Imre kasutab arvutit - Kasutaja kaastöö [et]

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-05T20:09:36Z

Imre: /* Kasulikud lisamaterjalid */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS internetis teenuste pakkumise platvorm, st MacOS jaoks ei valmistata ette nö üldotstarbelist tarvara nagu postfix, apache, nsd, unbound, nginx jne; ja Apple arvutite riistvara ei ole eriti redundantne (topelt toide, topelt võrgliidesed, topelt salvestusseade jne). Samas Mac riistvara on päris võimeline compute ressursi poolest (cpu, mälu, võrk, storage). Tundub, et 2016 aastal on omapärane võimalus MacOS abil moodustada server lahendus

* UTM virtuaalsel arvutil käivitatakse 'Proxmox PVE for ARM64'
* proxmox pve peal käivitatakse CT konteinereid
* konteinerites töötavad nö interneti serverid - postfix, apache, nginx, postfix jne
* workload peab olema arm64 kuna 2026 aastal ei tööta nö nested virtualization (st ei saa kasutada KVM tüüpi PVE virtuaalset arvutit)

Lisaks on võimalik vxlan abil korraldada võrguliikluse liigendamine MacOS sees töötava proxmox ja nt OpenBSD tulemüüri vahel - nad mõlemad oskvad vxlan kasutada (üle lokaalse võrgu liiguvad nö udp kapsel paketid).

Eriline Mac arvuti omadus on seejuures, et praktiliselt ei ole tema firmware kahjustatav - st Mac puhul on rangelt realiseeritud pahalase kahjustuse tuvastamiseks ahel

riistvara -> firmware -> software (kuni utm tarkvara programmi autentsuseni)

Redundantsust saab tekitada kahe Mac arvuti abil. MacOS lahendus ei ole odav, aga ta on pigem odavam kui sarnase jõudlusega arm64 alternatiivid (Nt Nvidia Grace Hopper, Vera - üldiselt on nad suurema jõudlusega).

Üks eeskujulik riistvara komplekt, Mac Studio lahenduse põhiselt

* url - https://www.apple.com/shop/buy-mac/mac-studio/m5-max-chip-18-core-cpu-40-core-gpu-128gb-memory-8tb-storage
* chip - M5 Max
* cpu/gpu - 18/40
* memory - 128 GB
* storage - 8 TB
* hind - 8 899 eur

MacOS lahenduse klastri saab moodustada muu hulgas ühendades node'id omavahel thunderbolt abil (järjestikuliselt või mesh kujul) - andmevahetuse toimub kanalil nt üle nö tavalise ethernet ja tcp/ip protokolli.

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/
* https://selfservicerepair.com/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T23:13:37Z

Imre: /* MacOS kasutamine serveri rollis */

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T23:12:38Z

Imre: /* MacOS kasutamine serveri rollis */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS internetis teenuste pakkumise platvorm, st MacOS jaoks ei valmistata ette nö üldotstarbelist tarvara nagu postfix, apache, nsd, unbound, nginx jne; ja Apple arvutite riistvara ei ole eriti redundantne (topelt toide, topelt võrgliidesed, topelt salvestusseade jne). Samas Mac riistvara on päris võimeline compute ressursi poolest (cpu, mälu, võrk, storage). Tundub, et 2016 aastal on omapärane võimalus MacOS abil moodustada server lahendus

* UTM virtuaalsel arvutil käivitatakse 'Proxmox PVE for ARM64'
* proxmox pve peal käivitatakse CT konteinereid
* konteinerites töötavad nö interneti serverid - postfix, apache, nginx, postfix jne
* workload peab olema arm64 kuna 2026 aastal ei tööta nö nested virtualization (st ei saa kasutada KVM tüüpi PVE virtuaalset arvutit)

Lisaks on võimalik vxlan abil korraldada võrguliikluse liigendamine MacOS sees töötava proxmox ja nt OpenBSD tulemüüri vahel - nad mõlemad oskvad vxlan kasutada (üle lokaalse võrgu liiguvad nö udp kapsel paketid).

Eriline Mac arvuti omadus on seejuures, et praktiliselt ei ole tema firmware kahjustatav - st Mac puhul on rangelt realiseeritud pahalase kahjustuse tuvastamiseks ahel

riistvara -> firmware -> software (kuni utm tarkvara programmi autentsuseni)

Redundantsust saab tekitada kahe Mac arvuti abil. MacOS lahendus ei ole odav, aga ta on pigem odavam kui sarnase jõudlusega arm64 alternatiivid (Nt Nvidia Grace Hopper, Vera - üldiselt on nad suurema jõudlusega).

Üks eeskujulik riistvara komplekt, Mac Studio lahenduse põhiselt

* url - https://www.apple.com/shop/buy-mac/mac-studio/m5-max-chip-18-core-cpu-40-core-gpu-128gb-memory-8tb-storage
* chip - M5 Max
* cpu/gpu - 18/40
* memory - 128 GB
* storage - 8 TB
* hind - 8 899 eur

MacOS lahenduse klastri saab moodustada muu hulgas ühendades node'id omavahel thunderbolt abil (järjestikuliselt või mesh kujul).

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T23:11:24Z

Imre: /* MacOS kasutamine serveri rollis */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS internetis teenuste pakkumise platvorm, st MacOS jaoks ei valmistata ette nö üldotstarbelist tarvara nagu postfix, apache, nsd, unbound, nginx jne; ja Apple arvutite riistvara ei ole eriti redundantne (topelt toide, topelt võrgliidesed, topelt salvestusseade jne). Samas Mac riistvara on päris võimeline compute ressursi poolest (cpu, mälu, võrk, storage). Tundub, et 2016 aastal on omapärane võimalus MacOS abil moodustada server lahendus

* UTM virtuaalsel arvutil käivitatakse 'Proxmox PVE for ARM64'
* proxmox pve peal käivitatakse CT konteinereid
* konteinerites töötavad nö interneti serverid - postfix, apache, nginx, postfix jne
* workload peab olema arm64 kuna 2026 aastal ei tööta nö nested virtualization (st ei saa kasutada KVM tüüpi PVE virtuaalset arvutit)

Lisaks on võimalik vxlan abil korraldada võrguliikluse liigendamine MacOS sees töötava proxmox ja nt OpenBSD tulemüüri vahel - nad mõlemad oskvad vxlan kasutada (üle lokaalse võrgu liiguvad nö udp kapsel paketid).

Eriline Mac arvuti omadus on seejuures, et praktiliselt ei ole tema firmware kahjustatav - st Mac puhul on rangelt realiseeritud pahalase kahjustuse tuvastamiseks ahel

riistvara -> firmware -> software (kuni utm tarkvara programmi autentsuseni)

Redundantsust saab tekitada kahe Mac arvuti abil. MacOS lahendus ei ole odav, aga ta on pigem odavam kui sarnase jõudlusega arm64 alternatiivid (Nt Nvidia Grace Hopper, Vera - üldiselt on nad suurema jõudlusega).

Üks eeskujulik riistvara komplekt, Mac Studio lahenduse põhiselt

* url - https://www.apple.com/shop/buy-mac/mac-studio/m5-max-chip-18-core-cpu-40-core-gpu-128gb-memory-8tb-storage
* chip - M5 Max
* cpu/gpu - 18/40
* memory - 128 GB
* storage - 8 TB
* hind - 8 899 eur

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T23:06:33Z

Imre: /* MacOS kasutamine serveri rollis */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS internetis teenuste pakkumise platvorm, st MacOS jaoks ei valmistata ette nö üldotstarbelist tarvara nagu postfix, apache, nsd, unbound, nginx jne; ja Apple arvutite riistvara ei ole eriti redundantne (topelt toide, topelt võrgliidesed, topelt salvestusseade jne). Samas Mac riistvara on päris võimeline compute ressursi poolest (cpu, mälu, võrk, storage). Tundub, et 2016 aastal on omapärane võimalus MacOS abil moodustada server lahendus

* UTM virtuaalsel arvutil käivitatakse Proxmox PVE for arm64
* proxmox pve peal käivitatakse CT konteinereid
* konteinerites töötavad nö interneti serverid - postfix, apache, nginx, postfix jne
* workload peab olema arm64 kuna 2026 aastal ei tööta nö nested virtualization (st ei saa kasutada KVM tüüpi PVE virtuaalset arvutit)

Lisaks on võimalik vxlan abil korraldada võrguliikluse liigendamine MacOS sees töötava proxmox ja nt OpenBSD tulemüüri vahel - nad mõlemad oskvad vxlan kasutada (üle lokaalse võrgu liiguvad nö udp kapsel paketid).

Eriline Mac arvuti omadus on seejuures, et praktiliselt ei ole tema firmware kahjustatav - st Mac puhul on rangelt realiseeritud pahalase kahjustuse tuvastamiseks ahel

riistvara -> firmware -> software (kuni utm tarkvara programmi autentsuseni)

Redundantsust saab tekitada kahe Mac arvuti abil. MacOS lahendus ei ole odav, aga ta on pigem odavam kui sarnase jõudlusega arm64 alternatiivid (Nt Nvidia Grace Hopper, Vera - üldiselt on nad suurema jõudlusega).

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T21:12:01Z

Imre: /* MacOS kasutamine serveri rollis */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS internetis teenuste pakkumise platvorm, st MacOS jaoks ei valmistata ette nö üldotstarbelist tarvara nagu postfix, apache, nsd, unbound, nginx jne. Sama Mac riistvara on päris võimeline compute ressursi poolest (cpu, mälu, võrk, storage). Tundub, et 2016 aastal on omapärane võimalus MacOS abil moodustada server lahendus

* UTM virtuaalsel arvutil käivitatakse Proxmox PVE for arm64
* proxmox pve peal käivitatakse CT konteinereid
* konteinerites töötavad nö interneti serverid - postfix, apache, nginx, postfix jne
* workload peab olema arm64 kuna 2026 aastal ei tööta nö nested virtualization (st ei saa kasutada KVM tüüpi PVE virtuaalset arvutit)

Lisaks on võimalik vxlan abil korraldada võrguliikluse liigendamine MacOS sees töötava proxmox ja nt OpenBSD tulemüüri vahel - nad mõlemad oskvad vxlan kasutada (üle lokaalse võrgu liiguvad nö udp kapsel paketid).

Eriline Mac arvuti omadus on seejuures, et praktiliselt ei ole tema firmware kahjustatav - st Mac puhul on rangelt realiseeritud pahalase kahjustuse tuvastamiseks ahel

riistvara -> firmware -> software (kuni utm tarkvara programmi autentsuseni)

MacOS lahendus ei ole odav, aga ta on pigem odavam kui sarnase jõudlusega arm64 alternatiivid.

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T21:11:13Z

Imre: /* MacOS kasutamine serveri rollis */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS internetis teenuste pakkumise platvorm, st MacOS jaoks ei valmistata ette nö üldotstarbelist tarvara nagu postfix, apache, nsd, unbound, nginx jne. Sama Mac riistvara on päris võimeline compute ressursi poolest (cpu, mälu, võrk, storage). Tundub, et 2016 aastal on omapärane võimalus MacOS abil moodustada server lahendus

* UTM virtuaalsel arvutil käivitatakse Proxmox PVE for arm64
* proxmox pve peal käivitatakse CT konteinereid
* konteinerites töötavad nö interneti serverid - postfix, apache, nginx, postfix jne
* workload peab olema arm64 kuna 2026 aastal ei tööta nö nested virtualization (st ei saa kasutada KVM tüüpi PVE virtuaalset arvutit)

Lisaks on võimalik vxlan abil korraldada võrguliikluse liigendamine MacOS sees töötava proxmox ja nt OpenBSD tulemüüri vahel - nad mõlemad oskvad vxlan kasutada (üle lokaalse võrgu liiguvad nö udp kapsel paketid).

Eriline Mac arvuti omadus on seejuures, et praktiliselt ei ole tema firmware kahjustatav - st Mac puhul on rangelt realiseeritud pahalase kahjustuse tuvastamiseks ahel

riistvara -> firmware -> software (kuni utm tarkvara programmi autentsuseni)

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T21:08:39Z

Imre: /* MacOS kasutamine serveri rollis */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS internetis teenuste pakkumise platvorm, st MacOS jaoks ei valmistata ette nö üldotstarbelist tarvara nagu postfix, apache, nsd, unbound, nginx jne. Sama Mac riistvara on päris võimeline compute ressursi poolest (cpu, mälu, võrk, storage). Tundub, et 2016 aastal on omapärane võimalus MacOS abil moodustada server lahendus

* UTM virtuaalsel arvutil käivitatakse Proxmox PVE for arm64
* proxmox pve peal käivitatakse CT konteinereid
* konteinerites töötavad nö interneti serverid - postfix, apache, nginx, postfix jne

Lisaks on võimalik vxlan abil korraldada võrguliikluse liigendamine MacOS sees töötava proxmox ja nt OpenBSD tulemüüri vahel - nad mõlemad oskvad vxlan kasutada (üle lokaalse võrgu liiguvad nö udp kapsel paketid).

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

MacOS operatsioonisüsteemi kasutamine füüsilise MacBook Air M4 arvutiga

2026-11-01T20:29:28Z

Imre: /* Kasulikud lisamaterjalid */

===Sissejuhatus===

TODO

Apple system level innovations

* XNU hybrid kernel (Mach + BSD + I/O Kit).
* Read-only, sealed root filesystem.
* APFS (snapshots, sealing, native encryption).
* Secure Enclave (separate CPU/resources).
* Cryptographic boot chain (from Boot ROM → kernel → apps).
* System Integrity Protection (SIP).
* Seatbelt / App Sandbox (kernel-enforced per-process confinement via entitlements, private per-app container storage).
* Gatekeeper & notarization.
* Launchd (unified service/daemon manager).
* Unified logging & tracing (dtrace, signpost).
* Rosetta + Universal binaries (smooth arch transitions).
* Quartz compositor + Core Animation (graphics pipeline).
* Metal API (low-level GPU abstraction).
* mälu pakkimine käigult (vt Activity Monitor -> Memory -> Bottom)

Misc

* Aqua - desktop visuaal
* Quartz - desktop mootor
* UTM - qemu-based virtulization
* AWDL (Apple Wireless Direct Link) - midagi Wifi-Direct laadset
* Entitelments
* XPC
* Swift - süsteemitaseme programmeerimiskeel (nagu C++ on Haiku, C on Linux jne)
* LLVM

Väited

* Apple lahendustele on iseloomulik, et sama it shop kontrolli all on nii riistvara kui tarkvara (põhimõtteliselt sarnane olukord nagu kunagi Sun sparc lahendustega)
* macos on pigem threaded orienteeritud lahendus (mitte process-is-single-thread) - märksõnad: Grand Central Dispatch, Operation Queues, Swift Concurrency)
* nn 'giant lock (https://en.wikipedia.org/wiki/Giant_lock)' probleem on macos puhul pigem praktiliselt lahendatud, ju see on sama millest openbsd vabastamisega tegeldakse, nt https://www.openbsd.org/76.html - 'Removed net lock from sysctl(8) net.inet.ip.forwarding, net.inet6.ip6.forwarding, net.inet6.ip6.redirect, net.inet.ip.directed-broadcast.'

===Tööpõhimõte===

Üldiselt on süsteemis teatud tegevuste sooritamiseks vaja rohkem privileege kui nö tavakasutajal tavaliselt on, nt virtualiseerimislahenduse, wifi või vpn jaoks, sellele väljakutsele lähenetakse kahel viisil

* enne privileege vajavate tegevuste algamist minnakse root kasutajaks ja käivatatakse tegevused root kasutajana (ja käivitatud protsess töötab edasi ja kasutajana root)
* tegevused käivitatakse tava-kasutajana ning käigult suudab süsteem teatud tegevusi, mis vajaksid root privileege teatud tingimustel lubada sooritada tava-kasutajal (nt nn helperite abil)

MacOS puhul kasutatakse pigem teist varianti, nt kogu apple-container lahendus töötab teise mõtlemise alusel; ja see teine mõtlemine on suuremal või vähemal määral kohal ka muude operatsioonisüsteemide puhul.

claude.ai vestlusest

[[Fail:20260812-macos-mach-01.png|700px]]

===Riistvara===

TODO

* MacBook Air 13" M4 protsessoriga arvuti
* compute resource - 1. cpu (risc arm), 2. gpu, 3. secure enclave, 4. neural engine
* 16 G ddr5 non-ecc memory - kõik compute resource'id kasutavad sama mälu, st ühisest pool'ist võetakse kasutuseks, ja antakse tagasi jne
* kaks Dell U2725QE monitori
* kaks thunderbolt 4 kaablit
* Logitech nö 9 eurone pc hiir
* lai apple magic keyboard
* väline andmekandja - SanDisk PRO-G40, https://www.apple.com/shop/mac/accessories/storage?f=thunderbolt3&fh=3783%2B47f6&page=1
* port saver - https://www.delock.com/produkt/66433/merkmale.html
* arvuti puhul ei ole kohta nagu pc arvuti puhul on 'enter bios' või 'enter setup' - ainuke realistlik sisenemiskoht on hoides alla toite nuppu arvuti käivitumise ajal

Väited

* macbookpro, air jt on non-ecc mäluga; mac pro ja mac studio on ecc mäluga
* arvuti on ühendatud ühe monitoriga TB4 kaabli abil
* esimese monitoriga on ühendatud usb klaviatuur ja hiir
* arvuti võrk töötab wifi abil, aga saaks töötada ka monitori rj45 ethernet kaabliga (arvutisse saabub üle thunderbolt neli nö signaali: 1. usb klaviatuur ja hiir, 2. ethenet, 3. video, 4. toide)
* teine monitor on ühendatud esimesega teise TB4 kaabliga nn daisy-chain ühenduses
* tundub, et monitoride pilt on vastuvõetava kvaliteediga ka non-4k režiimis (nt 3008 x 1692)

<pre>
system_profiler SPHardwareDataType # CPU, memory, model
system_profiler SPDisplaysDataType # GPU / monitor info
system_profiler SPUSBDataType # USB controllers and devices
system_profiler SPThunderboltDataType # Thunderbolt controllers
system_profiler SPNetworkDataType # Network interfaces
</pre>

Näiteks

<pre>
Imres-MacBook-Air:~ root# system_profiler SPHardwareDataType
Hardware:

Hardware Overview:

Model Name: MacBook Air
Model Identifier: Mac16,12
Model Number: MW0W3KS/A
Chip: Apple M4
Total Number of Cores: 10 (4 performance and 6 efficiency)
Memory: 16 GB
System Firmware Version: 11881.81.2
OS Loader Version: 11881.81.2
Serial Number (system): KGHGX652VT
Hardware UUID: 27AE0C7C-DCC6-5F5C-A133-8F10726347EC
Provisioning UDID: 00008132-001A618E0121801C
Activation Lock Status: Enabled

Imres-MacBook-Air:~ root# system_profiler SPDisplaysDataType
Graphics/Displays:

Apple M4:

Chipset Model: Apple M4
Type: GPU
Bus: Built-In
Total Number of Cores: 8
Vendor: Apple (0x106b)
Metal Support: Metal 3
Displays:
Color LCD:
Display Type: Built-in Liquid Retina Display
Resolution: 2560 x 1664 Retina
Main Display: Yes
Mirror: Off
Online: Yes
Automatically Adjust Brightness: Yes
Connection Type: Internal
DELL U2725QE:
Resolution: 6016 x 3384
UI Looks like: 3008 x 1692 @ 120.00Hz
Mirror: Off
Online: Yes
Rotation: Supported
</pre>

====Neural Engine====

TODO

* On-device machine learning
* Siri's voice recognition
* Image analysis in Photos
* Real-time video processing in apps like FaceTime

====Misc OS====

* cpu instructions - toimuvad kernel -> cpu vahel
* syscalls - toimuvad rakendustarkvara -> kernel vahel
* ei ole user-space-syscall'isid - kõik syscallid on nö kernel-space-syscall'd ehk lihtsalt syscall'id
* macos ei ole real-time operating system
* macos puhul on realiseeritud preemtion st ka tundlike kerneli kihi tegevuste puhul on võimalik teha nö katkestusi-tagasipöördumisi
* ei ole sellist storage-io lahenduste mitmekesisust nagu on linux puhul (nt io-uring, libaio) - nimetatakse 'Dispatch I/O'
* ei ole sellist network-io lahenduste mitmekesisust nagu on linux puhul (nt dpdk) - nimetatakse 'Network Framework'
* dpdk, rdma jms puudub kuna macos puhul tegevused käivad läbi kernel selleks, et toimuv oleks maksimaalselt kontrolli all (toimub kernel by-pass)
* tcp-offload jms siiski on kasutusel - kernel kontrollib siis ikkagi toimivat piisavalt
* XNU kernel ei võimalda linux namespace ja cgroup laadseid nö isolatsioone - st naturaalselt ei ole olemas native macos konteinerindust (nagu on linux jaoks olemas docker või freebsd jaoks daemonless) - kui on vajalik conteinerindus, siis on lahenduseks kasutada konteineri ja xnu kerneli vahel lisa kihti - linux-arm64)

Palju on https://www.openbsd.org/innovations.html nimekirjast olemas macos puhul, kas otseselt või siis kontseptuaalselt, aga implementatsioon on macos juhtumile iseloomulik

* OpenBSD: retguard uses a unique XOR-based canary on a function's return address to prevent a specific type of buffer overflow attack (ROP).
* macOS: macOS does not have a feature called retguard. However, the same concept is implemented by Apple's Clang compiler. macOS has used stack canaries (or stack cookies) for years, which are values placed on the stack to detect if the return address has been overwritten. Both systems use different implementations to solve the same problem.
* OpenBSD: pledge is a security mechanism where a program "pledges" to only use a limited set of system calls. If it tries to make a syscall outside of its "pledge," the program is killed.
* macOS: macOS does not have a pledge equivalent. The concept is not present in the same form. Instead, macOS uses sandboxing, which is a more comprehensive and declarative security model. Sandboxing restricts an application's access to files, network connections, and system resources based on a detailed set of rules (called entitlements) defined in a profile, which is part of the application itself. It's a different, but arguably more powerful, approach to the same problem.
* OpenBSD: W^X is a fundamental security policy that ensures a memory page is either writable or executable, but not both.
* macOS: This concept is directly implemented and has been a core security feature of macOS for many years. It is an integral part of the kernel and is enforced on all applications, making it impossible for an attacker to write shellcode to a memory page and then execute it.
* OpenBSD has long been a pioneer in security, and its implementation of ASLR is a core part of its "secure by default" philosophy.
* macOS introduced ASLR in Mac OS X Leopard (10.5) and has since continuously improved and strengthened it with each new release. Today, ASLR on macOS is a mandatory security feature for all modern applications.
* OpenBSD relinking
* Randomizing per-process: Instead of a single, system-wide reordering at boot, dyld randomizes the base addresses of shared libraries for every single process that is launched.
* Using a shared cache: To speed up program loading, macOS bundles commonly used system libraries into a single large file called the dyld_shared_cache. The location of this entire cache in memory is randomized at boot, and all processes then use this randomized location.

====User mode vs Kernel mode====

Väited

* User mode ja Kernel mode on kaks erinevat protsessori olekut
* esimesel puhul käitub arvuti nagu nö loogiline-masin, teisel juhul nagu riistvaraline-masin
* kontseptuaalselt võiks ette kujutada, et arvutis on kaks protsessorit - üks on pidevalt füüsilises ja teine loogilises olekus
* loogilist laadi tegevusteks on nt protsessi mällu laaditud mälu abil andmete sorteerimine, st kõik tegevused on taandatud matemaatikaks
* füüsilist laadi tegevusteks on nt võrku andmete saatmine, või plokkseadmelt andmete lugemine

====Seadme draiver====

Ettekujutuseks on nvme storage seade. Selleks, et andmed jõuaksid füüsilise plokkseadme pealt ühe user-space protsessi mällu nt postgresql andmebaas, liiguvad andmed läbi sellistest lõikudest koosneva teekonna

<pre>
plokkseade
control plain peal toimuv käsu tulemusel -> plokkseadmega seostatud fragment arvuti rom mälust
-> cpu kopeerib andmed oma registrite abil user-space mällu
..
</pre>

====SanDisk PRO-G40====

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Thunderbolt 4 porti ühendatud seade paistab selline

[[Fail:20250916-imre-sandisk-pro-g40-01.png|900px]]

kus

* seadet koheldakse pcie siinile ühendatud nvme seadmena

Arvutisse seadmega kaasas oleva Thunderbolt 3 kaabliga otse Non-Thuderbolt-USB-C porti ühendatud seade paistab selline

TODO

kus

* seadet koheldakse usb-storage ühendatud plokkseadmena

===Kasutajaliides===

====Magic Apple Keyboard====

klahvikombinatsioonid

* command + nool paremale/vasakule - tekstikursori viimine vastavalt rea lõppu või algusse
* command + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt rea lõppu või algusse
* command + shift + suurem/väiksem - mitme aknalise programmi akende vahel liikumine (nt iterm/terminal/chrome/safari)
* option + nool paremale/vasakule - tekstikursori viimine vastavalt järgmise või eelmise sõna juurde
* option + nool paremale/vasakule - teksti plokki võtmine kursori asukohast alates vastavalt sõna edasi või tagasi
* command + tühik - spotlight otsingu avamine
* control + nool paremal/vasakule - järgmise virtuaalse desktop juurde liikumine (spaces)
* control + nool üles/esc - xxx vaate avamine (üleval on virtuaalsete desktopide riba)
* command + nool üles/alla - teksti algusse või lõppu liikumine (nt chrome brauseris)
* option + nool üles/alla - tekstis nö page-up-page-down võtta liikumine (nt chrome brauseris)

====Touchpad====

gestured

* kahe sõrmega üles-alla swipe - hiirega skrollimine
* kolme sõrmega vasakule-paremale swipe - virtuaalsete desktopide vahel liikumine

===alt-drag - BetterTouchTool (BTT)===

====Tööpõhimõte====

Tegevuse eesmärk on alt-grab kasutamine akna asukohta muutmiseks ja akna suuruse muutmiseks. Linux desktop (gnome, xfce4 jt) puhul paistab see olevat tavaline, et akna asukoha muutmiseks ei pea tingimata haarama hiire vasaku nupuga akna tiitelribast ja siis vedama; või akna suuruse muutmiseks haarama hiire vasaku nupuga täpselt nurgast või servast ja siis vedama. Piisab hoida vasakut alt klahvi all ja haarata kuskilt akna seest hiire vasaku nupuga ning vedada; või hoida vasakut alt klahvi all ja haarata akna seest nurga lähedusest hiire parema nupuga ning vedada.

====BTT kopeerimine ja paigaldamine====

Väited

* https://folivora.ai/
* tundub, et BTT on usaldusväärne tarkvara (nt https://www.macworld.com/article/551700/mac-gems-bettertouchtool-review.html)
* BetterTouchTool ei ole tasuta tarkvara
* BetterTouchTool ei ole kõige parem lahendus nn alt-drag jaoks, aga paistab, et paremat ka pole (ja tundub, et ei saa olla kuna MacOS nö sisemiselt eriti ei võimalda alt-drag laadi tegevusi)
* BTT abil saab akna suurust muuta ainult paremas alumises nurgas
* akent ei saa ekraanilt osaliselt välja suruda üles suunas (nt alla saab)
* tundub, et paigaldamisel antakse rakendusele rikkalikult privileege

Litsents vms paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % cat "Downloads/Imre Oolberg.bettertouchtool"
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Product</key>
<string>BetterTouchTool</string>
<key>Name</key>
<string>Imre Oolberg</string>
<key>Email</key>
<string>imre.oolberg@xxx</string>
<key>OrderID</key>
<string>g6661c59baa3faf777b77c777ab1c888</string>
<key>LicenseType</key>
<string>paddle_lifetime</string>
<key>Licenses</key>
<string>1</string>
<key>Timestamp</key>
<string>1761172651</string>
<key>CheckoutName</key>
<string>IMRE OOLBERG</string>
<key>TransactionID</key>
<string>123456789-chre575d06b1e19-3fb2a9bc35</string>
<key>Signature</key>
<data>p889UyI9999BGX6BteE3s7hEVQW4M1JVEbxLXTRTf+W0XUoZhhhhhhjuuu55555555555555
hO0xoCHQGtuun9EzL6Vq+xZ6D5qSI5IuXJ/O6EO92t2OHqF5ddpj0W3pUGMc5gNnTQ9oNXaCUuWB
54Vwzj78888yeGupJk=
</data>
</dict>
</plist>
</pre>

Tarkvara jagatakse .zip failina

<pre>
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | head -n 5
Archive: Downloads/BetterTouchTool_latest.zip
testing: BetterTouchTool.app/ OK
testing: BetterTouchTool.app/Contents/ OK
testing: BetterTouchTool.app/Contents/CodeResources OK
testing: BetterTouchTool.app/Contents/_CodeSignature/ OK

...
imreoolberg@Imres-MacBook-Air ~ % unzip -t Downloads/BetterTouchTool_latest.zip | tail -n 5
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/Versions/Current OK
testing: BetterTouchTool.app/Contents/Frameworks/HexFiend.framework/HexFiend OK
testing: BetterTouchTool.app/Contents/Info.plist OK
testing: BetterTouchTool.app/Contents/PkgInfo OK
..
</pre>

ja paigaldamine toimub BetterTouchTool.app kataloogi kopeerimise teel /Applications kataloogi. Tulemus paistab selline

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/BetterTouchTool.app/Contents/* | head -n 5
drwxr-xr-x 3 imreoolberg staff 96 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/_CodeSignature
-rw-r--r-- 1 imreoolberg staff 2598 Sep 11 01:13 /Applications/BetterTouchTool.app/Contents/CodeResources
-rw-r--r-- 1 imreoolberg staff 20171 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/embedded.provisionprofile
drwxr-xr-x 8 imreoolberg staff 256 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Frameworks
-rw-r--r-- 1 imreoolberg staff 21874 Sep 11 01:10 /Applications/BetterTouchTool.app/Contents/Info.plist
</pre>

====Seadistamine====

Tööpõhimõte

* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse down', millele vastab tegevus (action) 'Start Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Leftclick + left alt + mouse up', millele vastab tegevus 'Stop Moving Windows'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse down', millele vastab tegevus 'Start Resizing'
* seadistatakse nö 'Top Level Trigger' väärtusega 'Rightclick + left alt + mouse up', millele vastab tegevus 'Stop Resizing'

alt-drag seadistamine paistab selliselt, rightclick triggeri ja vastava tegevuse (action) kirjeldamine, basic

[[Fail:20250903-btt-rightclick-01.png|1000px]]

kus

* valitud programmid on For All Apps st kirjeldatavad võimed tekivad kõigi programmide akendele
* valitud seade on Normal Mouse (mitte magic mouse)
* on valitud ka modifer - opt (magic keyboard klahv 'option')

ning advanced

[[Fail:20250903-btt-rightclick-02.png|1000px]]

kus

* Trigger Conditions - Trigger on Mouse Down (vaikimisi)

Analoogselt kirjeldatakse ülejäänud triggerid ja tegevused - seejuures tuleb kindlasti valida modifier, vastasel korral võib olla väga halb kasutuskogemus kuna hiire vasaku klahvi nö tavaline töö on häiritud).

