesse

<pre>
imreoolberg@Imres-MacBook-Air cc-01 % lsof -p 21245 -P -n | grep log
Claude 21245 imreoolberg 36w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 37w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 42w REG 1,20 6944 124005039 /Users/imreoolberg/Library/Application Support/Claude/Local Storage/leveldb/000183.log
Claude 21245 imreoolberg 47w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 48w REG 1,20 68 123983932 /Users/imreoolberg/Library/Application Support/Claude/Partitions/cowork-file-preview/Local Storage/leveldb/000003.log
Claude 21245 imreoolberg 51w REG 1,20 68 123983933 /Users/imreoolberg/Library/Application Support/Claude/Partitions/launch-preview-static/Local Storage/leveldb/000003.log
Claude 21245 imreoolberg 67w REG 1,20 30 123983949 /Users/imreoolberg/Library/Application Support/Claude/Partitions/launch-preview-static/Session Storage/000003.log
Claude 21245 imreoolberg 84w REG 1,20 9994 123984082 /Users/imreoolberg/Library/Application Support/Claude/Session Storage/000003.log
Claude 21245 imreoolberg 89w REG 1,20 224 123984215 /Users/imreoolberg/Library/Logs/Claude/ssh.log
Claude 21245 imreoolberg 90w REG 1,20 626 123984216 /Users/imreoolberg/Library/Logs/Claude/cowork_vm_node.log
Claude 21245 imreoolberg 92w REG 1,20 1032 123987914 /Users/imreoolberg/Library/Logs/Claude/unknown-window.log
Claude 21245 imreoolberg 97w REG 1,20 2012 123984251 /Users/imreoolberg/Library/Logs/Claude/claude.ai-web.log
Claude 21245 imreoolberg 98w REG 1,20 231448 123984147 /Users/imreoolberg/Library/Application Support/Claude/IndexedDB/https_claude.ai_0.indexeddb.leveldb/000003.log
</pre>

===Tarkvara uuendamine===

Claude Desktop tarkvara uuendamiseks sobib

[[Fail:20260722-cc-app-macos-02.png|800px]]

kus

* pressida ühte või teist Update nuppu

===Misc===

Claude teenuse erinevatest komponentidest annab aimu avalik https://status.claude.com/

[[Fail:20260719-cc-app-macos-01.png|700px]]

kus töökohaarvutil puudub võrguühndus, siis Desktop app ei tööta

[[Fail:20260720-cc-app-macos-01.png|700px]]

===Claude Code CLI - kasutaja õigustes===

Claude Code CLI paigaldamine MacOS peale on võimalik mitmel viisil

* tarkvara paigaldatakse nö ülesüsteemselt
* tarkvara paigaldatakse kasutaja kodukataloogi

Käesoleval juhtumil kirjeldatakse paigaldamist kodukataloogi kuna tuleb paigaldada kaks tarkvara, ja nad kumbki ei ole väga naturaalselt macos jaoks ettevalmistatud (st pole nö visuaalset vms installerit, ametlik juhend soovitab lausa pimedalt shellida, 'curl -fsSL https://claude.ai/install.sh | bash'

* node
* node moodul-pakett-jne - claude

====Tarkvara kopeerimine, paigaldamine ja käivitamine====

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % cp -a Downloads/node-v24.19.0-darwin-arm64 .local/node
imreoolberg@Imres-MacBook-Air ~ % ./.local/node/bin/node -v
v24.19.0

imreoolberg@Imres-MacBook-Air ~ % export PATH="$HOME/.local/node/bin:$PATH"
imreoolberg@Imres-MacBook-Air ~ % npm install -g cowsay

imreoolberg@Imres-MacBook-Air ~ % ./.local/node/bin/cowsay -y "hello world"
_____________
< hello world >
-------------
\ ^__^
\ (..)\_______
(__)\ )\/\
||----w |
|| ||

imreoolberg@Imres-MacBook-Air ~ % npm list -g
/Users/imreoolberg/.local/node/lib
├── corepack@0.35.0
├── cowsay@1.6.0
└── npm@11.17.0

imreoolberg@Imres-MacBook-Air ~ % cd /tmp
imreoolberg@Imres-MacBook-Air /tmp %
imreoolberg@Imres-MacBook-Air ~ % npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code
imreoolberg@Imres-MacBook-Air /tmp % cd ~

imreoolberg@Imres-MacBook-Air ~ % mkdir cc-local
imreoolberg@Imres-MacBook-Air ~ % cd cc-local

imreoolberg@Imres-MacBook-Air ~ % claude

imreoolberg@Imres-MacBook-Air cc-local % claude daemon status
pid: 8316
version: 2.1.240
uptime: 3008s
origin: transient — started on-demand by `claude` (pid 82547) in /Users/imreoolberg/cc-local
config: /Users/imreoolberg/.claude/daemon.json
log: /Users/imreoolberg/.claude/daemon.log

bg sessions:
sock dir: /tmp/cc-daemon-501/c67e4872
control.sock: reachable
bg workers: 5 running (control.sock), 5 in roster.json
roster.json: updated 77s ago
daemon.log: 8.8KB at /Users/imreoolberg/.claude/daemon.log

holding this daemon open:
5 bg workers running (daemon waits for them to settle)

to let it idle-exit: wait for (or cancel) bg workers and close any `claude agents`
imreoolberg@Imres-MacBook-Air cc-local %
</pre>

====Playwright kasutamine====

Playwright võimaldab nö visuaalset kontakti veebirakendusega (ehk natuke sarnane Selenium lahendusega).

<pre>
imreoolberg@Imres-MacBook-Air ~ % mkdir ~/playwright-mcp
imreoolberg@Imres-MacBook-Air ~ % cd ~/playwright-mcp
imreoolberg@Imres-MacBook-Air playwright-mcp % npm init -y
imreoolberg@Imres-MacBook-Air playwright-mcp % npm install playwright
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright install chromium
imreoolberg@Imres-MacBook-Air playwright-mcp % npm install -D @playwright/test
</pre>

Sessiooni salvestamine

<pre>
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright codegen -o my-jenkins-flow.spec.js https://jenkins.auul.pri.ee/
</pre>

Ja taasesitamine

<pre>
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright test --headed my-jenkins-flow.spec.js
</pre>

====Kasutamine====

TODO

===Kasulikud lisamaterjalid===

* https://www.auul.pri.ee/wiki/LiteLLM