====Kasutamine====

Kasutamine paistab välja natuke puudulikumalt kui linux desktop keskkonnas

* suurust saab muuta vaid alumist paremat nurka sisse või väljapoole surudes (linux all saab tegeleda igas nurgas)
* asukohta saab muuta kuid see mõjub fookuses olevale aknale (vahel on see üsna nö eba kogemus, et hiir on mitte fookuses oleva akna kohal ja kõrval oleva akna asukoht muutub)
* tegelemise ajal on aken nö täidetud (linux all saab valida kas aken paistab nö täidetuna või wireframe'ina)

====Tarkvara uuendamine====

Tarkvara uuendamine toimub tarkvara webgui abil

[[Fail:20260814-macos-btt-01.png|800px]]

kus

* saab valida käsitsi ja 'automatically download and install updates in the future' vahel

====Kasulikud lisamaterjalid====

* https://community.folivora.ai/t/resize-window-on-modifier-right-mouse-button-press/41430

===iterm2===

iterm2 võimaldab muu hulgas

* akende arrangement ettevalmistusi - st akende avamist komplektidena, seejuures logitakse automaatselt serveritesse ssh abil sisse, näiteks
* profile abil värvikasutust kirjeldada (taust, tekst, esiletoodud (bold), allajoonitud tekst jms)

[[Fail:20260302-iterm2-01.png|700px]]

avades

iTerm2 -> Settings -> Profiles

kus

* esiletoodud tekst esitatakse roheliselt (seda esineb linux puhul nt top, 'systemctl status postfix' ja dmesg väljundis)

aknale kerge ääre näitamine

iTerm2 -> Settings -> Appearence -> Windows -> Aestetics -> Heavy border around windows in light mode

Profiilid

<pre>
imreoolberg@Imres-MacBook-Air ~ % egrep -r wrx "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Command" : "ssh root@pve-wrx90e",
/Users/imreoolberg/Library/Application Support/iTerm2/DynamicProfiles/pve-wrx90e.json: "Name" : "pve-wrx90e",
imreoolberg@Imres-MacBook-Air ~ % egrep -r svc "/Users/imreoolberg/Library/Application Support/iTerm2"
egrep: /Users/imreoolberg/Library/Application Support/iTerm2/iterm2-daemon-1.socket: Operation not supported on socket
imreoolberg@Imres-MacBook-Air ~ % plutil -p ~/Library/Preferences/com.googlecode.iterm2.plist | grep -i "pve-svc-0"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-01"
"Name" => "pve-svc-01"
"Command" => "ssh root@pve-svc-01"
"Command" => "ssh root@pve-svc-02"
"Name" => "pve-svc-02"
"Command" => "ssh root@pve-svc-02"
</pre>

Tarkvara uuendamine

[[Fail:20260704-macos-01.png|900px]]

* ei toimu app store kaudu
* toimib rakenduse enda menüüst

Non-printable sümbol paistab nt selliselt

<pre>
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
Invalid unit name "rsyslog " escaped as "rsyslog\xc2\xa0" (maybe you should use systemd-escape?).
NoNewPrivileges=no
root@rv-nswa-01:~# systemctl show rsyslog | grep -i nonew
NoNewPrivileges=yes
</pre>

ning

<pre>
root@rv-nswa-01:~# echo "rsyslog " | od -c
0000000 r s y s l o g 302 240 \n
0000012
root@rv-nswa-01:~# echo "rsyslog" | od -c
0000000 r s y s l o g \n
0000010
root@rv-nswa-01:~#
</pre>

Claude teab, et '\xc2\xa0 is UTF-8 for U+00A0 — a non-breaking space (NBSP)'

===timemachine===

====Tööpõhimõte====

TODO

* võrgus failiserver
* võrgus avahi vms server
* macos süsteem

====Ettevalmistamine====

Väited

* tundub, et macos webgui kaudu ei õnnestu samba põhist tm lahendust ära seadistada, tuleb toimetada käsurealt (hüpotees on, et kuna cifs failisüsteemi monteerimisel Finder abil tekib .DS_Store vms faile automaatselt share peale, siis see eksitab tm lahendust

Samba serveri ettevalmistamine, Debian v. 12 (samba v. 4.17)

<pre>
# apt-get install --no-install-recommends samba
# apt-get install samba-vfs-modules

# cat /etc/samba/smb.conf
[global]
client min protocol = SMB3
client max protocol = SMB3
workgroup = MORAALCIFS
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
panic action = /usr/share/samba/panic-action %d
server role = standalone server

[timemachine]
path = /zpool_wdc/timemachine/
browsable =yes
writable = yes
guest ok = no
valid users = timemachine
smb encrypt = required
vfs objects = catia fruit streams_xattr
fruit:metadata = stream
fruit:resource = file
fruit:time machine = yes
fruit:time machine max size = 500G
</pre>

käivitamine

<pre>
# systemctl restart smbd
</pre>

Varundatava arvuti ettevalmistamine

<pre>
Imres-MacBook-Air:~ root# tmutil setdestination "smb://timemachine:parool@192.168.10.168/timemachine"
Imres-MacBook-Air:~ root# tmutil destinationinfo
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : 2E3ED96D-4626-4D55-BDD5-A0ED6CDDF973
</pre>

Varunduse käivitamine

<pre>
Imres-MacBook-Air:~ root# tmutil startbackup --auto
Imres-MacBook-Air:~ root# log stream --predicate 'process == "backupd"' --info
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 157Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 709 0 100% /dev
/dev/disk3s6 228Gi 20Ki 157Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 157Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 157Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 157Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 157Gi 2% 76 1.6G 0% /Volumes/Recovery
//timemachine@192.168.10.168/timemachine 500Gi 20Gi 480Gi 5% 21M 503M 4% /Volumes/.timemachine/192.168.10.168/CEF57214-AE85-44D1-86EB-D0D69E41EA1C/timemachine
/dev/disk5s1 15Ti 20Gi 480Gi 4% 383k 5.0G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 157Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
Imres-MacBook-Air:~ root#
</pre>

Tulemusena

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-015533.backup/2025-09-05-015533.backup
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2025-09-05-012346.local
com.apple.TimeMachine.2025-09-05-015510.local
com.apple.os.update-35F83766A7728F08A2DF1CFD45DF39CAB4C00F8C1A4A0DBECD314305426E5C549569F373D02B15DDC5C3E22E8E9D0A2F
com.apple.os.update-4278EFCBF37708F6ABE958C2E59447D754411B4697E4891DE3D58BC37F433306
com.apple.os.update-MSUPrepareUpdate
</pre>

====Kasutamine - süsteemi varundamine====

Time machine graafilise liidese peal, kui on kirjeldatud mitu time-machine varunduskohta, saab ühe peal hiire parema klõpsuga avada hüpikmenüü ja öelda, et käivitada varundus

[[Fail:20251109-timemachine-01.png|600px]]

====Kasutamine - üksiku faili taastamine====

TODO

====Kasutamine - süsteemi taastamine====

TODO

====Misc====

tm destinationinfo esitamine

<pre>
Imres-MacBook-Air:~ root# tmutil destinationinfo
> ==================================================
Name : volume-tm-backup-01
Kind : Local
Mount Point : /Volumes/volume-tm-backup-01 1
ID : B23C58B0-C5F1-4FE6-8CCE-B90B5FAA3C7A
====================================================
Name : timemachine
Kind : Network
URL : smb://timemachine@192.168.10.168/timemachine
ID : ECA95A15-3033-460C-B928-46E809CC1C58
</pre>

korra time machine gui utiliidiga läbi browsitud taaste vaates (tundub, et siis ta nö monteerib külge jne), df

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 10Gi 99Gi 10% 427k 1.0G 0% /
devfs 219Ki 219Ki 0Bi 100% 758 0 100% /dev
/dev/disk3s6 228Gi 24Ki 99Gi 1% 0 1.0G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 13Gi 99Gi 12% 2.6k 1.0G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 7.5Mi 99Gi 1% 104 1.0G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 480Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 6.0Mi 480Mi 2% 38 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 3.6Mi 480Mi 1% 100 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 56Gi 99Gi 37% 696k 1.0G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk7s1 3.6Ti 5.9Gi 3.5Ti 1% 24 38G 0% /Volumes/PRO-G40
/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/volume-tm-backup-01
com.apple.TimeMachine.2025-09-19-012830.backup@/dev/disk7s3 3.6Ti 122Gi 3.5Ti 4% 541k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup
com.apple.TimeMachine.2025-11-09-213757.local@/dev/disk3s5 228Gi 55Gi 99Gi 36% 687k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-213757/Data
com.apple.TimeMachine.2025-11-09-213824.backup@/dev/disk7s3 3.6Ti 142Gi 3.5Ti 4% 569k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup
com.apple.TimeMachine.2025-11-09-165402.backup@/dev/disk7s3 3.6Ti 140Gi 3.5Ti 4% 568k 38G 0% /Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup
com.apple.TimeMachine.2025-11-09-160153.local@/dev/disk3s5 228Gi 50Gi 99Gi 34% 711k 1.0G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-11-09-160153/Data
//timemachine@192.168.10.168/timemachine 500Gi 71Gi 429Gi 15% 74M 450M 14% /Volumes/.timemachine/192.168.10.168/D4D414B7-3607-44F6-8151-4F53ECDEF964/timemachine
/dev/disk5s1 15Ti 44Gi 429Gi 10% 568k 4.5G 0% /Volumes/Backups of Imre’s MacBook Air
com.apple.TimeMachine.2025-11-09-162452.backup@/dev/disk5s1 15Ti 78Gi 429Gi 16% 568k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup
com.apple.TimeMachine.2025-09-05-014511.backup@/dev/disk5s1 15Ti 23Gi 429Gi 6% 500k 4.5G 0% /Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup
</pre>

samal ajal diskutil

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 11.3 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 11.3 GB disk3s1s1
3: APFS Volume Preboot 14.2 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 60.0 GB disk3s5
6: APFS Volume VM 24.6 KB disk3s6
7: APFS Volume macOS Restored - Data 40.1 GB disk3s7
8: APFS Volume macOS Restored 11.3 GB disk3s8

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: +16.0 TB disk4

/dev/disk5 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +16.0 TB disk5
Physical Store disk4
1: APFS Volume Backups of Imre’s Ma... 47.7 GB disk5s1

/dev/disk6 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *4.0 TB disk6
1: EFI EFI 209.7 MB disk6s1
2: Apple_APFS Container disk7 4.0 TB disk6s2

/dev/disk7 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +4.0 TB disk7
Physical Store disk6s2
1: APFS Volume PRO-G40 6.4 GB disk7s1
2: APFS Volume volume-tm-backup-01 152.3 GB disk7s3

Imres-MacBook-Air:~ root#
</pre>

kus

* võrgus samba põhise time-machine varundusele sünteesitakse vastav plokkseade /dev/disk4 ja omakorda /dev/disk5
* lokaalselt külge kinnitatud välisele sandisk-pro-g40 plokkseade on /dev/disk6 ja edasi on seal sünteesitud /dev/disk7 ning eriti /dev/disk7s3
* samba serveris on tm varunduse jaoks üks kataloog välja jagatud 16 TB suuremalt failisüsteemilt, st sellest siin väljundis 16 TB märge

üksiku tm ressursi kohta info küsimine

<pre>
Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/Backups\ of\ Imre’s\ MacBook\ Air
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-09-05-014511.backup/2025-09-05-014511.backup
/Volumes/.timemachine/E66ECC48-9693-41FB-82C4-3860C334D43D/2025-11-09-162452.backup/2025-11-09-162452.backup

Imres-MacBook-Air:~ root# tmutil listbackups -d /Volumes/volume-tm-backup-01
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-09-19-012830.backup/2025-09-19-012830.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-165402.backup/2025-11-09-165402.backup
/Volumes/.timemachine/35BBA18F-DB62-4677-950D-8894EDED1C88/2025-11-09-213824.backup/2025-11-09-213824.backup
</pre>

===Storage===

Mõisted

* Seal
* Secure Enclave
* FileVault
* Volume Group

Tööpõhimõte

* füüsiline salvestusseade on jaotatud partitsioonideks
* partitsioonile vastab nn konteiner
* konteinerile vastab midagi lvm volume group või zfs pool laadset
* konteineris sisaldub hulk volume'eid
* volumile vastab failisüsteem (apfs - apple file system)
* sama konteineri sees asuvad failisüsteemid opereerivad sama jagatud vaba ruumi tingimustes

<pre>
Imres-MacBook-Air:~ root# diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *251.0 GB disk0
1: Apple_APFS_ISC Container disk1 524.3 MB disk0s1
2: Apple_APFS Container disk3 245.1 GB disk0s2
3: Apple_APFS_Recovery Container disk2 5.4 GB disk0s3

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +245.1 GB disk3
Physical Store disk0s2
1: APFS Volume Macintosh HD 16.0 GB disk3s1
2: APFS Snapshot com.apple.os.update-... 16.0 GB disk3s1s1
3: APFS Volume Preboot 13.1 GB disk3s2
4: APFS Volume Recovery 2.1 GB disk3s3
5: APFS Volume Data 45.9 GB disk3s5
6: APFS Volume VM 20.5 KB disk3s6
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# df -h
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk3s1s1 228Gi 15Gi 156Gi 9% 412k 1.6G 0% /
devfs 205Ki 205Ki 0Bi 100% 713 0 100% /dev
/dev/disk3s6 228Gi 20Ki 156Gi 1% 0 1.6G 0% /System/Volumes/VM
/dev/disk3s2 228Gi 12Gi 156Gi 8% 1.3k 1.6G 0% /System/Volumes/Preboot
/dev/disk3s4 228Gi 692Mi 156Gi 1% 301 1.6G 0% /System/Volumes/Update
/dev/disk1s2 500Mi 6.0Mi 482Mi 2% 1 4.9M 0% /System/Volumes/xarts
/dev/disk1s1 500Mi 5.8Mi 482Mi 2% 35 4.9M 0% /System/Volumes/iSCPreboot
/dev/disk1s3 500Mi 1.6Mi 482Mi 1% 95 4.9M 0% /System/Volumes/Hardware
/dev/disk3s5 228Gi 43Gi 156Gi 22% 582k 1.6G 0% /System/Volumes/Data
map auto_home 0Bi 0Bi 0Bi 100% 0 0 - /System/Volumes/Data/home
/dev/disk3s1 228Gi 15Gi 156Gi 9% 426k 1.6G 0% /System/Volumes/Update/mnt1
/dev/disk3s3 228Gi 1.9Gi 156Gi 2% 76 1.6G 0% /Volumes/Recovery
com.apple.TimeMachine.2025-09-05-012346.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-012346/Data
com.apple.TimeMachine.2025-09-05-015510.local@/dev/disk3s5 228Gi 42Gi 156Gi 22% 579k 1.6G 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Imre’s MacBook Air/2025-09-05-015510/Data
</pre>

Juurika suhtes ressursid

<pre>
Imres-MacBook-Air:/ root# ls -lO /
total 10
lrwxr-xr-x 1 root admin - 36 Jan 15 2025 .VolumeIcon.icns -> System/Volumes/Data/.VolumeIcon.icns
---------- 1 root admin - 0 Jan 15 2025 .file
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .nofollow
drwxr-xr-x 2 root wheel - 64 Jan 15 2025 .resolve
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 .vol
drwxrwxr-x 16 root admin sunlnk 512 Sep 5 12:56 Applications
drwxr-xr-x 66 root wheel sunlnk 2112 Sep 3 21:05 Library
drwxr-xr-x@ 10 root wheel restricted 320 Jan 15 2025 System
drwxr-xr-x 5 root admin sunlnk 160 Sep 2 22:41 Users
drwxr-xr-x 6 root wheel hidden 192 Sep 7 11:57 Volumes
drwxr-xr-x@ 39 root wheel restricted,hidden 1248 Jan 15 2025 bin
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 cores
dr-xr-xr-x 4 root wheel hidden 5047 Sep 5 01:14 dev
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 etc -> private/etc
lrwxr-xr-x 1 root wheel hidden 25 Sep 5 01:14 home -> /System/Volumes/Data/home
drwxr-xr-x 2 root wheel hidden 64 Jan 15 2025 opt
drwxr-xr-x 6 root wheel sunlnk,hidden 192 Sep 5 01:14 private
drwxr-xr-x@ 77 root wheel restricted,hidden 2464 Jan 15 2025 sbin
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 tmp -> private/tmp
drwxr-xr-x@ 11 root wheel restricted,hidden 352 Jan 15 2025 usr
lrwxr-xr-x@ 1 root wheel restricted,hidden 11 Jan 15 2025 var -> private/var
</pre>

kus

* sunlnk - apfs lahendusele iseloomulik nn sünteetline link (teine variatsioon on firmlink)
* /private sisuks on tegelikult volume /System/Volumes/Data
* / on unionfs laadne lahendus, st kokku on kogutud erinevad ressrussid, mõned on read-only, mõned on read-write
* / endale vastav /dev/disk3s1s1 on /dev/disk3s1 read-only apfs snapshot - sedasi on väga madalas kihis tagatud süsteemi osa immutability

ning

<pre>
Imres-MacBook-Air:~ root# diskutil apfs list
APFS Containers (3 found)
|
+-- Container disk3 71D88332-123F-4F15-99AA-FDD26D7118F7
====================================================
APFS Container Reference: disk3
Size (Capacity Ceiling): 245107195904 B (245.1 GB)
Capacity In Use By Volumes: 77898416128 B (77.9 GB) (31.8% used)
Capacity Not Allocated: 167208779776 B (167.2 GB) (68.2% free)
|
+-< Physical Store disk0s2 F202FF0C-8102-4C98-8DEA-BFC6BE9C61B4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 245107195904 B (245.1 GB)
|
+-> Volume disk3s1 9D894F4B-1ADA-47A9-9864-CECA47F5CC54
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s1 (System)
| Name: Macintosh HD (Case-insensitive)
| Mount Point: /System/Volumes/Update/mnt1
| Capacity Consumed: 15970652160 B (16.0 GB)
| Sealed: Broken
| FileVault: Yes (Unlocked)
| Encrypted: No
| |
| Snapshot: E4EE5A50-F503-4DC3-BB9E-6C3EF76A9105
| Snapshot Disk: disk3s1s1
| Snapshot Mount Point: /
| Snapshot Sealed: Yes
|
+-> Volume disk3s2 5C7FF5F7-C059-4568-879D-AEE09DB60CF7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: /System/Volumes/Preboot
| Capacity Consumed: 13066547200 B (13.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s3 8A6ADAED-7C32-4DFB-8731-005DA53BB3FF
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: /Volumes/Recovery
| Capacity Consumed: 2082414592 B (2.1 GB)
| Sealed: No
| FileVault: No
|
+-> Volume disk3s5 53270D80-303A-47F4-83DE-D2B9228E9FC7
| ---------------------------------------------------
| APFS Volume Disk (Role): disk3s5 (Data)
| Name: Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 45915893760 B (45.9 GB)
| Sealed: No
| FileVault: Yes (Unlocked)
|
+-> Volume disk3s6 5B9AA026-E765-4922-BFEA-B48FD11A79C6
---------------------------------------------------
APFS Volume Disk (Role): disk3s6 (VM)
Name: VM (Case-insensitive)
Mount Point: /System/Volumes/VM
Capacity Consumed: 20480 B (20.5 KB)
Sealed: No
FileVault: No
</pre>

iostat esitab ainult füüsiliste seadmete kohta info, huvitaval kombel ka time machine lahendusele vastava seadme (disk4) oma

<pre>
imreoolberg@Imres-MacBook-Air ~ % iostat 5
disk0 disk4 cpu load average
KB/t tps MB/s KB/t tps MB/s us sy id 1m 5m 15m
17.03 37 0.61 52.37 0 0.00 3 1 96 1.12 1.52 1.63
6.17 7 0.04 0.00 0 0.00 2 1 97 1.11 1.51 1.63
4.00 2 0.01 0.00 0 0.00 1 1 98 1.11 1.51 1.63
...
</pre>

Automaatse monteerimise vältimine

<pre>
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored" | grep "Volume UUID"
Volume UUID: CB4A4A81-A9EE-471D-90CA-7A116C740AC6
Imres-MacBook-Air:~ root# diskutil info "/Volumes/macOS Restored - Data" | grep "Volume UUID"
Volume UUID: 6AB10166-A262-4E22-8FE6-0D5C97C731FB

Imres-MacBook-Air:~ root# vifs

Imres-MacBook-Air:~ root# cat /etc/fstab
#
# Warning - this file should only be modified with vifs(8)
#
# Failure to do so is unsupported and may be destructive.
#

UUID=6AB10166-A262-4E22-8FE6-0D5C97C731FB none apfs rw,noauto
UUID=CB4A4A81-A9EE-471D-90CA-7A116C740AC6 none apfs rw,noauto
</pre>

Vastasel korral süsteem otsib teiselt volume'ilt ka nt Applicationid üles

[[Fail:20250903-spotlight-01.png|600px]]

Kopeerimine failisüsteemis

<pre>
Imres-MacBook-Air:~ root# ditto /Applications/Yubico\ Authenticator.app/ /Users/imreoolberg/Documents/Yubico\ Authenticator.app/
</pre>

Finder GUI liidesega programm.

USB pulk abil apsf opereerimine, volume lisamine

<pre>
Imres-MacBook-Air:~ root# diskutil eraseDisk APFS "USBTEST" /dev/disk4

Imres-MacBook-Air:~ root# diskutil apfs unlockVolume /dev/disk5s4

Imres-MacBook-Air:~ root# diskutil apfs addVolume disk5 APFS volume-05
Will export new APFS Volume "volume-05" from APFS Container Reference disk5
Started APFS operation on disk5
Preparing to add APFS Volume to APFS Container disk5
Creating APFS Volume
Created new APFS Volume disk5s5
Mounting APFS Volume
Setting volume permissions
Disk from APFS operation: disk5s5
Finished APFS operation on disk5

Imres-MacBook-Air:~ root# diskutil unmount /dev/disk5s5
Volume volume-05 on disk5s5 unmounted
Imres-MacBook-Air:~ root# diskutil mount /dev/disk5s5
Volume volume-05 on /dev/disk5s5 mounted

Imres-MacBook-Air:~ root# diskutil apfs deleteVolume /dev/disk5s4
Started APFS operation
Deleting APFS Volume from its APFS Container
Unmounting disk5s4
Erasing any xART session referenced by 9AC9146E-455D-45BA-99EC-3FE32D2CE59B
Deleting Volume
Removing any Preboot and Recovery Directories
Finished APFS operation
</pre>

Konteinerid ja volume'id

<pre>
Imres-MacBook-Air:~ root# df -h | grep part- | sort
/dev/disk5s1 1.9Gi 1.0Mi 1.9Gi 1% 109 19M 0% /Volumes/part-01-volume-01
/dev/disk6s1 3.7Gi 1.0Mi 3.7Gi 1% 109 39M 0% /Volumes/part-02-volume-01
/dev/disk7s1 11Gi 1.0Mi 11Gi 1% 113 119M 0% /Volumes/part-03-volume-01
/dev/disk8s1 12Gi 992Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-01
/dev/disk8s2 12Gi 988Ki 11Gi 1% 105 120M 0% /Volumes/part-04-volume-02
/dev/disk8s3 12Gi 1.0Mi 11Gi 1% 105 120M 0% /Volumes/part-04-volume-03
</pre>

ning

<pre>
Imres-MacBook-Air:~ root# diskutil list disk4
/dev/disk4 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *30.8 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_APFS Container disk5 2.0 GB disk4s2
3: Apple_APFS Container disk6 4.0 GB disk4s3
4: Apple_APFS Container disk7 12.2 GB disk4s4
5: Apple_APFS Container disk8 12.4 GB disk4s5
</pre>

kus

* füüsiline ketas on /dev/disk4
* füüsilise ketta partitsioonid on konteinerid /dev/disk5, /dev/disk6 jne
* konteinerite sees on volume'id, nt disk8 sees on kolm tükki, s1, s2 ja s3

ning

[[Fail:20250909-disk-utility-01.png|800px]]

kus

* TODO

Failide arhiveerime ja kopeerimine süsteemist välja

<pre>
imreoolberg@Imres-MacBook-Air ~ % ditto -ck --sequesterRsrc /Users/imreoolberg /Volumes/imre-data-01/users-imreoolberg.zip
</pre>

====TRIM====

<pre>
Imres-MacBook-Air:~ root# system_profiler SPNVMeDataType
NVMExpress:

Apple SSD Controller:

APPLE SSD AP0256Z:

Capacity: 251 GB (251,000,193,024 bytes)
TRIM Support: Yes
Model: APPLE SSD AP0256Z
Revision: 2,077.140
Serial Number: 0ba028eb8328ce39
Detachable Drive: No
BSD Name: disk0
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
iSCPreboot:
Capacity: 524.3 MB (524,288,000 bytes)
BSD Name: disk0s1
Content: Apple_APFS_ISC
Macintosh HD:
Capacity: 245.11 GB (245,107,195,904 bytes)
BSD Name: disk0s2
Content: Apple_APFS
Recovery:
Capacity: 5.37 GB (5,368,664,064 bytes)
BSD Name: disk0s3
Content: Apple_APFS_Recovery

Generic SSD Controller:

WD_BLACK SN850XE 4000GB:

Capacity: 4 TB (4,000,787,030,016 bytes)
TRIM Support: Yes
Model: WD_BLACK SN850XE 4000GB
Revision: 624131EX
Serial Number: 24525S801688
Link Width: x4
Link Speed: 8.0 GT/s
Detachable Drive: No
BSD Name: disk4
Partition Map Type: GPT (GUID Partition Table)
Removable Media: No
S.M.A.R.T. status: Verified
Volumes:
EFI:
Capacity: 209.7 MB (209,715,200 bytes)
File System: MS-DOS FAT32
BSD Name: disk4s1
Content: EFI
Volume UUID: 0E239BC6-F960-3107-89CF-1C97F78BB46B
PRO-G40:
Capacity: 4 TB (4,000,577,273,856 bytes)
BSD Name: disk4s2
Content: Apple_APFS
</pre>

kus

* TRIM Support: Yes - trim on nendel seadmetel asuvatel apfs failisüsteemidel võimalik ja kohal st sisselülitatud
* apfs trim on ext4 fstab 'discard' sarnane, mitte 'fstrim /' cron jobs abil ütlemise sarnane
* Model: APPLE SSD AP0256Z - '256' väljendab suurust 256 GB, nt teine mudel on AP1024Z ja väljendab suurust 1 TB

===Launchd kasutamine===

<pre>
Imres-MacBook-Air:/ root# cat /Library/LaunchDaemons/com.myname.addroute.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.myname.addroute</string>
<key>ProgramArguments</key>
<array>
<string>/sbin/route</string>
<string>-n</string>
<string>add</string>
<string>192.0.2.1/32</string>
<string>192.168.64.2</string>
</array>
<key>RunAtLoad</key>
<true/>
</dict>
</plist>
</pre>

käivitamiseks

<pre>
Imres-MacBook-Air:/ root# launchctl load /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

tulemusena

<pre>
Imres-MacBook-Air:/ root# netstat -nr | grep 192.0.
192.0.2.1/32 192.168.64.2 UGSc bridge100
</pre>

Ta on olemas globaalses launched listis

<pre>
Imres-MacBook-Air:/ root# launchctl list | grep myn
- 0 com.myname.addroute
</pre>

Põhimõtteliselt peaks töötama ka unload, aga antud juhul ei oma see toimet selle konkreetse nähtuse one-shot olemuse tõttu

<pre>
Imres-MacBook-Air:/ root# launchctl unload /Library/LaunchDaemons/com.myname.addroute.plist
</pre>

====Cron====

TODO

<pre>
Imres-MacBook-Air:~ root# plutil -p /System/Library/LaunchDaemons/com.apple.tmp_cleaner.plist
{
"Label" => "com.apple.tmp_cleaner"
"LowPriorityIO" => 1
"Nice" => 1
"ProgramArguments" => [
0 => "/usr/libexec/tmp_cleaner"
]
"StartCalendarInterval" => {
"Hour" => 0
}
}
</pre>

===Virtualiseerimine - UTM===

Süsteemis kirjeldatud virtuaalsed arvutid

<pre>
Imres-MacBook-Air:/ root# /System/Volumes/Data/Applications/UTM.app/Contents/MacOS/utmctl list
UUID Status Name
DE2A3E49-B049-40F9-9D79-3C1448B446C9 started vm-deb13-01
</pre>

Virtuaalse arvuti virtuaalne plokkseade

<pre>
Imres-MacBook-Air:/ root# du -sh /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
5.9G /Users/imreoolberg/Library/Containers/com.utmapp.UTM/Data/Documents/vm-deb13-01.utm/Data/2BBCF278-9AA7-4741-95B5-1886EC71C110.qcow2
</pre>

Virtuaalsele arvutile vastav võrgundus

<pre>
Imres-MacBook-Air:/ root# ifconfig bridge100
bridge100: flags=8a63<UP,BROADCAST,SMART,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
options=3<RXCSUM,TXCSUM>
ether fa:73:df:a0:51:64
inet 192.168.64.1 netmask 0xffffff00 broadcast 192.168.64.255
inet6 fe80::f873:dfff:fea0:5164%bridge100 prefixlen 64 scopeid 0x19
inet6 fda5:2ff0:49ee:6d45:14d7:6e80:6b22:c592 prefixlen 64 autoconf secured
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: vmenet0 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 24 priority 0 path cost 0
Address cache:
5e:7f:36:30:6b:51 Vlan1 vmenet0 1161 flags=0<>
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active

Imres-MacBook-Air:/ root# ifconfig vmenet0
vmenet0: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
ether b2:7a:48:40:de:47
media: autoselect
status: active
</pre>

===Virtualiseerimine - Virtualization.framework===

TODO

Väited

* Virtualization.framework kasutamine on võimalik UTM lahendusega
* Virtualization.framework'i kasutab Rancher Desktop lahendendus
* Virtualization.framework'i kasutab Claude Desktop lahendendus (Claude Cowork ja Claude Code puhul)

Virtuaalsetele arvutitele vastavad protsessid paistavad sellised

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep Virtuali
imreoolberg 9439 0.9 4.3 439637536 728784 ?? Ss 5:05PM 8:35.18 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
imreoolberg 2439 0.3 0.3 439691712 46720 ?? Ss 10:05AM 4:55.14 /System/Library/Frameworks/Virtualization.framework/Versions/A/XPCServices/com.apple.Virtualization.VirtualMachine.xpc/Contents/MacOS/com.apple.Virtualization.VirtualMachine
</pre>

ning

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 2439 -P -n | grep claudevm
com.apple 2439 imreoolberg txt REG 1,13 131072 124423025 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/efivars.fd
com.apple 2439 imreoolberg 6u REG 1,13 10737418240 124154442 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img
com.apple 2439 imreoolberg 11u REG 1,13 35880960 124155054 /Users/imreoolberg/Library/Application Support/Claude/vm_bundles/claudevm.bundle/sessiondata.img
</pre>

Kasulikud lisamaterjalid

* https://developer.apple.com/documentation/virtualization?language=objc

===Võrk===

Vaikimisi on application firewall välja lülitatud

<pre>
Imres-MacBook-Air:~ root# /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is disabled. (State = 0)
</pre>

ning pfctl olukord

<pre>
Imres-MacBook-Air:~ root# pfctl -si
No ALTQ support in kernel
ALTQ related functions disabled
Status: Enabled for 0 days 00:05:41 Debug: Urgent

State Table Total Rate
current entries 113
searches 11661 34.2/s
inserts 370 1.1/s
removals 257 0.8/s
Counters
match 579 1.7/s
bad-offset 0 0.0/s

Imres-MacBook-Air:~ root# pfctl -ss
No ALTQ support in kernel
ALTQ related functions disabled
ALL tcp 192.168.134.76:57540 -> 192.168.10.77:8291 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61048 <- 104.18.39.21:443 ESTABLISHED:ESTABLISHED
ALL tcp 192.168.134.76:61225 -> 192.168.10.196:80 ESTABLISHED:ESTABLISHED
ALL udp 192.168.134.76:49898 -> 142.251.151.119:443 MULTIPLE:MULTIPLE
..
</pre>

Parasjagu avatud võrgusoketid

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4TCP -sTCP:LISTEN
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 8u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 12u IPv4 0xd123f519af7dbdee 0t0 TCP *:22 (LISTEN)
launchd 1 root 36u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
launchd 1 root 38u IPv4 0x891943a4a4a3ca9 0t0 TCP 127.0.0.1:8021 (LISTEN)
ControlCe 632 imreoolberg 10u IPv4 0xde3561cefae81e29 0t0 TCP *:7000 (LISTEN)
ControlCe 632 imreoolberg 12u IPv4 0xbbbca5f5375388e5 0t0 TCP *:5000 (LISTEN)
rapportd 633 imreoolberg 10u IPv4 0x7505a25821d3a7df 0t0 TCP *:49152 (LISTEN)
zabbix_ag 6815 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
zabbix_ag 6816 zabbix 6u IPv4 0xe7ca8a84e1c8509f 0t0 TCP *:10050 (LISTEN)
...
</pre>

kus

* vaikimisi pfctl ei ole aktiivne, aga nt utm virtuaalse arvuti käivitamine aktiveerib (pfctl teeb utm arvutile src-nat teisendust
* pfctl laseb praktiliselt igasuguse liikluse läbi (nö tavaline brauser -> internet liiklus jms nö registreeritakse pfctl paketifiltriga, aga lubatakse läbi)
* 8021 on pfctl ftp-proxy mooduliga seotud
* 7000 ja 5000 pordid on seotud airdrop ja airport jms osakondadega (airport on vana aja nimetus everything-wifi kohta mac puhul)

Misc

<pre>
Imres-MacBook-Air:~ root# lsof -nP -i4UDP
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
launchd 1 root 7u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 8u IPv4 0xfd237aa308fea29c 0t0 UDP *:67
launchd 1 root 39u IPv4 0x8d461240652f3ced 0t0 UDP *:138
launchd 1 root 40u IPv4 0xb4b96b1c5de038ec 0t0 UDP *:137
mDNSRespo 441 _mdnsresponder 6u IPv4 0x2d5727fb23b4e854 0t0 UDP *:5353
mDNSRespo 441 _mdnsresponder 14u IPv4 0x1ed59c3cb4235fee 0t0 UDP *:53
airportd 455 root 4u IPv4 0x6e0c4f2c444299c 0t0 UDP *:*
airportd 455 root 9u IPv6 0xea04c0f07ef2ac65 0t0 UDP *:*
airportd 455 root 11u IPv4 0xb4a853f1977e96bf 0t0 UDP *:*
airportd 455 root 12u IPv4 0x6e9d20d0d8a5c95f 0t0 UDP *:*
...
</pre>

====Riistvara====

Võrguliidese MTU muutmiseks

<pre>
imreoolberg@Imres-MacBook-Air ~ % networksetup -listallnetworkservices
An asterisk (*) denotes that a network service is disabled.
USB 10/100/1000 LAN
USB 10/100/1G/2.5G LAN
USB 10/100/1G/2.5G LAN 2
Thunderbolt Bridge
Wi-Fi

imreoolberg@Imres-MacBook-Air ~ % networksetup -getMTU Wi-Fi
Active MTU: 1500 (Current Setting: 1500)

# networksetup -setMTU Wi-Fi 1400
</pre>

====Ruuting====

ipv4 ruutingutabeli esitamine

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet
Routing tables

Internet:
Destination Gateway Flags Netif Expire
default 192.168.134.77 UGScg en0
127 127.0.0.1 UCS lo0
127.0.0.1 127.0.0.1 UH lo0
169.254 link#12 UCS en0 !
192.168.134 link#12 UCS en0 !
192.168.134.2/32 link#12 UCS en0 !
192.168.134.77/32 link#12 UCS en0 !
192.168.134.77 64:d1:54:a7:cc:99 UHLWIir en0 1199
192.168.134.255 ff:ff:ff:ff:ff:ff UHLWbI en0 !
224.0.0/4 link#12 UmCS en0 !
224.0.0.251 1:0:5e:0:0:fb UHmLWI en0
255.255.255.255/32 link#12 UCS en0 !
</pre>

====Võrk - bluetooth====

Kuigi 2025 aastal müüdavate Apple Magic Keyboard puhul paljuski väljendatakse, et nad on kasutatavad wireless režiimis ja jääb mulje, et ainult nii, siis osutub, et tegelikult neil on toiteks mõeldud usb kaabel usb siiski ka andmevahetuseks võimaline. non-radio kasutamiseks

* system setting - bluetooth osakonnas lülitada välja bluetooth terviklikult, näiteks
* klaviatuur jätkab töötamist

====Võrk - wireless====

<pre>
Imres-MacBook-Air:~ root# wdutil info | head -n 44
————————————————————————————————————————————————————————————————————
NETWORK
————————————————————————————————————————————————————————————————————
Primary IPv4 : en0 (Wi-Fi / 9B1345E5-7303-47E8-9C98-5C1D150E7921)
: 192.168.134.74
Primary IPv6 : None
DNS Addresses : 1.1.1.1
Apple : Reachable
————————————————————————————————————————————————————————————————————
WIFI
————————————————————————————————————————————————————————————————————
MAC Address : <redacted> (hw=<redacted>)
Interface Name : en0
Power : On [On]
Op Mode : STA
SSID : <redacted>
BSSID : <redacted>
RSSI : -83 dBm
CCA : 2 %
Noise : -94 dBm
Tx Rate : 65.0 Mbps
Security : WPA2 Personal
PHY Mode : 11ac
MCS Index : 1
Guard Interval : 400
NSS : 1
Channel : 5g36/80
Country Code : EE
Scan Cache Count : 3
NetworkServiceID : 9B1345E5-7303-47E8-9C98-5C1D150E7921
IPv4 Config Method : DHCP
IPv4 Address : 192.168.134.74
IPv4 Router : 192.168.134.77
IPv6 Config Method : Automatic
IPv6 Address : fe80::ccb:dc0f:9b07:4271
IPv6 Router : None
DNS : 1.1.1.1
BTC Mode : Off
Desense :
Chain Ack : []
BTC Profile 2.4GHz : Disabled
BTC Profile 5GHz : Disabled
Sniffer Supported : YES
Supports 6e : Yes
</pre>

kus

* alumiselt pildilt tunneb ära sama info, nt channel 5g36/80
* 11ac tähistab protokolli 802.11ac

Visuaalne kujutis samas olukorras

[[Fail:20260718-macos-wifi-01.png|1000px]]

kus

* TODO

====SSH kaugligipääs====

Eemalt ligipääsu võimaldamiseks, ei pruugi olla hea mõte

[[Fail:20260706-macos-ssh-remote-access-01.png|600px]]

kus

* Remote Login

===Tulemüür===

Mõisted

* ALF - Application Layer Firewall
* PF - Packet filter

Väited

* MacOS tulemüüri lahendus on kahe kihiline, eemalt saabuva liiklusega tegeleb esmalt pf ja seejärel alf
* pf töötab ankrute abil (nii filtrimise kui nö teisenduse osas)
* pf aknrute sisu tekitatakse ka dünaamiliselt - st parasjagu mälus olevale seisule vastavaid faile ei ole failisüsteemis
* custom pf osa asub lisatud ankru sees - ee.pri.auul.rules

====Tulemüür - ALF====

Väited

* ALF põhimõtteliselt tegeleb macos enda operatsioonisüsteemis töötavate protsessidega
* macos platvormil töötav virtuaalne arvuti on ALF vaatest üks protsess (ta ei näe sinna sisse)
* ALF tulemüüris ei tegeleta ip aadresside ega portidega
* ALF tulemüür tegeleb ainult siseneva liiklus piiramisega (väljuvaga ei tegele üldse)

ALF tulemüüri seadistamine toimub

System Settings -> Network -> Firewall

ning paistab selline pilt

[[Fail:20260808-macos-fw-02.png|600px]]

Pressides 'Options ...' paistab selline pilt

[[Fail:20260808-macos-fw-01.png|600px]]

kus

* TODO

====Tulemüür - PF====

Väited

* pf tulemüür tegeleb nii siseneva kui väljuva liiklusega

PF mälus peale custom muudatust

<pre>
Imres-MacBook-Air:~ root# pfctl -sr
No ALTQ support in kernel
ALTQ related functions disabled
scrub-anchor "com.apple/*" all fragment reassemble
scrub-anchor "com.apple.internet-sharing" all fragment reassemble
anchor "ee.pri.auul.rules" all
anchor "com.apple/*" all
anchor "com.apple.internet-sharing" all

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state

Imres-MacBook-Air:~ root# pfctl -sn
No ALTQ support in kernel
ALTQ related functions disabled
nat-anchor "com.apple/*" all
nat-anchor "com.apple.internet-sharing" all
rdr-anchor "com.apple/*" all
rdr-anchor "com.apple.internet-sharing" all
</pre>

kus

* pf filter osakonnas on lisaks default kooseisule sissekanne 'anchor "ee.pri.auul.rules" all'
* esitatakse ankur ee.pri.auul.rules sisu
* pf filter nat ja rdr osakonnas ei ole erinevusi default'is

Failisüsteemi sisu

<pre>
Imres-MacBook-Air:~ root# find /etc/pf* -type f
/etc/pf.anchors/ee.pri.auul.rules
/etc/pf.anchors/com.apple
/etc/pf.conf
/etc/pf.os
</pre>

Käsundamine, reeglite kehtestamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -f /etc/pf.anchors/ee.pri.auul.rules
</pre>

ip addresside tabeli kasutamine

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -sr
No ALTQ support in kernel
ALTQ related functions disabled
block drop log quick on en0 proto tcp from any to <blocked_hosts_https> port = 443
pass log quick on en0 proto tcp from any to any port = 443 flags S/SA keep state
pass on en0 proto tcp all flags S/SA keep state
pass on en0 proto udp all keep state
</pre>

kus

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.154.221.53
10.154.221.54
</pre>

ning aknru sisule vastav seadistusfail

<pre>
Imres-MacBook-Air:~ root# cat /etc/pf.anchors/ee.pri.auul.rules
table <blocked_hosts_https> { 10.154.221.53, 10.154.221.54 }

block quick log on en0 proto tcp to <blocked_hosts_https> port 443
pass quick log on en0 proto tcp to any port 443
pass on en0 proto tcp
pass on en0 proto udp
</pre>

tabeli sisu saab muuta käigult

<pre>
Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T add 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses added.

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T show
No ALTQ support in kernel
ALTQ related functions disabled
10.0.113.9
10.154.221.53
10.154.221.54

Imres-MacBook-Air:~ root# pfctl -a ee.pri.auul.rules -t blocked_hosts_https -T delete 10.0.113.9
No ALTQ support in kernel
ALTQ related functions disabled
1/1 addresses deleted.
</pre>

===Tarkvara haldus===

====Mõisted====

* DMG - disk image

====Sissejuhatus====

Üldiselt tekib tarkvara macos süsteemi kolmest allikast

* süsteemne tarkvara - nö süsteemi enda paigaldamise tagajärel, nt Safari brauser
* App Store - apple.com standardne viis tarkvara levitada, nt Yubico Authenticator
* tootja levitab - igasugused huvilised, ausama ja vähem ausamad levitavad .dmg formaadis tõmmist oma veebikohas/repos/jms - nt BetterTouchTool

Tarkvara paigaldamisel võiks eelistada App Store lahendust võimalusel

* tarkvara on läbinud teatud turvalisuse jms kaanonitega seotud protseduurid
* paigaldamise järgne uuendamine toimub automaatselt, sarnaselt põhisüsteemi tarkvaraga

Rakenduste jaoks on üldiselt kolm asukohta failisüsteemis

* /System/Applications - read only
* /Applications - read write
* ~/Applications ehk nt /Users/imreoolberg/Applications - read write

~/Applications kataloogi on realistlik paigaldada nö lihtsat tarkvara, nt mis ei sisalda kernel extensioneid vms (nt OpenVPN ei saa, aga XCA saab). Paigaldamine toimub Finder gui liideses .dmg sees oleva .app kataloogi vedamise teel ~/Applications kataloogi või käsureal nt

$ ditto /Volumes/XCA/xca.app ~/Applications

====Tarkvara allikad====

TODO

Mitte-ametlikud registrid

* https://www.macupdate.com/
* https://www.apponic.com/mac/

====Tööpõhimõte - drag-and-drop install====

Tundub, et lihtsamal juhul tarkvara paigaldamine seisneb lihtsalt failide kopeerimises .dmg failist arvuti kataloogi /Applications. .dmg faili moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil create -ov -fs "APFS" -size 200m -volname "SimpleCalc" MyDisk.dmg
</pre>

monteerimine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil attach MyDisk.dmg
</pre>

Sisu moodustamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % date > /Volumes/SimpleCalc/testfile.txt
</pre>

lahti ühendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil detach /Volumes/SimpleCalc
</pre>

teisendamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % hdiutil convert MyDisk.dmg -format UDZO -o SimpleCalc-1.0.dmg
</pre>

Kui on soov läbi proovida nö omatehtud .dmg ja elamus, siis sobib

* mingi olemasolev lihtne .app põhine rakendus võtta aluseks - nt xca rakendus
* tema sisu kopeerida omatehtud .dmg sisse
* lõpuks selle abil tarkvara paigaldada

Osutub, et kui Finderis öelda Open siis monteeritaks .dmg nagu virtuaalne failipõhine plokkseade, mille juurkataloogi sisuks on peamiselt kaks sissekannet

* link /Applications kataloogile
* xca.app kataloog rakendusega

Ja Open avab ka nö erilises vaates Finderi, kus on näha nö traditsiooniline hiirega drag-and-drop install vaade, tehniliselt toimub tavaline kataloog-kopeeritakse-kataloogi muudatus.

MacOS sellist drag viisil tehtud tarkvara paigalduse ei registreeri kuskil keskses tarkvara-registris vms. Selline tarkvara paigaldamine on tehniliselt kataloogi kopeerimine, millega kaasneb signatuuri kontroll jms administratiivne element.

====Tööpõhimõte - installer packages====

<pre>
$ pkgutil --packages
$ pkgutil --files paketinimi
</pre>

====Paigaldatud tarkvara nimekirja esitamine====

GUI

<pre>
System Settings -> General -> System report -> Software -> Applications -> not obtained-from Apple
</pre>

käsurealt

<pre>
imreoolberg@Imres-MacBook-Air ~ % system_profiler SPApplicationsDataType | grep -B 3 -A 5 "Identified De" | head -n 20
Google Chrome:

Version: 140.0.7339.81
Obtained from: Identified Developer
Last Modified: 30.08.2025, 01:47
Kind: Universal
Signed by: Developer ID Application: Google LLC (EQHXZ8M8AV), Developer ID Certification Authority, Apple Root CA
Location: /Applications/Google Chrome.app
Get Info String: Google Chrome 140.0.7339.81, Copyright 2025 Google LLC. All rights reserved.
--
iTerm:

Version: 3.5.14
Obtained from: Identified Developer
Last Modified: 16.05.2025, 02:59
Kind: Universal
Signed by: Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D), Developer ID Certification Authority, Apple Root CA
Location: /Applications/iTerm.app
Get Info String: 3.5.14
--
</pre>

Üks viis on küsida failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep imreoo
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 3 11:10 /Applications/BetterTouchTool.app
drwxrwxr-x@ 3 imreoolberg admin 96 Aug 30 01:47 /Applications/Google Chrome.app
drwxr-xr-x@ 3 imreoolberg staff 96 May 16 02:59 /Applications/iTerm.app
drwxr-xr-x@ 3 imreoolberg admin 96 Apr 8 08:11 /Applications/UTM.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 25 15:41 /Applications/Visual Studio Code.app

imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/* | grep qdigi
drwxr-xr-x@ 3 root wheel 96 Sep 8 16:56 /Applications/qdigidoc4.app
</pre>

kus

* sõltuvalt paigaldusviisist on faili omanik erinev
* põhimõtteliselt tekib sellisest lähenemisest probleeme, nt mis siis kui süsteemil on mitu kasutajat, installinud kasutaja eemaldatakse jne - üks viis on kasutada süsteemis ühte non-personal administraator kasutajat kes tegeleb tarkvara paigaldamisega jms, ja ülejäänud kasutavad tarkvara
* @ tähistab asjaolu, et failiga on seotud apfs failisüsteemi extended attributs omadused, nt registreeritakse sedasi autor

<pre>
imreoolberg@Imres-MacBook-Air ~ % xattr -p com.apple.appstore.vendor_name "/Applications/Yubico Authenticator.app"
Yubico
</pre>

====Paigaldamine - App Store====

TODO

[[Fail:20250908-app-store-yubico-authenticator-01.png|900px]]

kus

* pressida Get -> Install -> Open
* tarkvara 'Obtained from' väärtuseks on 'App store'
* online otsing - https://www.apple.com/us/search/yubico?src=globalnav

====Paigaldamine - tootja juurest kopeerides====

TODO

====Tarkvara uuendamine====

Väited

* tarkvara uuendusi ei väljastata kindlaksmääratud aegadel (nt nagu Ubuntu või OpenBSD puhul)
* tarkvara uuendusi väljastatakse mitmel korral aastas ja vastavalt vajadusele
* tarkvara uuendused jaotuvad: 1. turva-uuendused, 2. vigade parandused, 3. funktsionaalsed muudatused
* tarkvara uuendusi koheldatakse terviklikult, st ei ole eraldi nt süsteemi osas ja rakendustarkvara, või pakettide nimekiri, millest saab teha käesoleva uuenduse korra jaoks valiku

Nt 2025 aastal on olnud selline uuenduste ajalugu

* January 27: macOS Sequoia 15.3, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3 were released with security patches.
* February 10: An urgent security update, macOS Sequoia 15.3.1, was released.
* March 11: macOS Sequoia 15.3.2 was released, addressing security vulnerabilities in WebKit.
* March 31: macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5 were released.
* April 16: macOS Sequoia 15.4.1 was released, providing security patches.
* May 12: macOS Sequoia 15.5, macOS Sonoma 14.7.6, and macOS Ventura 13.7.6 were released.
* July 29: macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7 were released.
* August 20: macOS Sequoia 15.6.1 was released with security updates.

Käsundamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % sw_vers
ProductName: macOS
ProductVersion: 15.3
BuildVersion: 24D2059

imreoolberg@Imres-MacBook-Air ~ % softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* Label: macOS Sequoia 15.6.1-24G90
Title: macOS Sequoia 15.6.1, Version: 15.6.1, Size: 6160384KiB, Recommended: YES, Action: restart,
</pre>

====Tarkvara uuendamine - App Store====

App Store rakendus vasakus paneelis on kõige all valik

Updates

[[Fail:20251203-macos-app-store-updates-01.png|800px]]

===Logi===

TODO

Kui klaviatuuri ja hiire kasutamine olid ebastabiilsed, siis soovitas gemini.google midagi sellist küsida, ei tea mis siit järeldada

<pre>
imreoolberg@Imres-MacBook-Air ~ % log show --predicate 'process == "WindowServer"' --style syslog --last 40m| grep -i skyl | tail -n 10
2026-07-06 00:49:00.495406+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:00.600614+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.751674+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.767823+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:00.824865+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] pid 771 failed to act on a ping it dequeued before timing out.
2026-07-06 00:49:00.847454+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.083920+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] delivery manager destinations for kCGSEventKeyDown event: <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.175320+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:KeyboardEvent] kCGSEventKeyUp was part of a sequence with destination <keyboardFocus; pid: 2922; token: viewbridge-key-window>
2026-07-06 00:49:01.498496+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
2026-07-06 00:49:01.498503+0300 localhost WindowServer[419]: (SkyLight) [com.apple.SkyLight:default] _CGXPackagesSetWindowConstraints: Invalid window
</pre>

===Misc===

====Screen Lock====

Tundub, et caffeinate on hästi efektiivne

$ caffeinate -di

====Watchdog====

Väited

* hardware watchdog on paratamatult sisse lülitatud
* software watchdog on seaditatav, vaikimisi on sisse lülitatud

<pre>
TODO
</pre>

====Programm====

Käivitamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % open -a BetterTouchTool
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
13:09:53.164 [desktop.init] INFO: Logging initialized, outputting to stderr
13:09:53.173 [desktop.init] INFO: Window hidden on startup: false
13:09:53.174 [desktop.init] INFO: Starting Helper subprocess: /Applications/Yubico Authenticator.app/Contents/Resources/helper/authenticator-helper
13:09:53.175 [desktop.init] INFO: Helper process started
13:09:53.176 [main] INFO: Running Yubico Authenticator...
{app_version: 7.2.3, dart: 3.8.1 (stable) (Wed May 28 00:47:25 2025 -0700) on "macos_arm64", os: macos, os_version: Version 15.6.1 (Build 24G90)}
13:09:53.302 [helper.ykman.logging] INFO: Logging at level: INFO
13:09:53.302 [helper.helper.device] INFO: Log level set to: INFO
13:09:53.302 [desktop.init] INFO: Helper log level set
13:09:53.327 [desktop.devices] INFO: USB state change
{"data":{"state":5740354900026072187,"pids":{}},"actions":["get","scan"],"children":{}}
13:09:53.327 [desktop.devices] INFO: USB state updated, unaccounted for: {}
..
</pre>

edasi

<pre>
Imres-MacBook-Air:/ root# file "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64]
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture x86_64): Mach-O 64-bit executable x86_64
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (for architecture arm64): Mach-O 64-bit executable arm64
Imres-MacBook-Air:/ root#
</pre>

<pre>
imreoolberg@Imres-MacBook-Air Documents % cat hello.c
#include <stdio.h>

int main() {
printf("Hello, World!\n");
return 0;
}
</pre>

kompileerimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % clang hello.c -o hello
</pre>

käivitamine

<pre>
imreoolberg@Imres-MacBook-Air Documents % ./hello
Hello, World!
</pre>

otool abil binary uurimine

<pre>
imreoolberg@Imres-MacBook-Air Documents % otool -L hello
hello:
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1351.0.0)
</pre>

yubico authenticator binary uurimine

<pre>
Imres-MacBook-Air:/ root# otool -L "/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator"
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture x86_64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/Applications/Yubico Authenticator.app/Contents/MacOS/Yubico Authenticator (architecture arm64):
@rpath/desktop_drop.framework/Versions/A/desktop_drop (compatibility version 1.0.0, current version 1.0.0)
@rpath/file_picker.framework/Versions/A/file_picker (compatibility version 1.0.0, current version 1.0.0)
@rpath/local_notifier.framework/Versions/A/local_notifier (compatibility version 1.0.0, current version 1.0.0)
@rpath/path_provider_foundation.framework/Versions/A/path_provider_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/screen_retriever_macos.framework/Versions/A/screen_retriever_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/shared_preferences_foundation.framework/Versions/A/shared_preferences_foundation (compatibility version 1.0.0, current version 1.0.0)
@rpath/tray_manager.framework/Versions/A/tray_manager (compatibility version 1.0.0, current version 1.0.0)
@rpath/url_launcher_macos.framework/Versions/A/url_launcher_macos (compatibility version 1.0.0, current version 1.0.0)
@rpath/window_manager.framework/Versions/A/window_manager (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.120.2)
/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit (compatibility version 45.0.0, current version 2487.60.105)
/usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)
/usr/lib/swift/libswiftCoreAudio.dylib (compatibility version 1.0.0, current version 6.0.0, weak)
/usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
/usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)
/usr/lib/swift/libswiftCoreMedia.dylib (compatibility version 1.0.0, current version 3110.8.2, weak)
/usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)
/usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0, weak)
/usr/lib/swift/libswiftIOKit.dylib (compatibility version 1.0.0, current version 1.0.0, weak)
/usr/lib/swift/libswiftMetal.dylib (compatibility version 1.0.0, current version 343.19.0, weak)
/usr/lib/swift/libswiftOSLog.dylib (compatibility version 1.0.0, current version 4.0.0, weak)
/usr/lib/swift/libswiftObjectiveC.dylib (compatibility version 1.0.0, current version 8.0.0, weak)
/usr/lib/swift/libswiftQuartzCore.dylib (compatibility version 1.0.0, current version 3.0.0, weak)
/usr/lib/swift/libswiftUniformTypeIdentifiers.dylib (compatibility version 1.0.0, current version 791.2.12, weak)
/usr/lib/swift/libswiftXPC.dylib (compatibility version 1.0.0, current version 36.100.8, weak)
/usr/lib/swift/libswiftos.dylib (compatibility version 1.0.0, current version 1049.100.4, weak)
@rpath/FlutterMacOS.framework/Versions/A/FlutterMacOS (compatibility version 0.0.0, current version 0.0.0)
/usr/lib/swift/libswiftFoundation.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftAppKit.dylib (compatibility version 1.0.0, current version 1.0.0)
/usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 120.100.0, weak)
</pre>

kus

* @rpath viitab rakenduse kapsli sisestele ressurssidele

====dtruss====

<pre>
Imres-MacBook-Air:/ root# dtruss -p 65630 2>&1 | tail -n 1

: probe description syscall:::entry does not match any probes. System Integrity Protection is on

imreoolberg@Imres-MacBook-Air Documents % dtruss ./hello
dtrace: system integrity protection is on, some features will not be available
dtrace: failed to initialize dtrace: DTrace requires additional privileges
</pre>

====Screenshot====

Tähistatud ala

<pre>
Command + Shift + 4
</pre>

Kogu ekraan

<pre>
Command + Shift + 3
</pre>

Screen cast

<pre>
Command + Shift + 5
</pre>

Vaikimisi asub pildistus iseloomuliku nimega failis desktopil.

===Süsteemi taastamine===

====Recovery meedia ettevalmistamine====

<pre>
Imres-MacBook-Air:/ root# diskutil eraseDisk JHFS+ "MyVolume" /dev/disk4
Started erase on disk4
Unmounting disk
Creating the partition map
Waiting for partitions to activate
Formatting disk4s2 as Mac OS Extended (Journaled) with name MyVolume
Initialized /dev/rdisk4s2 as a 28 GB case-insensitive HFS Plus volume with a 8192k journal
Mounting disk
Finished erase on disk4

Imres-MacBook-Air:/ root# /Applications/Install\ macOS\ Sequoia.app/Contents/Resources/createinstallmedia --volume /Volumes/MyVolume
Ready to start.
To continue we need to erase the volume at /Volumes/MyVolume.
If you wish to continue type (Y) then press return: y
Erasing disk: 0%... 10%... 20%... 30%... 100%
Copying essential files...
Copying the macOS RecoveryOS...
Making disk bootable...
Copying to disk: 0%... 10%... 20%... 30%... 40%... 50%... 60%... 70%... 80%... 90%... 100%
Install media now available at "/Volumes/Install macOS Sequoia"
Imres-MacBook-Air:/ root# echo $?
0

# diskutil unmount /Volumes/Install\ macOS\ Sequoia
</pre>

Protseduur

1. Create a New APFS Volume
The first step is to create a new, separate volume on your internal drive where you will restore the backup.

Boot from your USB installer by holding the Option key on startup.

In the macOS Utilities window, select Disk Utility and click Continue.

In Disk Utility, go to the menu bar and select View > Show All Devices.

In the sidebar, select the APFS container (the device, not the volume) that holds your current macOS installation.

Click the + button in the toolbar to add a new APFS volume.

Give the new volume a name (e.g., "macOS Restored") and click Add. This process is very fast as APFS volumes share the same free space.

Once the new volume appears in the sidebar, close Disk Utility.

2. Restore the Backup to the New Volume
Now that the new volume is ready, you can restore your Time Machine backup to it.

From the macOS Utilities window, select Restore From Time Machine Backup and click Continue.

Follow the on-screen instructions, selecting your Time Machine backup drive when prompted.

When the installer asks you to choose a destination disk, you will see your original macOS volume and the new "macOS Restored" volume you just created.

Select the new "macOS Restored" volume as the destination for the restoration. The installer will then proceed to restore the system to that specific volume only.

After the restoration is complete, you can restart your Mac and, by holding down the Option key, you will be able to choose between your original macOS system and the restored system on the second volume.

===homebrew===

<pre>
imre@imre-mac ~ % /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
==> Checking for `sudo` access (which may request your password)...
Password:
==> This script will install:
/opt/homebrew/bin/brew
/opt/homebrew/share/doc/homebrew
/opt/homebrew/share/man/man1/brew.1
/opt/homebrew/share/zsh/site-functions/_brew
/opt/homebrew/etc/bash_completion.d/brew
/opt/homebrew
/etc/paths.d/homebrew
==> The following new directories will be created:
/opt/homebrew/bin
/opt/homebrew/etc
/opt/homebrew/include
/opt/homebrew/lib
/opt/homebrew/sbin
/opt/homebrew/share
/opt/homebrew/var
/opt/homebrew/opt
/opt/homebrew/share/zsh
/opt/homebrew/share/zsh/site-functions
/opt/homebrew/var/homebrew
/opt/homebrew/var/homebrew/linked
/opt/homebrew/Cellar
/opt/homebrew/Caskroom
/opt/homebrew/Frameworks
==> The Xcode Command Line Tools will be installed.

Press RETURN/ENTER to continue or any other key to abort:
==> /usr/bin/sudo /usr/bin/install -d -o root -g wheel -m 0755 /opt/homebrew
==> /usr/bin/sudo /bin/mkdir -p /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod ug=rwx /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /bin/chmod go-w /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions
==> /usr/bin/sudo /usr/sbin/chown imre /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/bin/chgrp admin /opt/homebrew/bin /opt/homebrew/etc /opt/homebrew/include /opt/homebrew/lib /opt/homebrew/sbin /opt/homebrew/share /opt/homebrew/var /opt/homebrew/opt /opt/homebrew/share/zsh /opt/homebrew/share/zsh/site-functions /opt/homebrew/var/homebrew /opt/homebrew/var/homebrew/linked /opt/homebrew/Cellar /opt/homebrew/Caskroom /opt/homebrew/Frameworks
==> /usr/bin/sudo /usr/sbin/chown -R imre:admin /opt/homebrew
==> Searching online for the Command Line Tools
==> /usr/bin/sudo /usr/bin/touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Installing Command Line Tools for Xcode-16.4
==> /usr/bin/sudo /usr/sbin/softwareupdate -i Command\ Line\ Tools\ for\ Xcode-16.4
Software Update Tool

Finding available software

Downloading Command Line Tools for Xcode

Downloaded Command Line Tools for Xcode
Installing Command Line Tools for Xcode
Done with Command Line Tools for Xcode
Done.
==> /usr/bin/sudo /usr/bin/xcode-select --switch /Library/Developer/CommandLineTools
Password:
Sorry, try again.
Password:
==> /usr/bin/sudo /bin/rm -f /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress
==> Downloading and installing Homebrew...
remote: Enumerating objects: 310493, done.
remote: Counting objects: 100% (16399/16399), done.
remote: Compressing objects: 100% (608/608), done.
remote: Total 310493 (delta 15991), reused 15838 (delta 15791), pack-reused 294094 (from 3)
remote: Enumerating objects: 55, done.
remote: Counting objects: 100% (34/34), done.
remote: Total 55 (delta 33), reused 33 (delta 33), pack-reused 21 (from 1)
==> /usr/bin/sudo /bin/mkdir -p /etc/paths.d
==> /usr/bin/sudo tee /etc/paths.d/homebrew
/opt/homebrew/bin
==> /usr/bin/sudo /usr/sbin/chown root:wheel /etc/paths.d/homebrew
==> /usr/bin/sudo /bin/chmod a+r /etc/paths.d/homebrew
==> Updating Homebrew...
==> Downloading https://ghcr.io/v2/homebrew/portable-ruby/portable-ruby/blobs/sha256:20fa657858e44a4b39171d6e4111f8a9716eb62a78ebbd1491d94f90bb7b830a
################################################################################################################################################################ 100.0%
==> Pouring portable-ruby-3.4.5.arm64_big_sur.bottle.tar.gz
==> Installation successful!

==> Homebrew has enabled anonymous aggregate formulae and cask analytics.
Read the analytics documentation (and how to opt-out) here:
https://docs.brew.sh/Analytics
No analytics data has been sent yet (nor will any be during this install run).

==> Homebrew is run entirely by unpaid volunteers. Please consider donating:
https://github.com/Homebrew/brew#donations

==> Next steps:
- Run these commands in your terminal to add Homebrew to your PATH:
echo >> /Users/imre/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/imre/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"
- Run brew help to get started
- Further documentation:
https://docs.brew.sh

imre@imre-mac ~ %
</pre>

pyhton 3.13

<pre>
imre@imre-mac ti % brew install python@3.13
==> Fetching downloads for: python@3.13
==> Downloading https://ghcr.io/v2/homebrew/core/python/3.13/manifests/3.13.7
#################################################################################################################### 100.0%
==> Fetching dependencies for python@3.13: mpdecimal, ca-certificates, openssl@3, readline, sqlite and xz
==> Downloading https://ghcr.io/v2/homebrew/core/mpdecimal/manifests/4.0.1
#################################################################################################################### 100.0%
==> Fetching mpdecimal
...

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
==> Summary
🍺 /opt/homebrew/Cellar/python@3.13/3.13.7: 3,620 files, 66.6MB
==> Running `brew cleanup python@3.13`...
Disable this behaviour by setting `HOMEBREW_NO_INSTALL_CLEANUP=1`.
Hide these hints with `HOMEBREW_NO_ENV_HINTS=1` (see `man brew`).
==> No outdated dependents to upgrade!
==> Caveats
==> python@3.13
Python is installed as
/opt/homebrew/bin/python3

Unversioned symlinks `python`, `python-config`, `pip` etc. pointing to
`python3`, `python3-config`, `pip3` etc., respectively, are installed into
/opt/homebrew/opt/python@3.13/libexec/bin

`idle3.13` requires tkinter, which is available separately:
brew install python-tk@3.13

See: https://docs.brew.sh/Homebrew-and-Python
imre@imre-mac ti %

(py_venv) imre@imre-mac ti % brew tap hashicorp/tap
==> Tapping hashicorp/tap
Cloning into '/opt/homebrew/Library/Taps/hashicorp/homebrew-tap'...
remote: Enumerating objects: 5818, done.
remote: Counting objects: 100% (1132/1132), done.
remote: Compressing objects: 100% (221/221), done.
remote: Total 5818 (delta 1015), reused 913 (delta 911), pack-reused 4686 (from 3)
Receiving objects: 100% (5818/5818), 1.01 MiB | 1.18 MiB/s, done.
Resolving deltas: 100% (4104/4104), done.
Tapped 2 casks and 32 formulae (93 files, 1.3MB).
(py_venv) imre@imre-mac ti % brew install hashicorp/tap/vault
</pre>

===Xcode Command Line Tools===

Xcide CLI koosseisu kuuluvad muu hulgas

* git
* clang
* gcc

Paigaldamiseks sobib öelda

<pre>
# xcode-select --install
</pre>

to check

<pre>
imreoolberg@Imres-MacBook-Air ~ % xcode-select -p
/Library/Developer/CommandLineTools
</pre>

===Spaces===

Väited

* Spaces võimaldab tegeleda macos peal virtuaalsete desktop'idega
* käitumist kontrollib üldiselt 'System Settings -> Desktop & Dock -> Displays have separate Spaces' väärtus (vaikimisi 'On')
* F3 klahv abil saab Spaces riba kuvada monitoride üleosas
* Space'i saab liigutada monitoride vahel hiirega tirides, v.a. aktiivset space'i
* Space'ide vahel saab liikuda Control + left/righ arrow key abil
* Rakendust saab liigutada space'ide vahel minnes nn Mission Control vaatesse ja siis hiirega rakenduse akent lohistades
* Space sulgemisel paigutatakse vastavad aknad eelmisele space'ile

===Kellaaeg===

Süsteemi aeg

<pre>
Imres-MacBook-Air:~ root# date
Sat Sep 13 23:36:17 EEST 2025
</pre>

NTP serverilt kellaaja küsimine

<pre>
Imres-MacBook-Air:~ root# sntp time.apple.com
+0.049514 +/- 0.014280 time.apple.com 17.253.38.35
</pre>

Väärtuse küsimine

<pre>
Imres-MacBook-Air:~ root# systemsetup -getnetworktimeserver
Network Time Server: time.euro.apple.com
</pre>

Väärtuse muutmine

<pre>
Imres-MacBook-Air:~ root# systemsetup -setnetworktimeserver time.euro.apple.com
</pre>

Logist kellaajaga seotud sündmuste kohta küsimine

<pre>
Imres-MacBook-Air:~ root# log stream --predicate 'subsystem == "com.apple.timed"
</pre>

Kas kellaaeg automaatne hoidmine on kasutuses

<pre>
Imres-MacBook-Air:~ root# systemsetup -getusingnetworktime
Network Time: On
</pre>

===BSD pärand===

<pre>
imreoolberg@Imres-MacBook-Air ~ % which openssl
/usr/bin/openssl
imreoolberg@Imres-MacBook-Air ~ % openssl version
LibreSSL 3.3.6

Imres-MacBook-Air:~ root# ssh -V
OpenSSH_9.9p2, LibreSSL 3.3.6

Imres-MacBook-Air:~ root# pfctl -v
No ALTQ support in kernel
ALTQ related functions disabled

Imres-MacBook-Air:~ root# netstat -nr -f inet
</pre>

Süsteemsete kasutajate nimed algavad alakriipsuga (nt sarnaselt toimib OpenBSD), nt timed (ntp local protsess) töötab kasutajana _timed

<pre>
Imres-MacBook-Air:~ root# ps aux | grep timed
_timed 373 0.0 0.0 426967056 4576 ?? Ss Tue02PM 0:03.41 /usr/libexec/timed
</pre>

/etc/passwd failis on palju nö legacy kasutajad mille nimi viitab nö klassikalisele lahendusele

<pre>
Imres-MacBook-Air:~ root# egrep "_postgres|_dovenull|_postfix|_avamis|_clamav|_cyrus|_mailman|_cvs|_mysql|_jabber|_ftp" /etc/passwd
_postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false
_cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false
_mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false
_cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false
_mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false
_clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false
_jabber:*:84:84:Jabber XMPP Server:/var/empty:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_postgres:*:216:216:PostgreSQL Server:/var/empty:/usr/bin/false
_dovenull:*:227:227:Dovecot Authentication:/var/empty:/usr/bin/false
</pre>

===Süsteemi paigaldamine===

Eesmärk

* paigaldada töötav töökoha keskkond
* valmituda juhtumiks kui kasutaja parool kaob ja on vaja seda taastada (teha reset)

TODO

===Google Chrome brauser===

TODO

Google Chrome brauseril on lubatud kuvada ssh privaatset võtit, nt

file:///Users/imreoolberg/.ssh/id_ed25519

Analoogliselt on see lubatud Ubuntu 24.04 platvormil, aga nt OpenBSD puhul mitte (tänu unveil tehnoloogiale).

===GateKeeper===

Kui kopeerida internetist tarkvara nt .dmg kujul ja paigaldada, siis esimesel käivitamisel küsib süsteem, et kas ikka käivitada see internetist kopeeritud programm, küsimus ja vastusega tegelemine on seotud xattr parameetriga com.apple.quarantine

<pre>
Imres-MacBook-Air:~ root# xattr -p com.apple.quarantine /Applications/KeePassXC.app
0181;68c6f083;Chrome;AF698614-F806-4A2B-B66C-4B09CB133779
</pre>
ja
<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/KeePassXC.app
/Applications/KeePassXC.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Janek Bevendorff (G2S7P7J672)
</pre>

ja

<pre>
Imres-MacBook-Air:~ root# sqlite3 /Users/imreoolberg/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2
SQLite version 3.43.2 2023-10-10 13:08:14
Enter ".help" for usage hints.

sqlite> .schema
CREATE TABLE LSQuarantineEvent ( LSQuarantineEventIdentifier TEXT PRIMARY KEY NOT NULL, LSQuarantineTimeStamp REAL, LSQuarantineAgentBundleIdentifier TEXT, LSQuarantineAgentName TEXT, LSQuarantineDataURLString TEXT, LSQuarantineSenderName TEXT, LSQuarantineSenderAddress TEXT, LSQuarantineTypeNumber INTEGER, LSQuarantineOriginTitle TEXT, LSQuarantineOriginURLString TEXT, LSQuarantineOriginAlias BLOB );
CREATE INDEX LSQuarantineEventIndex ON LSQuarantineEvent ( LSQuarantineEventIdentifier );
CREATE INDEX LSQuarantineTimeStampIndex ON LSQuarantineEvent ( LSQuarantineTimeStamp );

sqlite> select * from LSQuarantineEvent;
9446C9BF-45BE-49C7-8EBE-2F15796AC8C8|778543831.0|com.google.Chrome|Chrome||||0|||
BDC2404B-51CD-4561-B50B-97C0C4272BF4|778543831.0|com.google.Chrome|Chrome||||0|||
295142B0-B654-4691-9F45-774441058E9A|778543831.0|com.google.Chrome|Chrome||||0|||
E806F7A8-856B-4A57-ADD6-0FFC2CAEECCB|778543833.0|com.google.Chrome|Chrome||||0|||
</pre>

Misc, .dmg faili kontroll

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -t open --context context:primary-signature -v Downloads/Claude.dmg
Downloads/Claude.dmg: accepted
source=Notarized Developer ID

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 Downloads/Claude.dmg
Executable=/Users/imreoolberg/Downloads/Claude.dmg
Identifier=Claude-1.21459.0-universal
Format=disk image
CodeDirectory v=20200 size=314 flags=0x0(none) hashes=1+6 location=embedded
Hash type=sha256 size=32
CandidateCDHash sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
CandidateCDHashFull sha256=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
Hash choices=sha256
CMSDigest=d648fbca8c1566d7e53bf37376aa5b5b73b6c266f8d8dce87481a0dff2b5cc66
CMSDigestType=2
Page size=none
CDHash=d648fbca8c1566d7e53bf37376aa5b5b73b6c266
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=14. Jul 2026 at 09:15:00
Notarization Ticket=stapled
Info.plist=not bound
TeamIdentifier=Q6L2SF6YDW
Sealed Resources=none
Internal requirements count=1 size=188
</pre>

ning paigaldatud rakendus

<pre>
imreoolberg@Imres-MacBook-Air ~ % spctl -a -vv /Applications/Claude.app
/Applications/Claude.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)

imreoolberg@Imres-MacBook-Air ~ % xcrun stapler validate /Applications/Claude.app
Processing: /Applications/Claude.app
The validate action worked!

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app
Executable=/Applications/Claude.app/Contents/MacOS/Claude
Identifier=com.anthropic.claudefordesktop
Format=app bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=458 flags=0x10000(runtime) hashes=3+7 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=64cd29a05443c8183ae1e1dcc645a4fd597f4760
CandidateCDHashFull sha256=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
Hash choices=sha256
CMSDigest=64cd29a05443c8183ae1e1dcc645a4fd597f476072e0c294455a97305dce70da
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=16384
Executable Segment flags=0x1
Page size=16384
CDHash=64cd29a05443c8183ae1e1dcc645a4fd597f4760
Signature size=9047
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:08:02
Notarization Ticket=stapled
Info.plist entries=42
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=1959
Internal requirements count=1 size=192
</pre>

kusjuures signatuurid võivad olla ka paketi moodustavatel komponentidel, nt

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /Applications/Claude.app -name _CodeSignature -ls
126867134 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:08 /Applications/Claude.app/Contents/_CodeSignature
126869217 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Claude Helper (GPU).app/Contents/_CodeSignature
126869228 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/A/_CodeSignature
126869697 0 drwxr-xr-x 3 imreoolberg staff 96 Aug 4 06:07 /Applications/Claude.app/Contents/Frameworks/ReactiveObjC.framework/Versions/A/_CodeSignature

imreoolberg@Imres-MacBook-Air ~ % codesign -dv --verbose=4 /Applications/Claude.app/Contents/Frameworks/Electron\ Framework.framework
Executable=/Applications/Claude.app/Contents/Frameworks/Electron Framework.framework/Versions/Current/Electron Framework
Identifier=com.github.Electron.framework
Format=bundle with Mach-O universal (x86_64 arm64)
CodeDirectory v=20500 size=368553 flags=0x10000(runtime) hashes=11510+3 location=embedded
VersionPlatform=1
VersionMin=786432
VersionSDK=1704448
Hash type=sha256 size=32
CandidateCDHash sha256=aef445b60ba087d333b3cdb77c3f60732ed473f7
CandidateCDHashFull sha256=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
Hash choices=sha256
CMSDigest=aef445b60ba087d333b3cdb77c3f60732ed473f766dc9fe1bd0a2fb5c7056bab
CMSDigestType=2
Executable Segment base=0
Executable Segment limit=178585600
Executable Segment flags=0x0
Page size=16384
CDHash=aef445b60ba087d333b3cdb77c3f60732ed473f7
Signature size=9046
Authority=Developer ID Application: Anthropic PBC (Q6L2SF6YDW)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=4. Aug 2026 at 09:07:56
Info.plist entries=13
TeamIdentifier=Q6L2SF6YDW
Runtime Version=26.2.0
Sealed Resources version=2 rules=13 files=234
Internal requirements count=1 size=192
</pre>

===Transparency, Consent, and Control (TCC)===

Esmakordsel käivitamisel küsitakse vahel kataloogide ja failide avamise õiguse kohta, sellega tegeleb TCC. Tulemus on paista nt

System Settings -> Privacy & Security -> KeePassXC -> xxx

<pre>
Imres-MacBook-Air:~ root# mdls -name kMDItemCFBundleIdentifier /Applications/KeePassXC.app
kMDItemCFBundleIdentifier = "org.keepassxc.keepassxc"
</pre>

ning eemaldamiseks

<pre>
Imres-MacBook-Air:~ root# tccutil reset All org.keepassxc.keepassxc
Successfully reset All approval status for org.keepassxc.keepassxc
</pre>

===Kasutajate haldamine===

Kasutaja tekitamiseks sobib

System Settings -> Users & Groups -> Add User -> ...

Teise kasutajana lisaks sisse logimiseks sobib kasutada

System Settings -> Control Center -> Fast User Switching -> ...

===Eesti id kaart===

TODO

Peale paigaldamist on

System Settings -> ID-updater

===Finder===

Finder programm on sarnane nö vana-aja Windows Explorer programmile või XFCE4 prorammile Thunar.

Vasaku sidebar ehk paneeli sisu muutmiseks sobib kasutada Finder -> Settings ja nt muuta nähtavaks kasutaja kodukataloog.

===XQuartz===

Väited

* X11 põhiste rakenduste töötamiseks vajalik tarkvara (nö linux traditsiooni juhtumiks)
* X2go töötamise eelduseks

===Locale===

MacOS on väga utf-8 keskne süsteem, graafiliste rakenduste ja käsurea osakonnas

<pre>
imreoolberg@Imres-MacBook-Air ~ % env | grep LANG
LANG=en_US.UTF-8

imreoolberg@Imres-MacBook-Air ~ % locale
LANG="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_CTYPE="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_ALL=
</pre>

Juhtimiseks sobib kasutada faili ~/.zshrc

===Mälu haldus===

Käesolevat mälukasutust saab jälgida Activity Monitor utiliidi abil

[[Fail:20250918-macos-memory-01.png|900px]]

kus

* physical memory - arvuti riistvaralise mälu hulk
* memory used - mälu hulk mida operatsioonisüteem moel või teisel aktiivsemalt/vähem-aktiivsemalt/jne kasutab
* swap used - plokkseadmele/failisüsteemi salvestatud/puhverdatud mälu sisu

Memory Used koosneb neljast osast

* app memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis on välja swapitav, kokku pakitav jms paindlik
* wired memory - operatsioonisüsteemi, rakenduste koodi ja andmete jms kasutusel olev mälu mis ei ole välja swapitav, kokku pakitav jms paindlik
* cached files - apfs jt failisüsteemide cache, st mällu puhverdatud sisu (tõenäoliselt teeb lugemise oluliselt kiiremaks)
* kokku pakitud mälule vastav maht mis kulub pakitud sisu hoidmiseks (mis on pakitud kujul)

'Compressed' väärtus väljendab, milline kokkupakkimata maht õnnestus kokku pakkida.

Väited

* arvutis on 'available memory' maht 16.00 - 12.84 = 3.16 G mälu - st see on ressurss, mida saab süsteem kohe kasutada täiendavate vajaduste jaoks
* kokku pakitud kujul olevate andmete maht on 12.84 - 5.90 - 2.17 - 3.30 = 1.47
* kokku pakkkimise efektiivsus on 3.96/1.47 = 2.69 st peaaegu 3x
* kuigi süsteemis on vaba mälu, siis on süsteem otsustanud siiski 175.6 MB välja swappida, ju ta teab mis teeb, ja nii on olnud otstarbekas
* cached files maht on selline ressurss, mille saab süsteem kiiresti võtta uude kasutusse, st nt rakenduse koodi jaoks

Hibernationi teemalised ressursid asuvad failisüsteemis kataloogis /private/var/vm

<pre>
imreoolberg@Imres-MacBook-Air ~ % find /private/var/vm -type f -ls
130187842 4194304 -rw------T 1 root wheel 2147483648 Aug 23 09:48 /private/var/vm/sleepimage
</pre>

Swap asub eraldi failisüsteemis

<pre>
imreoolberg@Imres-MacBook-Air ~ % diskutil list | grep VM
6: APFS Volume VM 7.5 GB disk3s6

imreoolberg@Imres-MacBook-Air ~ % find /System/Volumes/VM -ls
2 0 drwxr-xr-x 9 root wheel 288 Sep 4 20:40 /System/Volumes/VM
2208 2097152 -rw------- 1 root wheel 1073741824 Sep 4 15:14 /System/Volumes/VM/swapfile5
2159 2097152 -rw------- 1 root wheel 1073741824 Sep 1 18:24 /System/Volumes/VM/swapfile2
2192 2097152 -rw------- 1 root wheel 1073741824 Sep 3 16:48 /System/Volumes/VM/swapfile3
2138 2097152 -rw------- 1 root wheel 1073741824 Aug 30 00:02 /System/Volumes/VM/swapfile4
2118 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile1
2197 2097152 -rw------- 1 root wheel 1073741824 Sep 3 22:29 /System/Volumes/VM/swapfile8
2117 2097152 -rw------- 1 root wheel 1073741824 Aug 24 10:31 /System/Volumes/VM/swapfile0
imreoolberg@Imres-MacBook-Air ~ %
</pre>

kus

* kuna swap elab samas apfs poolis kus juur, data jt failisüsteemid, siis swap kasutuse suurenemisel jääb mujal ruumi vähemaks

===Yubico Authenticator===

====Tööpõhimõte====

Yubico tootja krüptoseadmed on hästi populaarsed ja korralikud, Eestis on ka nende kasutamine päris levinud

[[Fail:20260718-macos-yubico-01.png|700px]]

Füüsilise seadme haldamiseks on kasutada tarkvara 'Yubico Authenticator'

[[Fail:20260718-macos-yubico-02.png|600px]]

kus

* nime 'Authenticator' viitab justkui TOTP tüüpi rakendusele, tegelikult on see palju funktsionaalsem (FIDO2 saladuste haldamine, PIV saladuste haldamine jne)

====Paigaldamine====

Yubico Authenticator paigaldamine toimub nö tavalisel viisil Apple App Store abil, samuti edasine tarkvara uuendamine.

====Kasulikud lisamaterjalid====

* https://www.auul.pri.ee/wiki/Yubikey

===Yubikey===

TODO

Kui ssh kliendi kasutamisel tekib olukord

<pre>
... sign_and_send_pubkey: signing failed for ECDSA .. from agent: agent refused operation
</pre>

võib abistada

<pre>
% ssh-add -e /usr/local/lib/libykcs11.dylib
Card removed: /usr/local/lib/libykcs11.dylib

% ssh-add -s /usr/local/lib/libykcs11.dylib
Enter passphrase for PKCS#11:
Card added: /usr/local/lib/libykcs11.dylib

%
</pre>

===Apple riistvara-tarkvara ajalugu===

Küsimus chatgpt'le

'what operating system apple computers have used, please give timeline of cpu and operating system with mentioning whether is was single or two-mode privilege separation solution'

Vastus chatgpt'lt - eristatakse 6 ajastut

The Early Days (1976-1984)

* Computer: Apple I, Apple II series.
* CPU: MOS Technology 6502.
* Operating System: Apple DOS, ProDOS.
* Privilege Mode: Single-mode. The CPU and OS lacked a concept of privilege separation. All software, including the operating system, ran with full, unrestricted access to the hardware.

The Early Macintosh (1984-1987)

* Computer: Macintosh 128K, Macintosh Plus, Mac SE.
* CPU: Motorola 68000.
* Operating System: System Software (System 1.0 - 4.0).
* Privilege Mode: The CPU had a two-mode (Supervisor/User) architecture. However, the early Mac OS did not fully use it for memory protection. The OS was based on a cooperative multitasking model, and a buggy program could still crash the entire system.

The 32-bit Transition (1987-1994)

* Computer: Macintosh II series.
* CPU: Motorola 68020, 68030, 68040.
* Operating System: Mac OS (System 5.0 - 7.5).
* Privilege Mode: The CPUs were fully capable of two-mode operation. The OS began to use some of these features, but it was still not a truly protected-mode, preemptive multitasking system.

The PowerPC Era (1994-2006)

* Computer: Power Macintosh series.
* CPU: PowerPC 601, 603, G3, G4.
* Operating System: Mac OS 7.5 - Mac OS 9.
* Privilege Mode: The PowerPC was a modern two-mode RISC architecture with a robust privilege model. Despite the powerful hardware, the underlying Mac OS remained non-preemptive and lacked true memory protection between applications. This was a key reason why Apple chose to adopt a BSD-based foundation for its next-generation OS.

The Intel Era (2006-2020)

* Computer: MacBook, MacBook Pro, iMac, Mac Mini, Mac Pro (Intel models).
* CPU: Intel Core 2 Duo, Core i3/i5/i7/i9, Xeon (x86 architecture).
* Operating System: Mac OS X (versions 10.4 to 10.15), later renamed macOS (from 10.12 onward).
* Privilege Mode: Two-mode (Ring 0 for the kernel, Ring 3 for applications). This was a pivotal time for Apple, as their BSD-based Mac OS X was finally running on a CPU architecture with a robust, industry-standard privilege model. The operating system could now fully leverage preemptive multitasking and true memory protection, making the Mac far more stable and secure than in the previous eras.

The ARM Era (2020-Present)

* Computer: MacBook Air, MacBook Pro, iMac, Mac Mini (Apple Silicon models).
* CPU: Apple Silicon (M1, M2, M3, and so on), which are custom ARM-based processors.
* Operating System: macOS (starting with macOS 11 Big Sur).
* Privilege Mode: The ARM architecture uses a sophisticated multi-level privilege model. The OS runs in EL1 (Kernel Mode), while user applications run in EL0 (User Mode). The system also utilizes EL2 (Hypervisor Mode) for virtualization and security features. The transition to ARM allowed Apple to fully integrate hardware and software, creating a highly efficient platform where the CPU, GPU, and memory are on a single chip. The macOS operating system is built specifically to take advantage of this architecture and its robust privilege model.

===Apple Continuity===

Apple Continuity initsiatiiv võimaldab ühe appleid konto külge kinnitatud seadmete vahel teha koostööd, nt selliste seadmete ja tegevuste osas

* veebikaamera
* Universal Control - clipboard st kopi-paste üle seadmete (Synergy/Barrier/jms sarnane)
* rakenduste kasutamise jätkamine - nt brauser
* Contacts

Kasulikud lisamaterjalid

* https://www.apple.com/macos/continuity/

===Ansible===

export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES

===vnc klient===

vnc kliendi kasutamise eelduseks on kuskil võrgus töötav ja ligipääsetav vnc server. MacOS operatsioonisüsteemiga tuleb kaasa vnc klient, kasutamiseks sobib käivitada programm Finder

Finder -> Go -> Go to server

ning sisestada lahtrisse nt

vnc://192.168.10.187:5901

===Mail - IMAP ja SMTP klient===

TODO

===DFU - Device Firmware Update===

====Mõisted====

* Revive - tegevuse tulemusena asendatakse arvuti tava-firmware ja restore partitsioon - macos operatsioonisüsteem ja kasutaja andmed säilivad
* Restore - tegevuse tulemusena asendatakse arvuti tava-firmware, restore partition jne sh macos operatsioonisüsteem - st kõik
* IPSW - iphone software - praktiliselt kõik moodsad seadmed, nt https://ipsw.me/

====Tööpõhimõte====

Väited

* DFU puudutab 'macos all oleva tava-firmware all olevat eri-firmware kihti
* erinevalt nö x86 riistvara lahendustest saab mac riistvara puhul kasutada kahte seadet komplektis - seadmed ühendatakse tavalise thunderbolt vms kaabliga ning seejärel üks seade võimaldab teist ravida kasutades Apple Configurator tarkvara
* Apple Configurator ei võimalda tegeleda selle sama arvuti riistvaraga millel ta töötab, ta võimaldab tegeleda selle arvuti riistvaraga, mis on ühendatud thunderbolt kaabliga

====Apple Configurator tarkvara kasutamine====

* Apple Configurator paigaldatakse tavalisel viisil AppStore platvormi abil

====Kasulikud lisamaterjalid====

* youtube kanal lapfix sisaldab saateid - https://www.youtube.com/@lapfix

===Windows remote desktop klient===

AppStore abil on kasutada tasuta tarkvara 'Windows App'.

[[Fail:20251119-macos-windows-app-01.jpg|700px]]

===WireGuard===

WireGuard vpn klienti saab paigaldada tavalisel viisil App Store keskkonna abil. Peale paigaldamist ja esmast käivitamist valides spotlight otsingus wireguard, tuleks ilmselt kirjaldada vpn ühendus wireguard nö serveriga ning pressides + nuppu

[[Fail:20251215-macos-wireguard-04.png|700px]]

ning

[[Fail:20251215-macos-wireguard-01.png|700px]]

ehk teksti kujul

<pre>
[Interface]
PrivateKey = xxx
Address = 192.168.100.2/24

[Peer]
PublicKey = yyy
AllowedIPs = 192.168.100.1/32, 10.0.9.0/24, 10.0.6.0/24
Endpoint = 10.35.179.69:13231
PersistentKeepalive = 20
</pre>

Käivitatud st aktiivse vpn tunneli olek paistab selline

[[Fail:20251215-macos-wireguard-02.png|700px]]

ning üldises vpn ühenduste nimekirjas

[[Fail:20251215-macos-wireguard-03.png|700px]]

<pre>
Imres-MacBook-Air:~ root# ifconfig utun6
utun6: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1420
options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
inet 10.168.112.68 --> 10.168.112.68 netmask 0xffffff00
</pre>

ning ruuting

<pre>
Imres-MacBook-Air:~ root# netstat -nr -f inet | grep utun6
default link#22 UCSIg utun6
10.168.10.177/32 link#22 UCS utun6
10.168.112/24 10.168.112.68 UGSc utun6
10.168.112.68 10.168.112.68 UH utun6
192.168.112 link#22 UCS utun6
224.0.0/4 link#22 UmCSI utun6
255.255.255.255/32 link#22 UCSI utun6
</pre>

Tundub, et mingitel hetkedel wireguard klient nö ei allu eriti, siis võib olla abiks protsessi lõpetamine teminali aknas ning käivitamine 'open -a ..' abil

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i wireg
imreoolberg 757 0.0 0.4 435612624 63120 ?? S Wed12PM 0:01.19 /Applications/WireGuard.app/Contents/MacOS/WireGuard
imreoolberg 30026 0.0 0.0 435300208 1344 s014 S+ 5:10AM 0:00.01 grep -i wireg

imreoolberg@Imres-MacBook-Air ~ % killall WireGuard

imreoolberg@Imres-MacBook-Air ~ % open -a WireGuard
</pre>

vpn kasutamisel tuleb arvestada, et kui MacOS tulemüür ei ole sisselülitatud ja ei takista, siis saab vpn serveri poolelt pöörduda ka macos arvuti poole.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_OpenBSD_kasutamine#Wireguard
* https://www.auul.pri.ee/wiki/MikroTik_RouterOS#WireGuard

===Eesti ID kaardi kasutamine===

Eesti ID kaardi tarkvara paistab esindatud nn System Settings vasakus paneelis

[[Fail:20251216-macos-software-01.png|700px]]

Ning App Store peal

[[Fail:20251203-macos-app-store-updates-02.png|700px]]

ning

System Report -> Software -> Applications

juures

[[Fail:20251216-macos-software-02.png|700px]]

Lisaks Eesti ID kaardi tarkvara paistab nö .pkg osakonnas esindatud

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -v ^com.apple
..
eu.web-eid.web-eid-chrome
ee.ria.open-eid
ee.ria.qdigidoc4
eu.web-eid.web-eid
eu.web-eid.web-eid-safari
ee.ria.ID-updater
...
</pre>

kusjuures konkreetsed versioonid on sellest pkgutil vaatest

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.5.0.1954
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.7.0.660
volume: /
location: /
install-time: 1757342106

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.15.0
volume: /
location: /
install-time: 1757342106
</pre>

Kusjuures siit paistab vastuolu: pkgutil eistab nt paketi ee.ria.qdigidoc4 versiooniks 4.8.2 kuid muud 4.9.1. Kui küsida käsurealt teisiti versiooni

<pre>
Imres-MacBook-Air:~ root# defaults read /Applications/qdigidoc4.app/Contents/Info.plist CFBundleShortVersionString
4.9.1
</pre>

Ning programmi enda gui liides ütleb samuti versiooniks 4.9.1, lisaks tundub, et tegu on siiski sama tarkvara eksemplariga

<pre>
Imres-MacBook-Air:~ root# ps aux | grep qdigidoc4 | grep -v grep
imreoolberg 38841 0.0 0.4 436001936 63600 ?? S 4:19AM 0:01.45 /Applications/qdigidoc4.app/Contents/MacOS/qdigidoc4
</pre>

ning

[[Fail:20251216-macos-software-03.png|700px]]

====System Settings vasaku paneeli ID-updater kasutamine====

Peale System Settings vasaku paneeli ID-update kasutamist ja jaatavat vastamist vaikimisi valikutega

[[Fail:20251216-macos-eid-updater-01.png|700px]]

tessa

[[Fail:20251216-macos-eid-updater-02.png|700px]]

kossa

[[Fail:20251216-macos-eid-updater-03.png|700px]]

nessa

[[Fail:20251216-macos-eid-updater-04.png|700px]]

on tulemuseks

[[Fail:20251216-macos-eid-updater-05.png|700px]]

ning käsurealt küsides, st mõne komponendi versioon uuenes

* eu.web-eid.web-eid-chrome
* ee.ria.open-eid
* eu.web-eid.web-eid
* ee.ria.ID-updater

<pre>
Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-chrome
package-id: eu.web-eid.web-eid-chrome
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.open-eid
package-id: ee.ria.open-eid
version: 25.10.0.235
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.qdigidoc4
package-id: ee.ria.qdigidoc4
version: 4.8.2
volume: /
location: Applications
install-time: 1757339813

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid
package-id: eu.web-eid.web-eid
version: 2.8.0.710
volume: /
location: /
install-time: 1765858910

Imres-MacBook-Air:~ root# pkgutil --pkg-info eu.web-eid.web-eid-safari
package-id: eu.web-eid.web-eid-safari
version: 2.7.0
volume: /
location: Applications
install-time: 1757342162

Imres-MacBook-Air:~ root# pkgutil --pkg-info ee.ria.ID-updater
package-id: ee.ria.ID-updater
version: 3.18.0
volume: /
location: /
install-time: 1765858910
</pre>

20260630 kogemus

[[Fail:20260630-macos-eid-updater-01.png|900px]]

kus

* tundub, et macos lähenemisele natuke iseloomulikult erinevad kohad kirjutavad versiooni uuenduse kohta erinevat infot

===Mikrotik Winbox===

Paistab, et alates winbox v. 4 on toetatud MacOS

[[Fail:20260330-macos-mikrotik-install-01.png|800px]]

kus

* .dmg on Finder peal 'Open with' -> 'Diskmounter' abil avatud (monteeritud)
* paigaldamiseks tuleb nihutada .dmg sees paistev nö ressurss Applications alla kõrvale avatud Finder programmis (tavaliselt on .dmg avatud image nö ristkülikus kaks ikooni, rakendus ja Application ja tuleb nihutada selle akna sees
* Finder vasakus paneelis on Windbox disk image lahti monteeritud

kasutamine paistab välja nii

[[Fail:20260311-mikrotik-winbox-4-01.png|800px]]

Andmefailid asuvad

<pre>
imreoolberg@Imres-MacBook-Air ~ % find ~/Library/Application\ Support/MikroTik/WinBox -type f -ls
105559824 8 -rw-r--r-- 1 imreoolberg staff 1998 Jun 3 23:34 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.78.cfg.viw2
119606360 16 -rw-r--r-- 1 imreoolberg staff 5126 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/workspaces/__192.168.10.77.cfg.viw2
..

105555588 8 -rw-r--r-- 1 imreoolberg staff 502 Jun 3 23:29 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/Addresses.cdb
119606359 8 -rw-r--r-- 1 imreoolberg staff 383 Jun 29 09:39 /Users/imreoolberg/Library/Application Support/MikroTik/WinBox/settings.cfg.viw2
</pre>

====WindBox 4.1 -> 4.2 uuendamine====

Winbox uuendamine toimub üsna manuaalselt

[[Fail:20260709-mikrotik-01.png|900px]]

kus

* tootja jagab .dmg faili
* see fail tuleb eraldi liigutusena kopeerida tootja veebikohast
* avanenud värvilise pildi aknas ei ole teist ristkülikut nimega Application, tuleb lohistada Finderisse
* antud juhtum on hea näide kuidas MacOS Application kataloogi alamkataloogis asendab vana versiooni uuega

Kusjuures paigaldamise ajal midagi ei küsitud st privileegide saamiseks, tundub, et põhjusel kuna kataloog oli juba olemas ja kuulus kasutajale

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Applications/*
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 29 2025 /Applications/balenaEtcher.app
drwxr-xr-x@ 3 imreoolberg staff 96 Jul 3 07:43 /Applications/BetterTouchTool.app
drwxr-xr-x 13 root staff 416 Jul 5 16:07 /Applications/DDPM
..
drwxr-xr-x@ 3 root wheel 96 Dec 3 2025 /Applications/web-eid-safari.app
drwxr-xr-x@ 3 root wheel 96 Jun 30 19:52 /Applications/WhatsApp.app
drwxr-xr-x@ 3 imreoolberg admin 96 Jul 8 10:25 /Applications/WinBox.app
drwxr-xr-x@ 3 root wheel 96 Jul 4 19:44 /Applications/Windows App.app
drwxr-xr-x@ 3 root wheel 96 Dec 9 2025 /Applications/WireGuard.app
...
</pre>

kus

* sõltuvalt paigalduse viisist on kataloogil omanikuks kasutaja või root
* nt tundub, et app store ja pkgutil puhul on omanikuks root
* niisama kasutajana nö visuaalselt liigutades rakenduse Applications osakonda esmakordsel paigaldusel küsitakse täiendavalt privileegide kohta, ja seejärel enam mitte (st uuendamisel)

===MacOS virtualiseerimine===

TODO

===QR Journal===

TODO

===etcher===

TODO

===Rosetta 2===

* Rosetta 1
* Rosetta 2

====Tööpõhimõte====

TODO

====Paigaldamine====

Paigaldamiseks macos platvormile

<pre>
$ softwareupdate --install-rosetta
</pre>

====Kasutamine - UTM====

TODO

Virtuaalse arvuti juures peab olema rosetta 2 tugi sisse lülitatud

[[Fail:20260922-macos-rosetta-01.png|600px]]

Ubuntu operatsioonisüsteemi puhul paistab kasutamine välja selliselt

<pre>
root@rv-obsdb-01:~# lsscsi -s
[0:0:0:0] disk Apple Virtual Disk 1 /dev/sda 2.47GB

root@rv-obsdb-01:~# df -T -t virtiofs -h
Filesystem Type Size Used Avail Use% Mounted on
rosetta virtiofs 927G 229G 699G 25% /media/rosetta
</pre>

====Kasutamine - Rancher Desktop====

TODO

===Dell U2725QE monitor===

Kuigi kõik niisamagi töötab, monitori tootja veebikohas on üsna huvitavat tarkvara

[[Fail:20260705-dell-macos-01.png|900px]]

kus

* DDPM - Dell Display and Peripherial Manager
* Monitor Firmware Update Utility

====DDPM====

Mõisted

* DDPM - Dell Display and Peripherial Manager

Peale allkopeerimist paistab .pkg pakenduses tarkvara

[[Fail:20260705-dell-macos-02.png|1100px]]

kus

* TODO

Paigaldamine paistab

[[Fail:20260705-dell-macos-03.png|500px]]

ja kasutamine

[[Fail:20260705-dell-macos-04.png|700px]]

* paistab midagi sellist nagu monitori enda peal füüsiliselt

====Dell U2725QE Monitor Firmware Update Utility====

Väited

* monitori firmware uuendmaine toimub üle arvuti ja monitori vahelise thunderbolt kaabli

Paigaldamine paistab selline .pkg pakett

[[Fail:20260705-dell-macos-05.png|600px]]

Firmware uuendamine toimub üle thunderbolt kaabli

[[Fail:20260705-dell-macos-06.png|700px]]

kus

* oluline mitte lasta monitori screen saverisse, power save'i jms - nt 'caffeinate -di' abil
* firmware versioon muutab M2T101 -> M2T102

====Kahe monitori kasutamine====

Osutub võimalikuks ühe MacBook Air arvutiga ühendada kaks Dell monitori nö tunderbolt mõttes järjestikuliselt

[[Fail:20260718-macos-dell-01.png|800px]]

ning

[[Fail:20260718-macos-dell-02.png|800px]]

kus

* TODO

Tegu ei ole Dell monitor daisy-chain tehnoloogiaga, sest daisy-chain töötab display protocol kihis, antud juhul toimub kontakt thunderbolt kihis.

===character terminal seadme kasutamine===

character teminal seadme kasutamine paistab nii, väga analoogne ubuntu ja debian operatsioonisüsteemiga

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i iterm2
imreoolberg 1112 11.2 1.8 436586496 306448 ?? S 6:11PM 3:08.34 /Applications/iTerm.app/Contents/MacOS/iTerm2
</pre>

ning iterm protsessis on pseudo-terminal master multiplexer seadmed

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1112 -P -n | grep ptmx
iTerm2 1112 imreoolberg 5u CHR 15,0 0t23863949 609 /dev/ptmx
iTerm2 1112 imreoolberg 44u CHR 15,1 0t1199 609 /dev/ptmx
iTerm2 1112 imreoolberg 45u CHR 15,2 0t204098 609 /dev/ptmx
</pre>

zsh shelli avatud terminaliga seotud

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep zsh
imreoolberg 1398 0.0 0.0 435312416 2784 s003 S 6:17PM 0:00.01 -zsh
imreoolberg 1380 0.0 0.0 435313360 3472 s002 S 6:17PM 0:00.11 -zsh
imreoolberg 1376 0.0 0.0 435308624 2672 s001 S 6:17PM 0:00.01 -zsh
imreoolberg 1115 0.0 0.0 435313184 2896 s000 S+ 6:11PM 0:00.06 -zsh
imreoolberg 2434 0.0 0.0 435299552 1392 s002 S+ 7:16PM 0:00.00 grep zsh

imreoolberg@Imres-MacBook-Air ~ % lsof -p 1376 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
zsh 1376 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
zsh 1376 imreoolberg txt REG 1,15 1361216 1152921500312571448 /bin/zsh
zsh 1376 imreoolberg txt REG 1,15 81288 1152921500312585080 /usr/share/locale/en_US.UTF-8/LC_COLLATE
zsh 1376 imreoolberg txt REG 1,15 118896 1152921500312574306 /usr/lib/zsh/5.9/zsh/terminfo.so
zsh 1376 imreoolberg txt REG 1,15 593088 1152921500312574312 /usr/lib/zsh/5.9/zsh/zle.so
zsh 1376 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
zsh 1376 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 1u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
zsh 1376 imreoolberg 10u CHR 16,1 0t683 733 /dev/ttys001
</pre>

ssh kliendis on

<pre>
imreoolberg@Imres-MacBook-Air ~ % lsof -p 1437 -P -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ssh 1437 imreoolberg cwd DIR 1,15 7744 267481 /Users/imreoolberg
ssh 1437 imreoolberg txt REG 1,15 1555472 1152921500312572845 /usr/bin/ssh
ssh 1437 imreoolberg txt REG 1,15 72984 121429580 /Library/Preferences/Logging/.plist-cache.a1S8PMuK
ssh 1437 imreoolberg txt REG 1,15 2374000 1152921500312573276 /usr/lib/dyld
ssh 1437 imreoolberg 0u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 1u CHR 3,2 0t0 340 /dev/null
ssh 1437 imreoolberg 2u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 3u IPv4 0x79fda12a4e8825b1 0t0 TCP 192.168.134.76:49197->192.168.10.166:22 (ESTABLISHED)
ssh 1437 imreoolberg 4u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 5u CHR 16,1 0t513 733 /dev/ttys001
ssh 1437 imreoolberg 6u CHR 16,1 0t513 733 /dev/ttys001
</pre>

kus

* ilusti on paista järgnevus iterm2 -> zsh -> ssh

Selline pilt võiks

[[Fail:20260706-macos-char-01.png|800px]]

kus

* ptmx - pseudo-terminal master multiplexer
* ttys - teletypewriter slave
* console - füüsiline laptop graafilisse osakonda sisselogimise kohalolek
* Sun18 - kuna klassikaliselt on see tulp olnud max pikkusega 6 sümbolit, sellest selline notatsioon - kell 18, pühapäev

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/Operatsioonis%C3%BCsteemi_Debian_GNU/Linux_kasutamine#Seadmed_2

===Zabbix agent===

<pre>
imreoolberg@Imres-MacBook-Air ~ % sudo -i
Password:
Imres-MacBook-Air:~ root# file /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg: xar archive compressed TOC: 5108, SHA-1 checksum
</pre>

Misc

<pre>
imreoolberg@Imres-MacBook-Air ~ % installer -volinfo -pkg Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg
/Volumes/PRO-G40
/Volumes/volume-tm-backup-01
/
</pre>

Paigaldamine

<pre>
Imres-MacBook-Air:~ root# installer -pkg /Users/imreoolberg/Downloads/zabbix_agent-7.0.27-macos-arm64-openssl.pkg -target /
installer: Package name is Zabbix Agent
installer: Installing at base path /
installer: The install was successful.
</pre>

Tulemusena tekib süsteemi

<pre>
Imres-MacBook-Air:~ root# pkgutil --packages | grep -i zabbix
com.zabbix.pkg.ZabbixAgent

Imres-MacBook-Air:~ root# pkgutil --files com.zabbix.pkg.ZabbixAgent
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.zabbix.zabbix_agentd.plist
usr
usr/local
usr/local/bin
usr/local/bin/zabbix_get
usr/local/bin/zabbix_sender
usr/local/etc
usr/local/etc/zabbix
usr/local/etc/zabbix/zabbix_agentd
usr/local/etc/zabbix/zabbix_agentd/userparameter_examples.conf.NEW
usr/local/etc/zabbix/zabbix_agentd/userparameter_mysql.conf.NEW
usr/local/etc/zabbix/zabbix_agentd.conf.NEW
usr/local/sbin
usr/local/sbin/zabbix_agentd
</pre>

Seadistused

<pre>
Imres-MacBook-Air:~ root# egrep -v "^$|^#" /usr/local/etc/zabbix/zabbix_agentd.conf
LogFile=/var/log/zabbix/zabbix_agentd.log
Server=192.168.10.196
Hostname=macos-air.auul.pri.ee
</pre>

Tulemusena paistab vaikimisi Zabbix kaasa tuleva template abil selline pilt

[[Fail:20260706-macos-zabbix-01.png|1100px]]

kus

* võrreldes nt vaikimisi top utiliidi väljundiga, mis esitab muu hulgas andmeid cpu interruptide kohta, on zabbix esitus üsna tagasihoidlik

[[Fail:20260706-macos-zabbix-02.png|1400px]]

===scutil===

Osutub, et arvuti dhcp serveriga kohtumisele omandab lisaks ip aadressile jms võrguseadistusele ka uue hostname'i väärtuse, st mida vastab 'hostname' käsk kui kinnitatud uus dünaamiline ip address omab revers teisendust nimesüsteemis

<pre>
imreoolberg@orcl2-vip ~ % scutil --get LocalHostName
Imres-MacBook-Air
imreoolberg@orcl2-vip ~ % scutil --get ComputerName
Imre’s MacBook Air
imreoolberg@orcl2-vip ~ % scutil --get HostName
HostName: not set
</pre>

pinnimiseks sobib öelda

<pre>
orcl2-vip:~ root# scutil --set HostName "Imres-MacBook-Air"
</pre>

===Trash===

<pre>
imreoolberg@Imres-MacBook-Air ~ % du -sh .Trash
18G .Trash
</pre>

graafiliselt

[[Fail:20260729-macos-trash-01.png|600px]]

kus

* TODO

===Mattermost Desktop===

Saab kopeerida App Store juurest

TODO

===Python - uv===

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh
imreoolberg@Imres-MacBook-Air ~ % sh /tmp/uv-install.sh
downloading uv 0.12.5 aarch64-apple-darwin
installing to /Users/imreoolberg/.local/bin
uv
uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

source $HOME/.local/bin/env (sh, bash, zsh)
source $HOME/.local/bin/env.fish (fish)
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % cat .zshrc
### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
export PATH="/Users/imreoolberg/.rd/bin:$PATH"
### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
. "$HOME/.local/bin/env"
imreoolberg@Imres-MacBook-Air ~ %

imreoolberg@Imres-MacBook-Air ~ % uv -V
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)

imreoolberg@Imres-MacBook-Air ~ % uv self version
uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
imreoolberg@Imres-MacBook-Air ~ % cat ~/.config/uv/uv-receipt.json
{"binaries":["uv","uvx"],"binary_aliases":{},"cdylibs":[],"cstaticlibs":[],"install_layout":"flat","install_prefix":"/Users/imreoolberg/.local/bin","modify_path":true,"provider":{"source":"cargo-dist","version":"0.31.0"},"source":{"app_name":"uv","name":"uv","owner":"astral-sh","release_type":"github"},"version":"0.12.5"}
</pre>

Paigaldamise tulemusena tekib failisüsteemi kolm faili

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld /Users/imreoolberg/.local/bin/uv /Users/imreoolberg/.local/bin/uvx ~/.config/uv/uv-receipt.json
-rw-r--r--@ 1 imreoolberg staff 324 Aug 24 22:05 /Users/imreoolberg/.config/uv/uv-receipt.json
-rwxr-xr-x@ 1 imreoolberg staff 42201264 Aug 14 22:26 /Users/imreoolberg/.local/bin/uv
-rwxr-xr-x@ 1 imreoolberg staff 336352 Aug 14 22:26 /Users/imreoolberg/.local/bin/uvx
</pre>

CPython paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv python install 3.12
Installed Python 3.12.14 in 906ms
+ cpython-3.12.14-macos-aarch64-none (python3.12)
imreoolberg@Imres-MacBook-Air ~ % uv python list --only-installed
cpython-3.12.14-macos-aarch64-none .local/bin/python3.12 -> .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.12.14-macos-aarch64-none .local/share/uv/python/cpython-3.12-macos-aarch64-none/bin/python3.12
cpython-3.9.6-macos-aarch64-none /usr/bin/python3
</pre>

Ansible paigaldamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % which python3.12
/Users/imreoolberg/.local/bin/python3.12

imreoolberg@Imres-MacBook-Air ~ % python3.12 -V
Python 3.12.14

imreoolberg@Imres-MacBook-Air ~ % uv tool list
No tools installed

imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible --python 3.12
Resolved 10 packages in 860ms
Prepared 10 packages in 2.09s
Installed 10 packages in 213ms
+ ansible==14.3.1
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ %
</pre>

Paremini

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv tool uninstall ansible
Uninstalled 1 executable: ansible-community
imreoolberg@Imres-MacBook-Air ~ % uv tool install ansible-core --python 3.12
Resolved 9 packages in 22ms
Installed 9 packages in 17ms
+ ansible-core==2.21.3
+ cffi==2.1.1
+ cryptography==50.0.0
+ jinja2==3.1.6
+ markupsafe==3.0.3
+ packaging==26.3
+ pycparser==3.0
+ pyyaml==6.0.3
+ resolvelib==1.2.1
Installed 10 executables: ansible, ansible-config, ansible-console, ansible-doc, ansible-galaxy, ansible-inventory, ansible-playbook, ansible-pull, ansible-test, ansible-vault
imreoolberg@Imres-MacBook-Air ~ % ansible --version
ansible [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % ansible-playbook --version
ansible-playbook [core 2.21.3]
config file = None
configured module search path = ['/Users/imreoolberg/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/imreoolberg/.local/share/uv/tools/ansible-core/lib/python3.12/site-packages/ansible
ansible collection location = /Users/imreoolberg/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/imreoolberg/.local/bin/ansible-playbook
python version = 3.12.14 (main, Aug 14 2026, 15:24:41) [Clang 22.1.3 ] (/Users/imreoolberg/.local/share/uv/tools/ansible-core/bin/python)
jinja version = 3.1.6
pyyaml version = 6.0.3 (with libyaml v0.2.5)
imreoolberg@Imres-MacBook-Air ~ % uv tool list -v
DEBUG Searching for user configuration in: `/Users/imreoolberg/.config/uv/uv.toml`
DEBUG uv 0.12.5 (210d1f678 2026-08-14 aarch64-apple-darwin)
DEBUG Checking for Python environment at: `.local/share/uv/tools/ansible-core`
DEBUG Found existing environment for tool `ansible-core`: .local/share/uv/tools/ansible-core
ansible-core v2.21.3
- ansible
- ansible-config
- ansible-console
- ansible-doc
- ansible-galaxy
- ansible-inventory
- ansible-playbook
- ansible-pull
- ansible-test
- ansible-vault
imreoolberg@Imres-MacBook-Air ~ %
</pre>

pip compatibility interface

<pre>
imreoolberg@Imres-MacBook-Air ~ % uv pip list --python ~/.local/share/uv/tools/ansible-core/bin/python
Package Version
------------ -------
ansible-core 2.21.3
cffi 2.1.1
cryptography 50.0.0
jinja2 3.1.6
markupsafe 3.0.3
packaging 26.3
pycparser 3.0
pyyaml 6.0.3
resolvelib 1.2.1
</pre>

===Ansible===

TODO

===Seatbelt / App Sandbox===

Väited

* üks prosess saab töötada kas sandboxed või regular režiimis

Nt bettertouchtool on huvitav tarkvara selles mõttes, et mõni tema protsess töötab tavalises režiimis ja mõni sandboxed režiimis

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i betterto | grep -v grep
imreoolberg 3984 0.1 0.2 440140608 41392 ?? S 23Aug26 73:26.54 /Applications/BetterTouchTool.app/Contents/MacOS/BetterTouchTool
imreoolberg 3993 0.0 0.1 435529056 10960 ?? S 23Aug26 0:50.76 /Applications/BetterTouchTool.app/Contents/Resources/BTTRelaunch.app/Contents/MacOS/BTTRelaunch -bttPath /Applications/BetterTouchTool.app
imreoolberg 1409 0.0 0.0 435407504 7280 ?? Ss 23Aug26 0:00.05 /Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension -LaunchArguments eyJ0eXBlIjoxLCJzZXJ2aWNlTmFtZSI6ImNvbS5oZWdlbmJlcmcuQmV0dGVyVG91Y2hUb29sLkJldHRlclRvdWNoVG9vbC1XaWRnZXRzIiwiZW5oYW5jZWRTZWN1cml0eSI6ZmFsc2V9
imreoolberg 62187 0.0 0.0 435299632 7568 ?? Ss 10:46AM 0:00.02 /Applications/BetterTouchTool.app/Contents/XPCServices/BetterTouchToolAppleScriptRunner2.xpc/Contents/MacOS/BetterTouchToolAppleScriptRunner2

imreoolberg@Imres-MacBook-Air ~ % lsof +c0 -p 1409 -P -n | grep Containers
BetterTouchTool\x20WidgetsExtensio 1409 imreoolberg cwd DIR 1,14 384 563279 /Users/imreoolberg/Library/Containers/com.hegenberg.BetterTouchTool.BetterTouchTool-Widgets/Data
</pre>

kus

* sandboxed tunnuseks on protsess kasutab faili kataloogist ~/Library/Containers

Siin olev klapib ka entitlements lubadustega

<pre>
imreoolberg@Imres-MacBook-Air ~ % codesign -d --entitlements - "/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension"
Executable=/Applications/BetterTouchTool.app/Contents/PlugIns/BetterTouchTool WidgetsExtension.appex/Contents/MacOS/BetterTouchTool WidgetsExtension
[Dict]
[Key] com.apple.security.app-sandbox
[Value]
[Bool] true
imreoolberg@Imres-MacBook-Air ~ %
</pre>

===Force quit application===

Kui rakendus on hullunnud st ei ole võimalik teda ennast tema enda vahenditega sulgeda, siis sobib pressida klaviatuuril samaaegselt kolme klahvi

Cmd + Opt + Esc

ja paistab selline pilt

[[Fail:20260916-macos-force-quit-01.png|350px]]

===Gimp===

TODO

Gimp on nö klassikaline internetist alla kopeeritav rakendus

* jagatakse .dmg faili kujul
* paigaldamiseks monteeritakse süsteemi külge
* paigaldamiseks avatakse graafiline dialoog ja toimub hiirega Gimp -> Applications lohistamine
* hakkab asuma globaalses /Applications kataloogis
* uue versiooni ilmumisel rakendus annab teada, et on uus olemas
* uut alla ei laadita, tuleb ise kopeerida
* uuenduse paigaldamisel küsitakse, kas olemasolev asendada või lisada kõrvale

====Uuendamine====

TODO

===MacOS kasutamine serveri rollis===

Iseensest ei ole MacOS ...

===Kasulikud lisamaterjalid===

* [[:Claude Desktop - MacOS]]
* [[:Rancher Desktop - MacOS]]
* [[:Podman Desktop - MacOS]]
* https://github.com/luchina-gabriel/OSX-PROXMOX
* https://www.apple.com/mac/compare/

Mellanox ConnectX-6 Lx EN

2026-11-01T20:28:01Z

Imre: /* Kasulikud lisamaterjalid */

===Sissejuhatus===

===Mellanox riistvara===

Väited

* Mellanox nö kangemad võrguseadmed jaotatakse kaheks suuremaks osakonnaks: 1. SmartNIC, 2. SuperNIC
* SmartNIC - nvidia connectx seadmed
* SuperNIC - nvidia bluefield seadmed

ConnectX seadmed

* 'connectx-6 lx' ja 'connectx-6 dx' seadmed on kõik ethernet seadmed (st mitte infiniband)
* 'connectx-6' seade on füüsiliselt universaalne ethernet/infiniband seade, st võimalik on tarkvaraliselt kaardi poole pöördudes lülitada ta käima ethernet või infiniband režiimis

===Mellanox integratsioonid===

Kasutatakse

* Ubuntu v. 24.04 platvormil
* PVE v. 8.2.2
* QEMU v. 9.0.0
* OVS v. 3.1.0

Mellanox füüsilise kaardi kasutamise variatsioonid

* dual-port adapteri saab PVE webgui peal tervikuna nö pass-thru viisil anda edasi virtuaalsele arvutile (linnutada 'All Functions') - tulemusena antakse valides ühe pcie seadme mõlemad st .0 ja .1 seadmed virtuaalsele arvutile; neid kasutatakse siis virtuaalsest arvutist mlx5_core draiveriga jne; ovs ei puutu üldse asjasse
* dual-port adapterist saab PVE webgui peal ühe füüsilise pordi nö pass-thru viisil anda edasi virtuaalsele arvutile (linnutamata jätta 'All Functions') - tulemusena antakse valides ühe pcie seadme ainult see pcie seade, st .0 ja .1 seadme virtuaalsele arvutile; seda kasutatakse siis virtuaalsest arvutist mlx5_core draiveriga jne; ovs ei puutu üldse asjasse
* tavalisel viisil ovs abil: ovs-tava puutub asjasse
* vhost-user draiveriga; ovs-dpdk puutub asjasse
* representoriga; ovs-dpdk puutub asjasse
* vdpa abil; ovs-dpdk puutub asjasse

====dpdk abil liikluse kohale toomine ovs switchi juurde====

Väited

* eesmärgiks on füüsiliselt võrgust kohale tuua ovs switchi peale füüsilise võrgukaardi juures dpdk lahendust kasutades võimalikult palju liiklust
* ei tegelda liikluse edasi jõudmisega ovs switchi külge kinnitatud virtuaalse arvuti juurde
* tegevused toimuvad Ubuntu 24.04 keskkonnas (põhjusel, et alustuseks on nii ehk selgem st võrreldes kohe PVE peal toimetama hakkamisega)
* midagi ei kompileerita st kõik paigaldatakse Ubuntu tava apt repost

Tulemuseks ovs switch paistab selline

<pre>
root@dpdp-u2404:~# ovs-vsctl show
09d915bd-744b-4ff1-a223-983c02f05f3b
Bridge br0
datapath_type: netdev
Port dpdk-p0
Interface dpdk-p0
type: dpdk
options: {dpdk-devargs="0000:0f:00.0"}
Port br0
Interface br0
type: internal
Port vlan11
tag: 11
Interface vlan11
type: internal
ovs_version: "3.3.0"
</pre>

Ning võrk toimib selliselt

<pre>
root@dpdp-u2404:~# ping -c 4 192.168.1.254
PING 192.168.1.254 (192.168.1.254) 56(84) bytes of data.
64 bytes from 192.168.1.254: icmp_seq=1 ttl=255 time=0.765 ms
64 bytes from 192.168.1.254: icmp_seq=2 ttl=255 time=0.344 ms
64 bytes from 192.168.1.254: icmp_seq=3 ttl=255 time=0.285 ms
64 bytes from 192.168.1.254: icmp_seq=4 ttl=255 time=0.312 ms

--- 192.168.1.254 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3100ms
rtt min/avg/max/mdev = 0.285/0.426/0.765/0.196 ms
</pre>

Samal ajal ei ole nö tavalisel võrguliidesel midagi kuulda, põhjusel, et kernel ei tegele nende pakettidega tavalises mõttes

<pre>
root@dpdp-u2404:~# tcpdump -ni enp15s0f0np0
libibverbs: Warning: couldn't open config directory '/etc/libibverbs.d'.
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp15s0f0np0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
</pre>

Sellise olukorra saavutamiseks Ubuntu v. 24.04 operatsioonisüsteemil paigaldatakse tarkvara OVS-DPDK, sobib taustaks vaadata juhendeid

* 'How to use DPDK with Open vSwitch' - https://ubuntu.com/server/docs/how-to-use-dpdk-with-open-vswitch
* 'OVS Offload Using ASAP² Direct' - https://docs.nvidia.com/networking/display/mlnxofedv590590/ovs+offload+using+asap%C2%B2+direct#src-2408744435_safe-id-T1ZTT2ZmbG9hZFVzaW5nQVNBUMKyRGlyZWN0LU9WUy1LZXJuZWxIYXJkd2FyZU9mZmxvYWRz
* 'Using Open vSwitch with DPDK' - https://docs.openvswitch.org/en/latest/howto/dpdk/

root@dpdp-u2404:~# apt-get install openvswitch-switch-dpdk

Muu hulgas paigaldatakse sõltuvustena paketid

* dpdk
* openvswitch-switch

Ja kävitatakse ovs protsessid

<pre>
root@dpdp-u2404:~# systemctl | grep ovs | grep runni
ovs-vswitchd.service loaded active running Open vSwitch Forwarding Unit
ovsdb-server.service loaded active running Open vSwitch Database Unit
</pre>

kusjuures ovs tööd juhib fail 'root@dpdp-u2404:~# less /var/lib/openvswitch/conf.db' st kui midagi läheb ovs osakonna seadistamisel valesti sobib uuesti algamiseks lõpetada protsessid, kustutada failid ja käivitada protsessid

root@dpdp-u2404:~# systemctl stop ovs-vswitchd
root@dpdp-u2404:~# systemctl stop ovsdb-server
root@dpdp-u2404:~# rm /var/lib/openvswitch/.conf.db.~lock~
root@dpdp-u2404:~# rm /var/lib/openvswitch/conf.db
root@dpdp-u2404:~# systemctl stop ovs-vswitchd

Peale tarkvara paigaldamist on ovs käivitatud olekus ning sobib seda edasi seadistada

root@dpdp-u2404:~# echo 1024 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
root@dpdp-u2404:~# update-alternatives --get-selections
root@dpdp-u2404:~# update-alternatives --set ovs-vswitchd /usr/lib/openvswitch-switch-dpdk/ovs-vswitchd-dpdk
root@dpdp-u2404:~# update-alternatives --get-selections
root@dpdp-u2404:~# ovs-vsctl set Open_vSwitch . "other_config:dpdk-init=true"
root@dpdp-u2404:~# ovs-vsctl set Open_vSwitch . "other_config:dpdk-lcore-mask=0x1"
root@dpdp-u2404:~# ovs-vsctl set Open_vSwitch . "other_config:dpdk-alloc-mem=2048"
root@dpdp-u2404:~# ovs-vsctl set Open_vSwitch . "other_config:dpdk-extra=--allow=0000:0f:00.0"
root@dpdp-u2404:~# systemctl restart openvswitch-switch

other_config elemendi eemaldamiseks sobib öelda nt

ovs-vsctl remove Open_vSwitch . other_config dpdk-socket-mem

OVS rakenduses sisemiste sadistuste tegemiseks

root@dpdp-u2404:~# ovs-vsctl add-br br0 -- set bridge br0 datapath_type=netdev
root@dpdp-u2404:~# ovs-vsctl add-port br0 dpdk-p0 -- set Interface dpdk-p0 type=dpdk options:dpdk-devargs=0000:0f:00.0
root@dpdp-u2404:~# ovs-vsctl add-port br0 vlan11 tag=11 -- set interface vlan11 type=internal
root@dpdp-u2404:~# ifconfig vlan11 192.168.1.57/24

Märkused

* lahendusele on iseloomulik, et üks CPU on 100% koormatud ('us' user load top väljundis)

Jõudluse hindamine

<pre>
root@dpdp-u2404:~# timeout 30 hping3 -S -c 400000000 --flood -p 53 192.168.1.254

root@dpdp-u2404:~# vnstat -l vlan11
vlan11 / traffic statistics

rx | tx
--------------------------------------+------------------
bytes 8.06 KiB | 456.04 MiB
--------------------------------------+------------------
max 3.32 kbit/s | 133.65 Mbit/s
average 1.83 kbit/s | 106.27 Mbit/s
min 944 bit/s | 0 bit/s
--------------------------------------+------------------
packets 138 | 8855498
--------------------------------------+------------------
max 7 p/s | 309383 p/s
average 3 p/s | 245986 p/s
min 2 p/s | 0 p/s
--------------------------------------+------------------
time 36 seconds
</pre>

Tuunimiseks sobib kasutada nt selliseid hoobasid

root@dpdp-u2404:~# ovs-vsctl set Interface dpdk-p0 "options:n_rxq=4"
root@dpdp-u2404:~# ovs-vsctl set Open_vSwitch . other_config:pmd-cpu-mask=0x00f0

Tulemusena

<pre>
root@dpdp-u2404:~# ovs-vsctl show
09d915bd-744b-4ff1-a223-983c02f05f3b
Bridge br0
datapath_type: netdev
Port dpdk-p0
Interface dpdk-p0
type: dpdk
options: {dpdk-devargs="0000:0f:00.0", n_rxq="2"}
...
</pre>

ning 'top -> 1' peal on paista, et 0x00f0 määrab, et 4-7 cpu komplektist tuleb kasutada kõik protsessorid. Tulemusena on siseneva st kohale jõudva ja vastuvõetava liikluse maht mitu korda suurem, nt

<pre>
root@dpdp-u2404:~# vnstat -l -i vlan11
Monitoring vlan11... (press CTRL-C to stop)

rx: 382.62 Mbit/s 854067 p/s tx: 198.13 Mbit/s 427007 p/s^C
...
</pre>

Kasulikud lisamaterjalid

* https://enterprise-support.nvidia.com/s/article/mellanox-dpdk
* https://doc.dpdk.org/guides/nics/mlx5.html
* http://www.virtualopensystems.com/en/solutions/guides/snabbswitch-qemu/

====dpdk abil liikluse kohale toomine ovs switchi kaudu qemu virtuaalse arvuti juurde - vhost user protokoll====

Väited

* vhost-user-client
* tegevused toimuvad PVE v. 8.2.2 keskkonnas
* tulemusena saab PVE webgui jms naturaalsel viisil virtuaalse arvutit opereerida (mh kävitada-seisata) kuid nt tema võrguosakond töötab koostöös dpdk lahendusega
* midagi ei kompileerita st kõik paigaldatakse Debian v. 12 ja PVE tava apt repodest
* lahtiseks jääb, et kuidas peaks valmistama ette PVE guesti võrgu osakonna, et ta toimiks dpdk abil kohale jõudnud paketttidega efektiivselt (praegu on see tavaline debian v. 12 arvuti virtio võrgundusega jne)

Lahendus jätkab ja täiendab eelmise punkti lahendust. PVE host ettevalmistamine

* dpdk tarkvara paigaldamine - vt eelmine Ubuntu v. 24.04 punkt
* ovs dpdk omaduste seadistamine

<pre>
root@pve-moraal-x570:~/20240706# echo 2048 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
root@pve-moraal-x570:~/20240706# grep -i hugepages /proc/meminfo
AnonHugePages: 0 kB
ShmemHugePages: 0 kB
FileHugePages: 0 kB
HugePages_Total: 2048
HugePages_Free: 2048
HugePages_Rsvd: 0
HugePages_Surp: 0
Hugepagesize: 2048 kB

root@pve-moraal-x570:~/20240706# findmnt | grep huge
│ ├─/dev/hugepages hugetlbfs hugetlbfs rw,relatime,pagesize=2M
│ ├─/run/hugepages/kvm/2048kB hugetlbfs hugetlbfs rw,relatime,pagesize=2M
│ └─/run/hugepages/kvm/1048576kB hugetlbfs hugetlbfs rw,relatime,pagesize=1024M

root@pve-moraal-x570:~/20240706# ovs-vsctl set Open_vSwitch . "other_config:dpdk-init=true"
root@pve-moraal-x570:~/20240706# ovs-vsctl set Open_vSwitch . "other_config:dpdk-lcore-mask=0x1"
root@pve-moraal-x570:~/20240706# ovs-vsctl set Open_vSwitch . "other_config:dpdk-alloc-mem=2048"
root@pve-moraal-x570:~/20240706# ovs-vsctl set Open_vSwitch . "other_config:dpdk-extra=--allow=0000:0f:00.0"
root@pve-moraal-x570:~/20240706# systemctl restart openvswitch-switch

root@pve-moraal-x570:~/20240706# ovs-vsctl add-br vmbr0 -- set bridge vmbr0 datapath_type=netdev
root@pve-moraal-x570:~/20240706# ovs-vsctl add-port vmbr0 dpdk-p0 -- set Interface dpdk-p0 type=dpdk options:dpdk-devargs=0000:0f:00.0

root@pve-moraal-x570:~/20240706# ovs-vsctl add-port vmbr0 vlan14 tag=14 -- set interface vlan14 type=internal
root@pve-moraal-x570:~/20240706# ifconfig vlan14 192.168.112.169/24

root@pve-moraal-x570:~/20240706# mkdir /var/run/vhostuserclient
root@pve-moraal-x570:~/20240706# ovs-vsctl add-port vmbr0 vhost-user-1 -- set Interface vhost-user-1 type=dpdkvhostuserclient "options:vhost-server-path=/var/run/vhostuserclient/vhost-user-client-1"
root@pve-moraal-x570:~/20240706# ovs-vsctl set port vhost-user-1 tag=10
(see vist ei ole asjakohane root@pve-moraal-x570:~/20240706# ovs-vsctl set Open_vSwitch . other_config:hw-offload=true )

root@pve-moraal-x570:~/20240706# ovs-vsctl set Interface dpdk-p0 "options:n_rxq=4"
root@pve-moraal-x570:~/20240706# ovs-vsctl set Open_vSwitch . other_config:pmd-cpu-mask=0x00f0
</pre>

PVE guest seadistusfail

<pre>
root@pve-moraal-x570:~/20240706# cat /etc/pve/qemu-server/123.conf
agent: 1
bios: ovmf
boot: order=virtio0;ide2;net0
cores: 4
cpu: host
efidisk0: sn_srv_btrfs:123/vm-123-disk-5.raw,efitype=4m,pre-enrolled-keys=1,size=528K
ide2: none,media=cdrom
machine: q35
memory: 1024
name: deb11-tm-tartu-btrfs
# net0: virtio=12:4A:8D:1E:33:3D,bridge=vmbr0,firewall=1,tag=10
numa: 1
onboot: 0
ostype: l26
rng0: source=/dev/urandom
scsihw: virtio-scsi-pci
serial0: socket
smbios1: uuid=0d52990c-3194-4c80-942f-d14621a6e940
sockets: 1
virtio0: sn_srv_btrfs:123/vm-123-disk-0.raw,size=16G
virtio1: sn_srv_btrfs:123/vm-123-disk-1.raw,size=32G
virtio2: sn_srv_btrfs:123/vm-123-disk-2.raw,size=24G
vmgenid: fb558ebc-7d59-4c13-8eae-505349adf9a1
hugepages: 1024
args: -machine q35+pve0,kernel_irqchip=split \
-device intel-iommu,intremap=on,caching-mode=on \
-chardev socket,id=char1,path=/var/run/vhostuserclient/vhost-user-client-1,server=on \
-netdev type=vhost-user,id=mynet1,chardev=char1,vhostforce=on,queues=4 \
-device virtio-net-pci,mac=12:4A:8D:1E:33:3D,netdev=mynet1,mq=on,vectors=10,rx_queue_size=1024,tx_queue_size=256
</pre>

kus

* PVE webgui peal ei ole võrguliidest seadistatud, selle asemel on võrguliides moodustatud 'arg' abil käsitsi
* 'args' abil on lisatud muid vajalikke elemente qemu guestile (võib olla 2024 seisuga ei ole see kõik vajalik, nt tundub, et 'kernel_irqchip=split' on niikuinii default
* 'args' jätel olev komplekt chardev/netdev/device põhineb eeldusel, et eelpool kirjeldatud ovs ettevalmistused vhostuserclient osas on tehtud

Tulemus

* TODO

Kasulikud lisamaterjalid

* https://stackoverflow.com/questions/69710907/connect-qemu-kvm-vms-using-vhost-user-client-and-ovs-dpdk
* https://docs.redhat.com/en/documentation/red_hat_openstack_platform/10/html/network_functions_virtualization_planning_guide/ch-vhost-user-ports
* https://forum.proxmox.com/threads/tutorial-run-open-vswitch-ovs-dpdk-on-pve-7-0.97116/
* https://docs.openvswitch.org/en/latest/topics/dpdk/vhost-user/
* https://docs.nvidia.com/networking/display/mlnxenv24040700/ovs+offload+using+asap%C2%B2+direct#src-2958624697_safe-id-T1ZTT2ZmbG9hZFVzaW5nQVNBUMKyRGlyZWN0LWh3dmRwYQ
* https://www.youtube.com/watch?v=y0ASTg3VCCc
* https://www.intel.com/content/www/us/en/developer/articles/technical/data-plane-development-kit-vhost-user-client-mode-with-open-vswitch.html
* https://www.redhat.com/en/blog/journey-vhost-users-realm
* https://www.redhat.com/en/virtio-networking-series

====dpdk abil liikluse kohale toomine ovs switchi kaudu qemu virtuaalse arvuti juurde - vf representor====

Väited

* eesmärgiks on füüsiliselt võrgust kohale tuua ovs switchi peale füüsilise võrgukaardi juures dpdk lahendust kasutades võimalikult palju liiklust
* virtuaalsele arvutile antakse kasutamiseks Mellanox füüsilise kaardi üks nn virtuaal-funktsioon - st virtuaalses arvuti töötab ens16 nimeline võrguseade mlx draiveriga
* tundub, et 2024 aasta lõpus on representor mõtlemine Mellanox riistvara spetsiifiline

Esmalt veendutakse, et Mellanox füüsiline võrgukaart on olemas; ja eswitch legacy režiimis

<pre>
root@pve-moraal-x570:~# lspci | grep Mellanox
0f:00.0 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
0f:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]

root@pve-moraal-x570:~/20240706# devlink dev eswitch show pci/0000:0f:00.1
pci/0000:0f:00.1: mode legacy inline-mode none encap-mode basic

root@pve-moraal-x570:~/20240706# devlink dev eswitch show pci/0000:0f:00.0
pci/0000:0f:00.0: mode legacy inline-mode none encap-mode basic
</pre>

Lülitatakse kaks VF sisse

<pre>
root@pve-moraal-x570:~# echo 2 > /sys/class/net/enp15s0f0np0/device/sriov_numvfs

root@pve-moraal-x570:~# lspci | grep Mellanox
0f:00.0 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
0f:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
0f:00.2 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
0f:00.3 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
</pre>

Omistatakse mac aadressid VF jaoks

<pre>
root@pve-moraal-x570:~# ip link set enp15s0f0np0 vf 0 mac e4:11:22:33:46:50
root@pve-moraal-x570:~# ip link set enp15s0f0np0 vf 1 mac e4:11:22:33:46:51

root@pve-moraal-x570:~# ip link show dev enp15s0f0np0
3: enp15s0f0np0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether e8:eb:d3:0b:78:74 brd ff:ff:ff:ff:ff:ff
vf 0 link/ether e4:11:22:33:46:50 brd ff:ff:ff:ff:ff:ff, spoof checking off, link-state auto, trust off, query_rss off
vf 1 link/ether e4:11:22:33:46:51 brd ff:ff:ff:ff:ff:ff, spoof checking off, link-state auto, trust off, query_rss off
</pre>

Seotakse lahti mlx5_core draiver VF seadmest

<pre>
root@pve-moraal-x570:~# lspci -vvv | grep mlx5_ | grep use
Kernel driver in use: mlx5_core
Kernel driver in use: mlx5_core
Kernel driver in use: mlx5_core
Kernel driver in use: mlx5_core

root@pve-moraal-x570:~# echo 0000:0f:00.2 > /sys/bus/pci/drivers/mlx5_core/unbind
root@pve-moraal-x570:~# echo 0000:0f:00.3 > /sys/bus/pci/drivers/mlx5_core/unbind

root@pve-moraal-x570:~# lspci -vvv | grep mlx5_ | grep use
Kernel driver in use: mlx5_core
Kernel driver in use: mlx5_core
</pre>

Lülitatakse legacy asemel switchdev mode

root@pve-moraal-x570:~# devlink dev eswitch set pci/0000:0f:00.0 mode switchdev

Seostatakse VF seadmetega mlx5_core draiver

<pre>
root@pve-moraal-x570:~# echo 0000:0f:00.2 > /sys/bus/pci/drivers/mlx5_core/bind
root@pve-moraal-x570:~# echo 0000:0f:00.3 > /sys/bus/pci/drivers/mlx5_core/bind

root@pve-moraal-x570:~# lspci -vvv | grep mlx5_ | grep use
Kernel driver in use: mlx5_core
Kernel driver in use: mlx5_core
Kernel driver in use: mlx5_core
Kernel driver in use: mlx5_core
</pre>

Tehakse restart ovs protsessidele

<pre>
root@pve-moraal-x570:~# ovs-vsctl show
9ffe33a7-4486-4701-b4c0-880c61f407b7
ovs_version: "3.1.0"

root@pve-moraal-x570:~# systemctl restart openvswitch-switch

root@pve-moraal-x570:~# ovs-vsctl show
9ffe33a7-4486-4701-b4c0-880c61f407b7
ovs_version: "3.1.0"
</pre>

Võetakse kasutusele hugepage ressurss

<pre>
# echo 2048 > /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages
</pre>

Rakendatakse ovs üldised seadistused

<pre>
root@pve-moraal-x570:~# ovs-vsctl set Open_vSwitch . "other_config:dpdk-init=true"
root@pve-moraal-x570:~# ovs-vsctl set Open_vSwitch . other_config:hw-offload=true
root@pve-moraal-x570:~# ovs-vsctl set Open_vSwitch . other_config:dpdk-extra="-a 0000:0f:00.0,representor=0,dv_flow_en=1,dv_esw_en=1,dv_xmeta_en=1"
root@pve-moraal-x570:~# systemctl restart openvswitch-switch
</pre>

Tekitatakse ovs sisu

<pre>
root@pve-moraal-x570:~# ovs-vsctl add-br vmbr0 -- set bridge vmbr0 datapath_type=netdev
root@pve-moraal-x570:~# ovs-vsctl add-port vmbr0 dpdk-p0 -- set Interface dpdk-p0 type=dpdk options:dpdk-devargs=0000:0f:00.0
root@pve-moraal-x570:~# ovs-vsctl add-port vmbr0 representor -- set Interface representor type=dpdk options:dpdk-devargs=0000:0f:00.0,representor=0
root@pve-moraal-x570:~# ovs-vsctl set port representor tag=10
</pre>

Tulemusena

<pre>
root@pve-moraal-x570:~# ovs-vsctl list open_vSwitch
_uuid : 9ffe33a7-4486-4701-b4c0-880c61f407b7
bridges : [1d7619bb-7b33-4959-9266-325808d72c13]
cur_cfg : 7
datapath_types : [netdev, system]
datapaths : {}
db_version : "8.3.1"
dpdk_initialized : true
dpdk_version : "DPDK 22.11.5"
external_ids : {hostname=pve-moraal-x570.sise.moraal.ee, rundir="/var/run/openvswitch", system-id="9e871242-44eb-499f-a049-32f089e65f68"}
iface_types : [afxdp, afxdp-nonpmd, bareudp, dpdk, dpdkvhostuser, dpdkvhostuserclient, erspan, geneve, gre, gtpu, internal, ip6erspan, ip6gre, lisp, patch, stt, system, tap, vxlan]
manager_options : []
next_cfg : 7
other_config : {dpdk-extra="-a 0000:0f:00.0,representor=0,dv_flow_en=1,dv_esw_en=1,dv_xmeta_en=1", dpdk-init="true", hw-offload="true"}
ovs_version : "3.1.0"
ssl : []
statistics : {}
system_type : debian
system_version : "12"
</pre>

ja

<pre>
root@pve-moraal-x570:~# ovs-vsctl show
9ffe33a7-4486-4701-b4c0-880c61f407b7
Bridge vmbr0
datapath_type: netdev
Port dpdk-p0
Interface dpdk-p0
type: dpdk
options: {dpdk-devargs="0000:0f:00.0"}
Port vmbr0
Interface vmbr0
type: internal
Port representor
tag: 10
Interface representor
type: dpdk
options: {dpdk-devargs="0000:0f:00.0,representor=0"}
ovs_version: "3.1.0"
</pre>

PVE virtuaalse arvuti seadistus, representor-lahendus töötab selliselt, et vf seade tuleb nö ededal ja tavalisel kujul anda virtuaalsele arvutile kasutada

<pre>
root@pve-moraal-x570:~# cat /etc/pve/qemu-server/123.conf
agent: 1
bios: ovmf
boot: order=virtio0;ide2;net0
cores: 4
cpu: host
efidisk0: sn_srv_btrfs:123/vm-123-disk-5.raw,efitype=4m,pre-enrolled-keys=1,size=528K
hostpci0: 0000:0f:00.2
hugepages: 1024
ide2: none,media=cdrom
machine: q35,viommu=intel
memory: 1024
name: deb11-tm-tartu-btrfs
numa: 1
onboot: 0
ostype: l26
rng0: source=/dev/urandom
scsihw: virtio-scsi-pci
serial0: socket
smbios1: uuid=0d52990c-3194-4c80-942f-d14621a6e940
sockets: 1
vga: virtio
virtio0: sn_srv_btrfs:123/vm-123-disk-0.raw,size=16G
virtio1: sn_srv_btrfs:123/vm-123-disk-1.raw,size=32G
virtio2: sn_srv_btrfs:123/vm-123-disk-2.raw,size=24G
vmgenid: fb558ebc-7d59-4c13-8eae-505349adf9a1
</pre>

Tulemusena

* võrk töötab
* jõudlus on mõõdukas
* virtuaalses arvutis kasutatakse võrguseadmel mlx5_core tavalist draiverit

<pre>
root@tm-tartu-x570:~# lspci | grep Mella
06:10.0 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
</pre>

PVE host peal on paista iseloomulik nö 100% ühe cpu kasutus

[[Fail:20240708-mlnx-pmd-01.png]]

Kasulikud lisamaterjalid

* https://docs.openvswitch.org/en/latest/topics/dpdk/phy/#
* https://github.com/Mellanox/scalablefunctions/wiki/Upstream-step-by-step-guide
* https://www.youtube.com/watch?v=37MN8C_MNuQ

====dpdk abil liikluse kohale toomine ovs switchi kaudu qemu virtuaalse arvuti juurde - vdpa====

TODO

Kasulikud lisamaterjalid

* https://metonymical.hatenablog.com/entry/2021/04/14/002638

====kernel tls====

<pre>
TODO
</pre>

====inbox draiver ja utiliidid====

# apt-get install mstflint

Kaardi SRIOV muutmiseks sobib öelda

<pre>
root@pve-moraal-x570:~# mstconfig -d 0000:0f:00.0 set SRIOV_EN=False

Device #1:
----------

Device type: ConnectX6LX
Name: MCX631102AN-ADA_Ax
Description: ConnectX-6 Lx EN adapter card; 25GbE ; Dual-port SFP28; PCIe 4.0 x8; No Crypto
Device: 0000:0f:00.0

Configurations: Next Boot New
SRIOV_EN True(1) False(0)

Apply new Configuration? (y/n) [n] : y
Applying... Done!
-I- Please reboot machine to load new configurations.
</pre>

Tulemusena ei ole enam VF võimekust

<pre>
root@pve-moraal-x570:~# ls -ld /sys/class/net/enp15s0f0np0/device/s*
lrwxrwxrwx 1 root root 0 Jun 30 03:32 /sys/class/net/enp15s0f0np0/device/subsystem -> ../../../../bus/pci
-r--r--r-- 1 root root 4096 Jun 30 03:35 /sys/class/net/enp15s0f0np0/device/subsystem_device
-r--r--r-- 1 root root 4096 Jun 30 03:35 /sys/class/net/enp15s0f0np0/device/subsystem_vendor
</pre>

Peale tagasi sisse lülitamist on VF võimekus tagasi

<pre>
root@pve-moraal-x570:~# mstconfig -d 0000:0f:00.0 set SRIOV_EN=True

root@pve-moraal-x570:~# ls -ld /sys/class/net/enp15s0f0np0/device/s*
-rw-r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/sriov_drivers_autoprobe
-rw-r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/sriov_numvfs
-r--r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/sriov_offset
-r--r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/sriov_stride
-r--r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/sriov_totalvfs
-r--r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/sriov_vf_device
-r--r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/sriov_vf_total_msix
lrwxrwxrwx 1 root root 0 Jun 30 03:39 /sys/class/net/enp15s0f0np0/device/subsystem -> ../../../../bus/pci
-r--r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/subsystem_device
-r--r--r-- 1 root root 4096 Jun 30 03:43 /sys/class/net/enp15s0f0np0/device/subsystem_vendor

root@pve-moraal-x570:~# cat /sys/class/net/enp15s0f0np0/device/sriov_totalvfs
8
</pre>

Nende muudatuste tegemiseks peab olema secure boot välja lülitatud.

mstlink utiliit

<pre>
root@pve-moraal-x570:~# mstlink -d 0000:0f:00.0 --show_device

Operational Info
----------------
State : Polling
Physical state : ETH_AN_FSM_ENABLE
Speed : N/A
Width : N/A
FEC : N/A
Loopback Mode : No Loopback
Auto Negotiation : FORCE - 25G,10G,1G

Supported Info
--------------
Enabled Link Speed (Ext.) : 0x00000052 (25G,10G,1G)
Supported Cable Speed (Ext.) : 0x00000003 (1G,100M)

Troubleshooting Info
--------------------
Status Opcode : 36
Group Opcode : PHY FW
Recommendation : Force Mode no partner detected.

Tool Information
----------------
Firmware Version : 26.41.1000
amBER Version : 2.05
MSTFLINT Version : mstflint 4.21.0

Device Info
-----------
Part Number : N/A
Part Name : N/A
Serial Number : N/A
Revision : N/A
FW Version : 26.41.1000

Note: P/N, Product Name, S/N and Revision are supported only in switches
</pre>

Virtual Functions kasutamiseks, lähtepunt on nö tavaolek

<pre>
root@pve-moraal-x570:~# lspci | grep Mellanox
0f:00.0 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
0f:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
</pre>

4 funktsiooni kasutamiseks sobib öelda

<pre>
root@pve-moraal-x570:~# lspci | grep Mellanox
0f:00.0 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
0f:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
0f:00.2 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
0f:00.3 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
0f:00.4 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
0f:00.5 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
</pre>

Kusjuures moodustatakse sellised seadmed

<pre>
root@pve-moraal-x570:~# ip link show dev enp15s0f0np0
50: enp15s0f0np0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether e8:eb:d3:0b:78:74 brd ff:ff:ff:ff:ff:ff
vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking off, link-state auto, trust off, query_rss off
vf 1 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking off, link-state auto, trust off, query_rss off
vf 2 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking off, link-state auto, trust off, query_rss off
vf 3 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking off, link-state auto, trust off, query_rss off
root@pve-moraal-x570:~# ip link show dev enp15s0f0v0
56: enp15s0f0v0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether 3a:48:d1:d6:57:dd brd ff:ff:ff:ff:ff:ff
</pre>

VF seadet saab host peal kasutama asuda praktiliselt nagu tavalist võrguseadet. Teine variant on ta saata edasi pcie passthru abil PVE virtuaalsele arvutile. Virtuaalses arvutis paistab kaart selline

<pre>
root@pve-sdn-01:~# lspci | grep Mell
01:00.0 Ethernet controller: Mellanox Technologies ConnectX Family mlx5Gen Virtual Function
root@pve-sdn-01:~# ethtool -i enp1s0
driver: mlx5_core
version: 6.8.8-1-pve
firmware-version: 26.41.1000 (MT_0000000531)
expansion-rom-version:
bus-info: 0000:01:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: yes
</pre>

kus

* virtuaalses arvutis sobib kasutada sama mlx5 draiverit mida kasutatakse pve host peal

===dpdk kasutamine===

Paigaldatakse dpdk ja dpdk-dev paketid

# apt-get install dpdk dpdk-dev

Tulemusena on süsteemis muu hulgas utiliidid

* dpdk-devbind.py
* dpdk-hugepages.py
* dpdk-testpmd

Olukorra hindamine, vt https://doc.dpdk.org/guides/nics/mlx5.html -> 'Usage example'

<pre>
root@pve-moraal-x570:~# ls -d /sys/class/net/*/device/infiniband_verbs/uverbs* | cut -d / -f 5
enp15s0f0np0
enp15s0f1np1
</pre>

testpmd käivitamine, täpslt ei ole saada aru, kas see on edukas käivitamine

<pre>
root@pve-moraal-x570:~# dpdk-testpmd -l 8-15 -n 4 -a 0f:00.0 -a 0f:00.1 -- --rxq=2 --txq=2 -i
EAL: Detected CPU lcores: 24
EAL: Detected NUMA nodes: 1
EAL: Detected shared linkage of DPDK
EAL: Multi-process socket /var/run/dpdk/rte/mp_socket
EAL: Selected IOVA mode 'VA'
EAL: Probe PCI driver: mlx5_pci (15b3:101f) device: 0000:0f:00.0 (socket -1)
EAL: Probe PCI driver: mlx5_pci (15b3:101f) device: 0000:0f:00.1 (socket -1)
Interactive-mode selected
Warning: NUMA should be configured manually by using --port-numa-config and --ring-numa-config parameters along with --numa.
testpmd: create a new mbuf pool <mb_pool_0>: n=203456, size=2176, socket=0
testpmd: preferred mempool ops selected: ring_mp_mc
Configuring Port 0 (socket 0)
Port 0: E8:EB:D3:0B:78:74
Configuring Port 1 (socket 0)
Port 1: E8:EB:D3:0B:78:75
Checking link statuses...
Done
testpmd>
</pre>

Näiteks

<pre>
root@pve-moraal-x570:~# dpdk-testpmd -l 6-9 -n 4 -a 0f:00.0 -- --rxq=4 --txq=4 -i
testpmd> set fwd txonly

testpmd> show port stats all

######################## NIC statistics for port 0 ########################
RX-packets: 0 RX-missed: 0 RX-bytes: 0
RX-errors: 0
RX-nombuf: 0
TX-packets: 5153664 TX-errors: 0 TX-bytes: 329834496

Throughput (since last show)
Rx-pps: 0 Rx-bps: 0
Tx-pps: 1420582 Tx-bps: 727338208
############################################################################
</pre>

ja teisel pordil võrku pealt kuulates paistab

<pre>
root@pve-moraal-x570:~# tcpdump -c 4 -nei enp15s0f1np1
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp15s0f1np1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:07:53.700764 e8:eb:d3:0b:78:74 > 02:00:00:00:00:00, ethertype IPv4 (0x0800), length 64: 198.18.0.1.9 > 198.18.0.2.9: UDP, length 22
09:07:53.700764 e8:eb:d3:0b:78:74 > 02:00:00:00:00:00, ethertype IPv4 (0x0800), length 64: 198.18.0.1.9 > 198.18.0.2.9: UDP, length 22
09:07:53.700764 e8:eb:d3:0b:78:74 > 02:00:00:00:00:00, ethertype IPv4 (0x0800), length 64: 198.18.0.1.9 > 198.18.0.2.9: UDP, length 22
09:07:53.700765 e8:eb:d3:0b:78:74 > 02:00:00:00:00:00, ethertype IPv4 (0x0800), length 64: 198.18.0.1.9 > 198.18.0.2.9: UDP, length 22
</pre>

Kasulikud lisamaterjalid

* https://www.youtube.com/watch?v=KX1QOqMtchg
* https://www.youtube.com/watch?v=0yDdMWQPCOI
* https://www.youtube.com/watch?v=Un5-AN4nb9s

===Misc===

<pre>
# lspci | grep 3d:00
3d:00.0 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
3d:00.1 Ethernet controller: Mellanox Technologies MT2894 Family [ConnectX-6 Lx]
</pre>

devlink show andmed

<pre>
# devlink dev show
pci/0000:3d:00.0
pci/0000:3d:00.1
</pre>

ja devlink info

<pre>
# devlink dev info
pci/0000:3d:00.0:
driver mlx5_core
versions:
fixed:
fw.psid SM_1281000001000
running:
fw.version 26.35.2000
fw 26.35.2000
stored:
fw.version 26.35.2000
fw 26.35.2000
pci/0000:3d:00.1:
driver mlx5_core
versions:
fixed:
fw.psid SM_1281000001000
running:
fw.version 26.35.2000
fw 26.35.2000
stored:
fw.version 26.35.2000
fw 26.35.2000
</pre>

ethtool andmed

<pre>
# ethtool -i ens7f0np0
driver: mlx5_core
version: 5.15.0-92-generic
firmware-version: 26.35.2000 (SM_1281000001000)
expansion-rom-version:
bus-info: 0000:3d:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: no
supports-register-dump: no
supports-priv-flags: yes
</pre>

kus

* ethtool ja devlink-dev-info väljundis klapib kaardil oleva firmware versioon - 26.35.2000

===Tootja MLNX EN tarkvara kasutamine===

====Mõisted====

* MFT - NVIDIA Firmware Tools, tõenäoliselt algupäraselt Mellanox Firmware Tools

====Kasutamine füüsilise seadme tervikuna passthru režiimis====

Väited

* üldiselt proxmox v. 8 keskkonnas saab mellanox seadme anda üle virtuaalsele arvuti tavalisel viisil (valides pve webgui liidses 'Add -> PCI device' ja näidates esimese MLNX seadme; teine lisatakse automaatselt
* tundub, et füüsilist mellanox seadet ei saa tervikuna nö täiuslikult virtuaalsele arvutile edasi anda, ühe asjana puudub jääb sr-iov võimekus
* virtuaalses arvutis saab võrguseadet kasutada tema PF osas, VF ei ole ligipääsetav
* virtuaalsele arvutile saab lisada tavalise pve webgui peal vIOMMU ning siis paigutatakse virtuaalse arvuti seadmed sh erinevad MLNX adapteri füüsilised pordid erinevatesse IOMMU gruppidesse

Sellisele asjakorraldusele on üldiselt iseloomulik, et host arvutis tegeleb edasi vfio draiver seadmega

<pre>
root@pve-moraal-x570:~# lspci -vvv | grep vfio
Kernel driver in use: vfio-pci
Kernel driver in use: vfio-pci
</pre>

Ilma rebootida host peale seadme koos mlx driveri kasutamisega tagasi saamiseks sobib

* lõpetada virtuaalse arvuti töötamine
* öelda host peal

<pre>
echo 1 > /sys/bus/pci/devices/0000\:0f\:00.0/remove
echo 1 > /sys/bus/pci/devices/0000\:0f\:00.1/remove
echo 1 > /sys/bus/pci/rescan
</pre>

====Tarkvara paigaldamine====

TODO

root@debian-mlnx-01:~# mount /root/mlnx-en-24.04-0.6.6.0-debian12.1-x86_64.iso /mnt/mlnx

<pre>
root@debian-mlnx-01:~# find /lib/modules/6.1.0-22-amd64/ -type f -mmin -20 -ls | grep dkms
661960 4312 -rw-r--r-- 1 root root 4415205 Jun 29 22:07 /lib/modules/6.1.0-22-amd64/updates/dkms/mlx5_core.ko
661959 28 -rw-r--r-- 1 root root 25237 Jun 29 22:07 /lib/modules/6.1.0-22-amd64/updates/dkms/mlx_compat.ko
661961 8 -rw-r--r-- 1 root root 5565 Jun 29 22:07 /lib/modules/6.1.0-22-amd64/updates/dkms/mlx5_ib.ko
661962 52 -rw-r--r-- 1 root root 49445 Jun 29 22:07 /lib/modules/6.1.0-22-amd64/updates/dkms/mlxfw.ko
661963 208 -rw-r--r-- 1 root root 210797 Jun 29 22:07 /lib/modules/6.1.0-22-amd64/updates/dkms/mlxdevm.ko
</pre>

====Firmware uuendamine====

<pre>
root@debian-mlnx-01:~# apt-get install mlnx-fw-updater
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following package was automatically installed and is no longer required:
linux-image-6.1.0-15-amd64
Use 'apt autoremove' to remove it.
The following NEW packages will be installed:
mlnx-fw-updater
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/50.2 MB of archives.
After this operation, 87.9 MB of additional disk space will be used.
Get:1 file:/mnt/mlnx/DEBS_ETH ./ mlnx-fw-updater 24.04-0.6.6.0 [50.2 MB]
Selecting previously unselected package mlnx-fw-updater.
(Reading database ... 63847 files and directories currently installed.)
Preparing to unpack .../mlnx-fw-updater_24.04-0.6.6.0_amd64.deb ...
Unpacking mlnx-fw-updater (24.04-0.6.6.0) ...
Setting up mlnx-fw-updater (24.04-0.6.6.0) ...
Initializing...
Attempting to perform Firmware update...
Querying Mellanox devices firmware ...

Device #1:
----------

Device Type: ConnectX6LX
Part Number: MCX631102AN-ADA_Ax
Description: ConnectX-6 Lx EN adapter card; 25GbE ; Dual-port SFP28; PCIe 4.0 x8; No Crypto
PSID: MT_0000000531
PCI Device Name: 01:00.0
Base GUID: e8ebd303000b7874
Base MAC: e8ebd30b7874
Versions: Current Available
FW 26.32.2004 26.41.1000
PXE 3.6.0502 3.7.0400
UEFI 14.25.0018 14.34.0012

Status: Update required

---------
Found 1 device(s) requiring firmware update...

Device #1: Updating FW ...
FSMST_INITIALIZE - OK
Writing Boot image component - OK
Done

Restart needed for updates to take effect.
Log File: /tmp/oaFVUkaJsl
Real log file: /tmp/mlnx_fw_update.log

root@debian-mlnx-01:~# less /tmp/mlnx_fw_update.log
CMD: mlxup -u --log-on-update --ssl-certificate /tmp/OloIGrYWuz/mlxfwmanager_sriov_dis_x86_64_4127-dir/ca-bundle.crt --current-dir /opt/mellanox/mlnx-fw-updater/ -L /tmp/oaFVUkaJsl -y -d 01:00.0
Querying Mellanox devices firmware ...

Device #1:
----------

...
</pre>

Paistab, et tulemusena on kaardil olemas kaks versiooni firmwarest

<pre>
root@debian-mlnx-01:~# devlink dev info
pci/0000:01:00.0:
driver mlx5_core
versions:
fixed:
fw.psid MT_0000000531
running:
fw.version 26.32.2004
fw 26.32.2004
stored:
fw.version 26.41.1000
fw 26.41.1000
pci/0000:01:00.1:
driver mlx5_core
versions:
fixed:
fw.psid MT_0000000531
running:
fw.version 26.32.2004
fw 26.32.2004
stored:
fw.version 26.41.1000
fw 26.41.1000
</pre>

kus

* running version - 26.32.2004
* stored version - 26.41.1000

====systemd unit mlnx-en.d====

Tundub, et mlx driveritega tegeleb systemd unit

<pre>
root@debian-mlnx-01:~# dpkg -S /etc/mlnx-en.conf
mlnx-en-utils: /etc/mlnx-en.conf

root@debian-mlnx-01:~# cat /etc/mlnx-en.conf
# Allow calling the service script with the option 'stop' for unloading the driver stack.
# This flag should be disabled when the OS root file system is on remote storage.
ALLOW_STOP=yes

# Run sysctl performance tuning script
RUN_SYSCTL=no

# Run /usr/sbin/mlnx_tune
RUN_MLNX_TUNE=no

# Load MLX4 modules
MLX4_LOAD=no

# Load MLX5 modules
MLX5_LOAD=yes

root@debian-mlnx-01:~# systemctl start mlnx-en.d
root@debian-mlnx-01:~# systemctl status mlnx-en.d
● mlnx-en.d.service - mlnx-en.d - configure Mellanox devices
Loaded: loaded (/lib/systemd/system/mlnx-en.d.service; enabled; preset: enabled)
Active: active (exited) since Sun 2024-06-30 00:49:29 EEST; 6s ago
Docs: file:/etc/mlnx-en.conf
Process: 1505 ExecStart=/etc/init.d/mlnx-en.d start (code=exited, status=0/SUCCESS)
Main PID: 1505 (code=exited, status=0/SUCCESS)
CPU: 385ms

Jun 30 00:49:26 debian-mlnx-01 systemd[1]: Starting mlnx-en.d.service - mlnx-en.d - configure Mellanox devices...
Jun 30 00:49:28 debian-mlnx-01 mlnx-en.d[1505]: [32B blob data]
Jun 30 00:49:29 debian-mlnx-01 systemd[1]: Finished mlnx-en.d.service - mlnx-en.d - configure Mellanox devices.
</pre>

samal ajal dmesg väljundis

<pre>
# dmesg -T -w

[Sun Jun 30 00:49:26 2024] Compat-mlnx-ofed backport release: 7037b8d
[Sun Jun 30 00:49:26 2024] Backport based on https://:@git-nbu.nvidia.com/r/a/mlnx_ofed/mlnx-ofa_kernel-4.0.git 7037b8d
[Sun Jun 30 00:49:26 2024] compat.git: https://:@git-nbu.nvidia.com/r/a/mlnx_ofed/mlnx-ofa_kernel-4.0.git
[Sun Jun 30 00:49:26 2024] mlx5_core 0000:01:00.0: firmware version: 26.32.2004
[Sun Jun 30 00:49:26 2024] mlx5_core 0000:01:00.0: 126.024 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x8 link)
[Sun Jun 30 00:49:26 2024] mlx5_core 0000:01:00.0: Rate limit: 127 rates are supported, range: 0Mbps to 24414Mbps
[Sun Jun 30 00:49:26 2024] mlx5_core 0000:01:00.0: E-Switch: Total vports 2, per vport: max uc(128) max mc(2048)
[Sun Jun 30 00:49:26 2024] mlx5_core 0000:01:00.0: Port module event: module 0, Cable plugged
[Sun Jun 30 00:49:26 2024] mlx5_core 0000:01:00.0: mlx5_pcie_event:304:(pid 1398): PCIe slot advertised sufficient power (75W).
[Sun Jun 30 00:49:26 2024] mlx5_core 0000:01:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 basic)
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.0 enp1s0f0np0: renamed from eth0
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1: firmware version: 26.32.2004
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1: 126.024 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x8 link)
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1: Rate limit: 127 rates are supported, range: 0Mbps to 24414Mbps
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1: E-Switch: Total vports 2, per vport: max uc(128) max mc(2048)
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1: Port module event: module 1, Cable plugged
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1: mlx5_pcie_event:304:(pid 1391): PCIe slot advertised sufficient power (75W).
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 basic)
[Sun Jun 30 00:49:27 2024] mlx5_core 0000:01:00.1 enp1s0f1np1: renamed from eth0
</pre>

Kusjuures 'systemctl stop mlnx-en.d' eemaldab mlx moodulid mälust

<pre>
root@debian-mlnx-01:~# lsmod | grep mlx
mlx5_core 2269184 0
mlxfw 36864 1 mlx5_core
mlxdevm 180224 1 mlx5_core
mlx_compat 20480 2 mlxdevm,mlx5_core
psample 20480 1 mlx5_core
tls 135168 1 mlx5_core
pci_hyperv_intf 16384 1 mlx5_core

root@debian-mlnx-01:~# systemctl stop mlnx-en.d
root@debian-mlnx-01:~# lsmod | grep mlx
root@debian-mlnx-01:~#
</pre>

====devlink kasutamine====

<pre>
root@debian-mlnx-01:~# devlink dev param show pci/0000:01:00.0 name enable_roce
pci/0000:01:00.0:
name enable_roce type generic
values:
cmode driverinit value true
</pre>

====Monitoring====

Tundub, et inimese jaoks on see kaarti küljes olev füüsiline radiaator päris kuum (sõrme küljes ei jaoks hoida), ja tundub, et sisuliselt on see ok, 'The adapter card incorporates the ConnectX IC, which operates in the range of temperatures between 0°C and 105°C.', https://docs.nvidia.com/networking/display/connectx6lxen/monitoring

<pre>
root@debian-mlnx-01:~# devlink dev
pci/0000:01:00.0
pci/0000:01:00.1
root@debian-mlnx-01:~# mget_temp -d 0000:01:00.0
82
root@debian-mlnx-01:~# mget_temp -d 0000:01:00.1
83
</pre>

Kasulikud lisamaterjalid

* https://docs.nvidia.com/networking/display/connectx6lxen/monitoring

===Misc===

* https://www.youtube.com/watch?v=XLPgDEbUMgk - 'How to set Mellanox ConnectX VPI to Ethernet or Infiniband in Linux'

===E810 kasutamine===

Kasulikud lisamaterjalid

* https://bugzilla.redhat.com/show_bug.cgi?id=2082528
* https://bugzilla.redhat.com/show_bug.cgi?id=1878026

===2026 sügis tähelepanekud===

25 Gbit/s switchid

* Mikrotik 'CRS518-16XS-2XQ-RM' - https://mikrotik.com/product/crs518_16xs_2xq
* Mikrotik 'CRS510-8XS-2XQ-IN' - https://mikrotik.com/product/crs510_8xs_2xq_in
* Mikrotik 'CRS504-4XQ-IN' - https://mikrotik.com/product/crs504_4xq_in
* QNAP 'QSW-M7308R-4X' - https://www.qnap.com/en/product/qsw-m7308r-4x

===Kasulikud lisamaterjalid===

* https://network.nvidia.com/pdf/prod_software/Ubuntu_20_04_Inbox_Driver_User_Manual.pdf

Mellanox ConnectX-6 Lx EN

2026-11-01T12:43:44Z

Imre: /* Kasulikud lisamaterjalid */

Open-firmware arvuti

2026-10-31T23:06:00Z

Imre:

===Sissejuhatus===

TODO

===Misc===

Tootjad

* Star Labs - https://starlabs.systems/
* Tuxedo - https://www.tuxedocomputers.com/
* Novacustom - https://novacustom.com/
* Purism - https://puri.sm/
* System76 - https://system76.com/
* Nitrokey - https://www.nitrokey.com/

Misc

* https://9elements.com/
* https://www.dasharo.com/
* https://www.clevo.com.tw/
* https://www.coreboot.org/
* https://libreboot.org/
* https://canoeboot.org/

===Kasulikud lisamaterjalid===

* TODO

2026-10-28T22:58:05Z

Imre: /* Misc */

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

kus

* url - https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

Lenovo mudelite täpse koosseisu esitamine

[[Fail:20261028-p14s-lenovo-psref-01.png|900px]]

kus

* url - https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Ja Lenovo mudeli eriti täpse koosseisu esitamine

[[Fail:20261028-lenovo-p14s-04.png|1000px]]

kus

* url - https://pcsupport.lenovo.com/ee/en/products/laptops-and-netbooks/thinkpad-p-series-laptops/thinkpad-p14s-gen-6-type-21ql-21qm/21ql/21ql003wmx/parts/display/model

NVME seadme variatsioonid

[[Fail:20261028-lenovo-p14s-05.png|1000px]]

kus

* TODO

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Fail:20261028-lenovo-p14s-05.png

2026-10-28T22:56:57Z

Imre:

Laptop - Lenovo P14s

2026-10-28T21:35:20Z

Imre: /* Misc */

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

kus

* url - https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

Lenovo mudelite täpse koosseisu esitamine

[[Fail:20261028-p14s-lenovo-psref-01.png|900px]]

kus

* url - https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Ja Lenovo mudeli eriti täpse koosseisu esitamine

[[Fail:20261028-lenovo-p14s-04.png|1000px]]

kus

* url - https://pcsupport.lenovo.com/ee/en/products/laptops-and-netbooks/thinkpad-p-series-laptops/thinkpad-p14s-gen-6-type-21ql-21qm/21ql/21ql003wmx/parts/display/model

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Laptop - Lenovo P14s

2026-10-28T21:34:43Z

Imre: /* Misc */

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

Lenovo mudelite täpse koosseisu esitamine

[[Fail:20261028-p14s-lenovo-psref-01.png|900px]]

kus

* url - https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Ja Lenovo mudeli eriti täpse koosseisu esitamine

[[Fail:20261028-lenovo-p14s-04.png|1000px]]

kus

* url - https://pcsupport.lenovo.com/ee/en/products/laptops-and-netbooks/thinkpad-p-series-laptops/thinkpad-p14s-gen-6-type-21ql-21qm/21ql/21ql003wmx/parts/display/model

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Laptop - Lenovo P14s

2026-10-28T21:33:29Z

Imre: /* Misc */

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

Lenovo mudelite täpse koosseisu esitamine

[[Fail:20261028-p14s-lenovo-psref-01.png|900px]]

Ja Lenovo mudeli eriti täpse koosseisu esitamine

[[Fail:20261028-lenovo-p14s-04.png|1000px]]

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Laptop - Lenovo P14s

2026-10-28T21:33:15Z

Imre:

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

Lenovo mudelite täpse koosseisu esitamine

[[Fail:20261028-p14s-lenovo-psref-01.png|900px]]

Ja Lenovo mudeli eriti täpse koosseisu esitamine

[[Fail:20261028-lenovo-p14s-04.png|900px]]

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Fail:20261028-lenovo-p14s-04.png

2026-10-28T21:32:21Z

Imre:

Xfce kasutamine operatsioonisüsteemiga Debian

2026-10-28T08:59:08Z

Imre: /* 2026 aasta sügise märkmed */

===Sissejuhatus===

XFCE https://xfce.org/ ...

===Mõisted===

* desktop environment
* window manager
* XFWM
* multi seat
* menulibre - menüühaldur

===Tööpõhimõte===

Xfce kasutamisel tuleb hallata selliseid komponente

* Passwords and Keys (Seahorse)
* Polkit
* Power Management (protsessor, aku, monitor jms)
* videokaardi kasutamine
* heli kasutamine
* brauseri paroolide haldus
* Secure Boot
* võtmete agendid (ssh, gpg)
* eesti id kaardi kasutamine

===Tarkvara paigaldamine===

Tarkvara paigaldamiseks sobib öelda

# apt-get install xfce4 xfce4-goodies

kus

* xfce4 - keskkonna põhiosa
* xfce4-goodies - lisad, nt power management, keyboard layout jms

===Kahe monitori kasutamine===

Kahe monitori kasutamiseks tuleb esmalt veenduda, et monitorid on sisselülitatud

TODO

ja seejärel kuvada monitoride kohta andmed

$ xrandr
Screen 0: minimum 320 x 200, current 1920 x 1200, maximum 8192 x 8192
DVI-I-1 connected primary 1920x1200+0+0 (normal left inverted right x axis y axis) 518mm x 324mm
1920x1200 60.0*+
1920x1080 60.0
1600x1200 60.0
1680x1050 59.9
1280x1024 60.0
1280x960 60.0
1024x768 60.0
800x600 60.3
640x480 60.0
720x400 70.1
DP-1 connected 1920x1200+0+0 (normal left inverted right x axis y axis) 518mm x 324mm
1920x1200 60.0*+
1600x1200 60.0
1680x1050 59.9
1280x1024 60.0
1280x960 60.0
1024x768 60.0
800x600 60.3
640x480 60.0
720x400 70.1

Ja suhteliseks paigutamiseks

$ xrandr --output DP-1 --left-of DVI-I-1

Selleks, et paigutus säiliks peale järgmist sisselogimist sobib

TODO

Paneeli riba liigutamiseks monitoride vahel tuleb

Panel -> Panel Preferences

juures kontrollida, et

Lock Panel

poleks valitud (linnukesega). Seejärel saab paneeli vasakust või paremast servast hiire vasaku nupuga haarates paneeli liigutada uude asukohta, nt teisele monitorile või alla äärde.

===xfconf-query===

<pre>
$ xfconf-query -c displays -l -v
/Default/DP-1 1. AOC Intl 28"
/Default/DP-1/Active true
/Default/DP-1/Position/X 0
/Default/DP-1/Position/Y 0
/Default/DP-1/Primary true
/Default/DP-1/Reflection 0
/Default/DP-1/RefreshRate 30.000000
/Default/DP-1/Resolution 3840x2160
/Default/DP-1/Rotation 0
...
</pre>

===Mitmetasemeliste menüüde kasutamine===

Xfce v. 4.12 märkus: Selleks, et mitmetasemeline menüü töötaks tuleb iga alam-taseme nö kataloogide nimekirja panna ka üks Application sissekanne.

Menüü struktuuriga on seotud fail, mille nö põhjana sobib kasutada vastavat süsteemset faili

$ cp /etc/xdg/menus/xfce-applications.menu ~/.config/menus/xfce-applications.menu

ning kasutada seal nt sarnast sektsiooni

..
<Menu>
<Name>Office</Name>
<Directory>xfce-office.directory</Directory>
<Include>
<Category>Office</Category>
</Include>
</Menu>

<Menu>
<Name>X-IMOOL</Name>
<Directory>x-imool.directory</Directory>
<Include>
<Category>X-IMOOL</Category>
</Include>

<Menu>
<Name>X-IMOOL-kontor</Name>
<Directory>x-imool-kontor.directory</Directory>
<Include>
<Category>X-IMOOL-kontor</Category>
</Include>
</Menu>

<Menu>
<Name>X-IMOOL-toodang</Name>
<Directory>x-imool-toodang.directory</Directory>
<Include>
<Category>X-IMOOL-toodang</Category>
</Include>
</Menu>

</Menu>
...

Lisaks iga menüü sissekandele vastab fail

$ cat .local/share/applications/www-1.auul.desktop
[Desktop Entry]
Version=1.0
Type=Application
Name=www-1-105.auul
Comment=
Icon=
Exec=xterm -geometry 140x42+60+80 -e ssh root@192.168.1.105
Path=
Terminal=false
StartupNotify=false
Categories=X-XFCE;X-IMOOL-toodang;
OnlyShowIn=XFCE;
NoDisplay=false

Tundub, et xfce juures ei saa alacarte programmi hästi kasutada, aga menüüde genereerimiseks ehk sobibki paremini otsekohesem viis, nt tekstifaili alusel skripti abil genereerimine

# cat moodustaja.pl
#!/usr/bin/perl
open (fh, 'elemendid.txt');
@read=<fh>;
foreach $rida(@read) {
chomp $rida;
if ($rida !~ /^#/ && $rida ne "") {
@elemendid = split (/\;/, $rida);
$menuu = $elemendid[0];
$nimi = $elemendid[1];
$kask = $elemendid[2];

open (fh, ">tmp/$nimi.desktop");

print fh "[Desktop Entry]
Version=1.0
Type=Application
Name=$nimi
Comment=
Icon=
Exec=xterm -geometry 140x42+60+80 -e $kask
Path=
Terminal=false
StartupNotify=false
Categories=X-XFCE;$menuu;
OnlyShowIn=XFCE;
NoDisplay=false";
};
};

kus faili elemendid.txt sisu oleks nt

# cat elemendid.txt
# X-IMOOL-kontor
X-IMOOL-kontor;zabbix-10-123;ssh root@192.168.10.123
X-IMOOL-kontor;ibm-10-211;ssh root@192.168.10.211
X-IMOOL-kontor;moraal-dom0-10-11;ssh root@192.168.10.11

# X-IMOOL-toodang
X-IMOOL-toodang;veebel-1-4;ssh root@192.168.1.4
X-IMOOL-toodang;www-2-1-14;ssh root@192.168.1.14

===Audio Mixer Plugin===

XFCE Audio Mixer Plugin kasutamisel tuleb valida õige riistvaraline seade, millega plugin töötama hakkab

[[Pilt:Xfce-1.gif]]

kus

* valitud Sound Card on HDA Intel PCH

===Keyboard shortcuts===

Avada Window Manager programm

Settings -> Window Manager -> Keyboard

Topeltklõps hiirega või enter ja näidata uus kombinatsioon.

Väga mugav on hiire + alt (või mac klaviatuuril super) klahviga aknaid liigutada ja suurendada. Millist klavhi tuleb liigutamiseks/suuruse muutmiseks all hoida, saab kontrolliga XFCE Tweaks abil

Settings -> Windows Manager Tweaks -> Accessibility -> Key used to grab and move windows -> Super

===Keyboard Layouts===

Avada klõpsuga paneelil

Properties -> Panel -> Add New Item -> Keyboard Layouts

ning seejärel ilmunud ikooni klõpsuga

Keyboard Settings -> Layout -> Add -> Estonian

===LightDM kasutamine===

Selleks, et LightDM display manageri kontrolli all olevasse arvutisse sisse loginud kasutaja ekraanile saata üle võrgu aknaid sobib kasutada /etc/lightdm/lightdm.conf failis rida

# cat /etc/lightdm/lightdm.conf
..
xserver-allow-tcp=true
...

Tulemusena kuulab port 6000

# netstat -lnp | grep 6000
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN 1836/X

===4K kasutamine===

Tundub, et 4K monitorideks nimetatakse ca 3840 × 2160 resolutsiooni võimaldavaid monitore, mis on reeglina vähemalt 28" diagonaaliga. Nende kasutamiseks on tarvis

* 4K resolutsiooniks võimelist videokaarti, nt Nvidia Quadro midagi
* sobivat Display Port (DP) kaablit, soovitavalt standard v. 1.2 ja pikkus ca 2m
* 4K resolutsiooniks võimelist monitori

4K kasutamisel on omapärane probleem, vaikimisi on tõenäoliselt kõik liiga tilluke silma jaoks. Tõenäoliselt aitab sättida

* Settings Manager -> Appearance -> Fonts -> DPI -> 140 vms

Setting Manageri saab käivitada menüüst või xterminalist käsuga

$ xfce-settings-manager

Chrome brauseris saab globaalselt muuta Zoom väärtust Settings alt, nt valides 125%.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/NVIDIA_videokaardi_kasutamine_operatsioonis%C3%BCsteemiga_Debian_Wheezy#Debian_v._8_Jessie

===gpg ja ssh agendid===

<pre>
# ps aux | grep agent
imre 1297 0.0 0.0 11204 2708 ? Ss Apr23 0:02 /usr/bin/ssh-agent x-session-manager
imre 1325 0.0 0.0 91604 3228 ? SLs Apr23 0:00 /usr/bin/gpg-agent --supervised
</pre>

ssh agenti kasutamiseks sobib Xfce alt käivitatud Terminalis vms aknas öelda

$ ssh-add .ssh/votmenimi

===Passwords and Keys (Seahorse)===

MÄRKUS - tundub, et see pole väga vajalik, ssh võtmete agent töötab niisamagi.

'Passwords and Keys' abil saab Xfce keskkonnas kasutaja paroolide/sertifikaatide/gpg võtmete jms haldamiseks. Pigem on see mõeldud selliselt hallatud paroolide rakendustega integratsiooniks (nt Chromium brauser) kui nö üldotstarbelise saladuse-haldurina (milleks sobib tõenäoliselt paremini nt Password Gorilla).

====Mõisted====

* keyring

====Tööpõhimõte====

* keyringid asuvad kataloogis ~/.local/share/keyrings, nt

<pre>
-rw------- 1 imre imre 301 May 1 22:57 /home/imre/.local/share/keyrings/login.keyring
-rw------- 1 imre imre 301 May 1 22:57 /home/imre/.local/share/keyrings/passwords-keyring-test1.keyring
-rw------- 1 imre imre 207 May 1 21:55 /home/imre/.local/share/keyrings/user.keystore
</pre>

* login.keyring on krüptitud sama parooliga, millega kasutaja logib sisse X konsoolilt ja avatakse sisselogimisel automaatselt (täna lightdm pam.d integratsioonile)

<pre>
# grep keyring /etc/pam.d/*
..
/etc/pam.d/lightdm:-auth optional pam_gnome_keyring.so
/etc/pam.d/lightdm:-session optional pam_gnome_keyring.so auto_start
</pre>

* tundub, et tänu common-password ja keyring integratsioonile parooli vahetamisel automaatselt muutub ka login keyring parool

# grep keyring /etc/pam.d/*
/etc/pam.d/common-password:password optional pam_gnome_keyring.so
...

====Paigaldamine====

Kasutamiseks tuleb Seahorse pakett paigaldada

# apt-get install seahorse

ja välja logida (veenduda, et seejuures kõik kasutaja protsessid on otsa lõppenud, vajadusel öelda 'systemctl restart lightdm') ja uuesti sisse logida. Applications menüüs on muu hulgas näha

Accessories -> Passwords and Keys

===Whisker menüü asendamine klassikalisega===

Whisker eemaldamiseks valida

XFCE settings -> Panel -> Items -> Whisker Menu -> punane miinus paremal ääres

Klassikalise Application menu lisamiseks paneelile tuleb valida samas roheline pluss ja 'Applications Menu'. Seejärel nihutada Application klassik vasakusse serva.

===Liigutamise / suuruse muutmise ajal akna sisu esitamine===

Selleks, et akna sisu mitte esitada (liigub raam) akna liigutamise või suuruse muutmise ajal sobib

Settings Manager -> Windows Manager -> Advanced -> Hide content of windows when moving / resizing

===Terminali seadistamine===

Teksti suuruse muutmiseks

Edit -> Preferences -> Appearance -> Font -> ...

Taustavärvi muutmiseks

Edit -> Preferences -> Color -> Background color -> must

===Automaatne failisüsteemi monteerimine===

Vaikimisi XFCE monteerib süsteemile nähtavaks muutunud uue plokkseadme peal asuva failisüsteemi, nt lvm snapshot tekitamisel. Automaatse monteerimise väljalülitamiseks sobib öelda

Settings -> Removeable Drives and Media -> Storage

ning eemaldada linnukesed

* Mount removeable drives when hot-plugged
* Mount removeable media when inserted
* Browse removeable media when inserted

===2026 aasta sügise märkmed===

Mõisted

* MST - multi-stream transport
* DDC (Display Data Channel) is the I2C wire link inside the display cable. It's the same channel the EDID is read over.
* DDC/CI (Command Interface) is the protocol for sending commands over DDC.
* MCCS (Monitor Control Command Set) is the VESA standard that defines the VCP codes.

ddcutil tööriista abil saab üle dp kaabli ligi monitori sellele osakonnale, millega tegelevad ka tema füüsilisel korpusel olevad füüsilised nupud (osd - on-screen display)

<pre>
root@ubu2110:~# ddcutil detect
Failed to find connector name for /dev/i2c-8, set_connector_for_businfo_using_edid at line 1376 in file i2c_bus_core.c.
Invalid display
I2C bus: /dev/i2c-4
DRM_connector: card1-eDP-1
EDID synopsis:
Mfg id: LGD - LG Display
Model:
Product code: 1313 (0x0521)
Serial number:
Binary serial number: 0 (0x00000000)
Manufacture year: 2016, Week: 0
This is a laptop display. Laptop displays do not support DDC/CI.

Display 1
I2C bus: /dev/i2c-8
EDID synopsis:
Mfg id: DEL - Dell Inc.
Model: DELL U2725QE
Product code: 17250 (0x4362)
Serial number: 7ZL9B34
Binary serial number: 1095185484 (0x4147344c)
Manufacture year: 2025, Week: 13
VCP version: 2.1

Display 2
I2C bus: /dev/i2c-12
DRM_connector: card1-DP-8
EDID synopsis:
Mfg id: DEL - Dell Inc.
Model: DELL U2725QE
Product code: 17250 (0x4362)
Serial number: H2M9B34
Binary serial number: 1095258956 (0x4148534c)
Manufacture year: 2025, Week: 13
VCP version: 2.1
</pre>

i2c bus kaudu andmete küsimine

<pre>
root@ubu2110:~# ddcutil --bus 6 getvcp ALL
VCP code 0x02 (New control value ): One or more new control values have been saved (0x02)
VCP code 0x03 (Soft controls ): Button 2 active (sl=0x02)
VCP code 0x0b (Color temperature increment ): 2 degree(s) Kelvin
VCP code 0x0c (Color temperature request ): 3000 + 2 * (feature 0B color temp increment) degree(s) Kelvin
VCP code 0x0e (Clock ): current value = 50, max value = 100
VCP code 0x10 (Brightness ): current value = 77, max value = 100
VCP code 0x12 (Contrast ): current value = 75, max value = 100
VCP code 0x14 (Select color preset ): 6500 K (sl=0x05)
VCP code 0x16 (Video gain: Red ): current value = 100, max value = 100
VCP code 0x18 (Video gain: Green ): current value = 100, max value = 100
VCP code 0x1a (Video gain: Blue ): current value = 100, max value = 100
VCP code 0x1e (Auto setup ): Auto setup not active (sl=0x00)
VCP code 0x20 (Horizontal Position ): current value = 0, max value = 100
VCP code 0x30 (Vertical Position ): current value = 0, max value = 100
VCP code 0x3e (Clock phase ): current value = 50, max value = 100
VCP code 0x52 (Active control ): Value: 0x12
VCP code 0x60 (Input Source ): DisplayPort-1 (sl=0x0f)
VCP code 0x62 (Audio speaker volume ): current value = 50, max value = 100
VCP code 0x66 (Ambient light sensor ): Invalid value (sl=0x41)
VCP code 0x6c (Video black level: Red ): current value = 50, max value = 255
VCP code 0x6e (Video black level: Green ): current value = 50, max value = 255
VCP code 0x70 (Video black level: Blue ): current value = 50, max value = 255
VCP code 0x87 (Sharpness ): Invalid value (sl=0x32)
VCP code 0xaa (Screen Orientation ): 0 degrees (sl=0x01)
VCP code 0xac (Horizontal frequency ): 2228 hz
VCP code 0xae (Vertical frequency ): 59.99 hz
VCP code 0xb2 (Flat panel sub-pixel layout ): Red/Green/Blue vertical stripe (sl=0x01)
VCP code 0xb4 (Source Timing Mode ): mh=0x00, ml=0x02, sh=0x00, sl=0x01
VCP code 0xb6 (Display technology type ): LCD (active matrix) (sl=0x03)
VCP code 0xc0 (Display usage time ): Usage time (hours) = 7996 (0x001f3c) mh=0xff, ml=0xff, sh=0x1f, sl=0x3c
VCP code 0xc6 (Application enable key ): 0x0001
VCP code 0xc8 (Display controller type ): Mfg: Mstar (sl=0x05), controller number: mh=0x00, ml=0x00, sh=0x56
VCP code 0xc9 (Display firmware level ): 65.2
VCP code 0xca (OSD ): Invalid value (sl=0x00)
VCP code 0xcc (OSD Language ): English (sl=0x02)
VCP code 0xd6 (Power mode ): DPM: On, DPMS: Off (sl=0x01)
VCP code 0xdc (Display Mode ): Standard/Default mode (sl=0x00)
VCP code 0xdf (VCP Version ): 2.1
</pre>

===Kasulikud lisamaterjalid===

* http://www.youtube.com/watch?v=JnH92h_QHf0
* https://en.wikipedia.org/wiki/Xfce
* [[:Polkit kasutamine operatsioonisüsteemiga Debian]]

Laptop - Lenovo P14s

2026-10-28T06:40:01Z

Imre: /* Misc */

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

Lenovo mudelite täpse koosseisu esitamine

[[Fail:20261028-p14s-lenovo-psref-01.png|900px]]

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Laptop - Lenovo P14s

2026-10-28T06:39:49Z

Imre: /* Misc */

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

Lenovo mudelite täpse koosseisu esitamine

[[Fail:20261028-p14s-lenovo-psref-01.png|1000px]]

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Fail:20261028-p14s-lenovo-psref-01.png

2026-10-28T06:39:13Z

Imre:

Laptop - Lenovo P14s

2026-10-28T06:39:06Z

Imre:

===Sissejuhatus===

TODO

===Misc===

Tundub, et tervikuna arvuti võiks toimida pigem hästi Linux operatsioonisüsteemiga

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

OpenBSD puhul on täna väljakutse wifi, aga see võiks varsti paraneda, https://man.openbsd.org/mwx.4

OpenBSD puhul tõenäoliselt AMD videokaart toimib, https://man.openbsd.org/amdgpu.4

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20
* https://psref.lenovo.com/detail/ThinkPad_P14s_Gen_6_AMD?M=21QL003WMX

Laptop - Lenovo P14s

2026-10-28T06:32:31Z

Imre: /* Misc */

===Sissejuhatus===

TODO

===Misc===

[[Fail:20261028-p14s-ubuntu-certified-01.png|1000px]]

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20

Laptop - Lenovo P14s

2026-10-28T06:32:22Z

Imre:

===Sissejuhatus===

TODO

===Misc===

[[Fail:20261028-p14s-ubuntu-certified-01.png|800px]]

===Kasulikud lisamaterjalid===

* https://ubuntu.com/certified/search?q=Lenovo+ThinkPad+P14s+Gen+6&category=Laptop&limit=20

2026-10-27T10:34:01Z

Imre: Uus lehekülg: '===Sissejuhatus=== XFCE https://xfce.org/ ... ===Mõisted=== * desktop environment * window manager * XFWM * multi seat * menulibre - menüühaldur ===Tööpõhimõte=== Xfce kasutamisel tuleb hallata selliseid komponente * Passwords and Keys (Seahorse) * Polkit * Power Management (protsessor, aku, monitor jms) * videokaardi kasutamine * heli kasutamine * brauseri paroolide haldus * Secure Boot * võtmete agendid (ssh, gpg) * eesti id kaardi kasutamine ===Tarkvara pa...'

===Sissejuhatus===

XFCE https://xfce.org/ ...

===Mõisted===

* desktop environment
* window manager
* XFWM
* multi seat
* menulibre - menüühaldur

===Tööpõhimõte===

Xfce kasutamisel tuleb hallata selliseid komponente

* Passwords and Keys (Seahorse)
* Polkit
* Power Management (protsessor, aku, monitor jms)
* videokaardi kasutamine
* heli kasutamine
* brauseri paroolide haldus
* Secure Boot
* võtmete agendid (ssh, gpg)
* eesti id kaardi kasutamine

===Tarkvara paigaldamine===

Tarkvara paigaldamiseks sobib öelda

# apt-get install xfce4 xfce4-goodies

kus

* xfce4 - keskkonna põhiosa
* xfce4-goodies - lisad, nt power management, keyboard layout jms

===Kahe monitori kasutamine===

Kahe monitori kasutamiseks tuleb esmalt veenduda, et monitorid on sisselülitatud

TODO

ja seejärel kuvada monitoride kohta andmed

$ xrandr
Screen 0: minimum 320 x 200, current 1920 x 1200, maximum 8192 x 8192
DVI-I-1 connected primary 1920x1200+0+0 (normal left inverted right x axis y axis) 518mm x 324mm
1920x1200 60.0*+
1920x1080 60.0
1600x1200 60.0
1680x1050 59.9
1280x1024 60.0
1280x960 60.0
1024x768 60.0
800x600 60.3
640x480 60.0
720x400 70.1
DP-1 connected 1920x1200+0+0 (normal left inverted right x axis y axis) 518mm x 324mm
1920x1200 60.0*+
1600x1200 60.0
1680x1050 59.9
1280x1024 60.0
1280x960 60.0
1024x768 60.0
800x600 60.3
640x480 60.0
720x400 70.1

Ja suhteliseks paigutamiseks

$ xrandr --output DP-1 --left-of DVI-I-1

Selleks, et paigutus säiliks peale järgmist sisselogimist sobib

TODO

Paneeli riba liigutamiseks monitoride vahel tuleb

Panel -> Panel Preferences

juures kontrollida, et

Lock Panel

poleks valitud (linnukesega). Seejärel saab paneeli vasakust või paremast servast hiire vasaku nupuga haarates paneeli liigutada uude asukohta, nt teisele monitorile või alla äärde.

===xfconf-query===

<pre>
$ xfconf-query -c displays -l -v
/Default/DP-1 1. AOC Intl 28"
/Default/DP-1/Active true
/Default/DP-1/Position/X 0
/Default/DP-1/Position/Y 0
/Default/DP-1/Primary true
/Default/DP-1/Reflection 0
/Default/DP-1/RefreshRate 30.000000
/Default/DP-1/Resolution 3840x2160
/Default/DP-1/Rotation 0
...
</pre>

===Mitmetasemeliste menüüde kasutamine===

Xfce v. 4.12 märkus: Selleks, et mitmetasemeline menüü töötaks tuleb iga alam-taseme nö kataloogide nimekirja panna ka üks Application sissekanne.

Menüü struktuuriga on seotud fail, mille nö põhjana sobib kasutada vastavat süsteemset faili

$ cp /etc/xdg/menus/xfce-applications.menu ~/.config/menus/xfce-applications.menu

ning kasutada seal nt sarnast sektsiooni

..
<Menu>
<Name>Office</Name>
<Directory>xfce-office.directory</Directory>
<Include>
<Category>Office</Category>
</Include>
</Menu>

<Menu>
<Name>X-IMOOL</Name>
<Directory>x-imool.directory</Directory>
<Include>
<Category>X-IMOOL</Category>
</Include>

<Menu>
<Name>X-IMOOL-kontor</Name>
<Directory>x-imool-kontor.directory</Directory>
<Include>
<Category>X-IMOOL-kontor</Category>
</Include>
</Menu>

<Menu>
<Name>X-IMOOL-toodang</Name>
<Directory>x-imool-toodang.directory</Directory>
<Include>
<Category>X-IMOOL-toodang</Category>
</Include>
</Menu>

</Menu>
...

Lisaks iga menüü sissekandele vastab fail

$ cat .local/share/applications/www-1.auul.desktop
[Desktop Entry]
Version=1.0
Type=Application
Name=www-1-105.auul
Comment=
Icon=
Exec=xterm -geometry 140x42+60+80 -e ssh root@192.168.1.105
Path=
Terminal=false
StartupNotify=false
Categories=X-XFCE;X-IMOOL-toodang;
OnlyShowIn=XFCE;
NoDisplay=false

Tundub, et xfce juures ei saa alacarte programmi hästi kasutada, aga menüüde genereerimiseks ehk sobibki paremini otsekohesem viis, nt tekstifaili alusel skripti abil genereerimine

# cat moodustaja.pl
#!/usr/bin/perl
open (fh, 'elemendid.txt');
@read=<fh>;
foreach $rida(@read) {
chomp $rida;
if ($rida !~ /^#/ && $rida ne "") {
@elemendid = split (/\;/, $rida);
$menuu = $elemendid[0];
$nimi = $elemendid[1];
$kask = $elemendid[2];

open (fh, ">tmp/$nimi.desktop");

print fh "[Desktop Entry]
Version=1.0
Type=Application
Name=$nimi
Comment=
Icon=
Exec=xterm -geometry 140x42+60+80 -e $kask
Path=
Terminal=false
StartupNotify=false
Categories=X-XFCE;$menuu;
OnlyShowIn=XFCE;
NoDisplay=false";
};
};

kus faili elemendid.txt sisu oleks nt

# cat elemendid.txt
# X-IMOOL-kontor
X-IMOOL-kontor;zabbix-10-123;ssh root@192.168.10.123
X-IMOOL-kontor;ibm-10-211;ssh root@192.168.10.211
X-IMOOL-kontor;moraal-dom0-10-11;ssh root@192.168.10.11

# X-IMOOL-toodang
X-IMOOL-toodang;veebel-1-4;ssh root@192.168.1.4
X-IMOOL-toodang;www-2-1-14;ssh root@192.168.1.14

===Audio Mixer Plugin===

XFCE Audio Mixer Plugin kasutamisel tuleb valida õige riistvaraline seade, millega plugin töötama hakkab

[[Pilt:Xfce-1.gif]]

kus

* valitud Sound Card on HDA Intel PCH

===Keyboard shortcuts===

Avada Window Manager programm

Settings -> Window Manager -> Keyboard

Topeltklõps hiirega või enter ja näidata uus kombinatsioon.

Väga mugav on hiire + alt (või mac klaviatuuril super) klahviga aknaid liigutada ja suurendada. Millist klavhi tuleb liigutamiseks/suuruse muutmiseks all hoida, saab kontrolliga XFCE Tweaks abil

Settings -> Windows Manager Tweaks -> Accessibility -> Key used to grab and move windows -> Super

===Keyboard Layouts===

Avada klõpsuga paneelil

Properties -> Panel -> Add New Item -> Keyboard Layouts

ning seejärel ilmunud ikooni klõpsuga

Keyboard Settings -> Layout -> Add -> Estonian

===LightDM kasutamine===

Selleks, et LightDM display manageri kontrolli all olevasse arvutisse sisse loginud kasutaja ekraanile saata üle võrgu aknaid sobib kasutada /etc/lightdm/lightdm.conf failis rida

# cat /etc/lightdm/lightdm.conf
..
xserver-allow-tcp=true
...

Tulemusena kuulab port 6000

# netstat -lnp | grep 6000
tcp 0 0 0.0.0.0:6000 0.0.0.0:* LISTEN 1836/X

===4K kasutamine===

Tundub, et 4K monitorideks nimetatakse ca 3840 × 2160 resolutsiooni võimaldavaid monitore, mis on reeglina vähemalt 28" diagonaaliga. Nende kasutamiseks on tarvis

* 4K resolutsiooniks võimelist videokaarti, nt Nvidia Quadro midagi
* sobivat Display Port (DP) kaablit, soovitavalt standard v. 1.2 ja pikkus ca 2m
* 4K resolutsiooniks võimelist monitori

4K kasutamisel on omapärane probleem, vaikimisi on tõenäoliselt kõik liiga tilluke silma jaoks. Tõenäoliselt aitab sättida

* Settings Manager -> Appearance -> Fonts -> DPI -> 140 vms

Setting Manageri saab käivitada menüüst või xterminalist käsuga

$ xfce-settings-manager

Chrome brauseris saab globaalselt muuta Zoom väärtust Settings alt, nt valides 125%.

Kasulikud lisamaterjalid

* https://www.auul.pri.ee/wiki/NVIDIA_videokaardi_kasutamine_operatsioonis%C3%BCsteemiga_Debian_Wheezy#Debian_v._8_Jessie

===gpg ja ssh agendid===

<pre>
# ps aux | grep agent
imre 1297 0.0 0.0 11204 2708 ? Ss Apr23 0:02 /usr/bin/ssh-agent x-session-manager
imre 1325 0.0 0.0 91604 3228 ? SLs Apr23 0:00 /usr/bin/gpg-agent --supervised
</pre>

ssh agenti kasutamiseks sobib Xfce alt käivitatud Terminalis vms aknas öelda

$ ssh-add .ssh/votmenimi

===Passwords and Keys (Seahorse)===

MÄRKUS - tundub, et see pole väga vajalik, ssh võtmete agent töötab niisamagi.

'Passwords and Keys' abil saab Xfce keskkonnas kasutaja paroolide/sertifikaatide/gpg võtmete jms haldamiseks. Pigem on see mõeldud selliselt hallatud paroolide rakendustega integratsiooniks (nt Chromium brauser) kui nö üldotstarbelise saladuse-haldurina (milleks sobib tõenäoliselt paremini nt Password Gorilla).

====Mõisted====

* keyring

====Tööpõhimõte====

* keyringid asuvad kataloogis ~/.local/share/keyrings, nt

<pre>
-rw------- 1 imre imre 301 May 1 22:57 /home/imre/.local/share/keyrings/login.keyring
-rw------- 1 imre imre 301 May 1 22:57 /home/imre/.local/share/keyrings/passwords-keyring-test1.keyring
-rw------- 1 imre imre 207 May 1 21:55 /home/imre/.local/share/keyrings/user.keystore
</pre>

* login.keyring on krüptitud sama parooliga, millega kasutaja logib sisse X konsoolilt ja avatakse sisselogimisel automaatselt (täna lightdm pam.d integratsioonile)

<pre>
# grep keyring /etc/pam.d/*
..
/etc/pam.d/lightdm:-auth optional pam_gnome_keyring.so
/etc/pam.d/lightdm:-session optional pam_gnome_keyring.so auto_start
</pre>

* tundub, et tänu common-password ja keyring integratsioonile parooli vahetamisel automaatselt muutub ka login keyring parool

# grep keyring /etc/pam.d/*
/etc/pam.d/common-password:password optional pam_gnome_keyring.so
...

====Paigaldamine====

Kasutamiseks tuleb Seahorse pakett paigaldada

# apt-get install seahorse

ja välja logida (veenduda, et seejuures kõik kasutaja protsessid on otsa lõppenud, vajadusel öelda 'systemctl restart lightdm') ja uuesti sisse logida. Applications menüüs on muu hulgas näha

Accessories -> Passwords and Keys

===Whisker menüü asendamine klassikalisega===

Whisker eemaldamiseks valida

XFCE settings -> Panel -> Items -> Whisker Menu -> punane miinus paremal ääres

Klassikalise Application menu lisamiseks paneelile tuleb valida samas roheline pluss ja 'Applications Menu'. Seejärel nihutada Application klassik vasakusse serva.

===Liigutamise / suuruse muutmise ajal akna sisu esitamine===

Selleks, et akna sisu mitte esitada (liigub raam) akna liigutamise või suuruse muutmise ajal sobib

Settings Manager -> Windows Manager -> Advanced -> Hide content of windows when moving / resizing

===Terminali seadistamine===

Teksti suuruse muutmiseks

Edit -> Preferences -> Appearance -> Font -> ...

Taustavärvi muutmiseks

Edit -> Preferences -> Color -> Background color -> must

===Automaatne failisüsteemi monteerimine===

Vaikimisi XFCE monteerib süsteemile nähtavaks muutunud uue plokkseadme peal asuva failisüsteemi, nt lvm snapshot tekitamisel. Automaatse monteerimise väljalülitamiseks sobib öelda

Settings -> Removeable Drives and Media -> Storage

ning eemaldada linnukesed

* Mount removeable drives when hot-plugged
* Mount removeable media when inserted
* Browse removeable media when inserted

===Kasulikud lisamaterjalid===

* http://www.youtube.com/watch?v=JnH92h_QHf0
* https://en.wikipedia.org/wiki/Xfce
* [[:Polkit kasutamine operatsioonisüsteemiga Debian]]

Claude Desktop - MacOS

2026-10-27T09:31:39Z

Imre: /* Teenuse kättesaadavus */

===Sissejuhatus===

Väited

* Claude tähistab üldiselt tootja Anthropic ühte toodete komplekti - keelemudel, teenus, klienttarkavara, protokoll jne
* käesolev tekst keskendub Claude abil agentse lahenduse kasutamisele - st eesmärgiks on, et inimene istub koos agendiga samas aruvutis ja nad koos teevad midagi aktiivselt (nt paigaldavad arvutisse tarkvara, analüüsivad arvutis toimuvaid protsesse jne (jutt ei ole inimese töökohaarvutist, aga mingist muust arvutist, nt serverist)
* Claude agentset kasutamist tähistatakse 'Claude Code'
* Claude Code kasutamiseks on tingimata tarvis paigaldada kas töökohaarvutisse või serverisse Claude agendi tarkvara
* Claude Code kasutamiseks on tingimata tarvis kasutada sobivat kommerts teenust (nt Pro taseme subscription abil)
* kuigi käesolev tekst soovib keskenduda agentsele kasutamisele on Claude Desktop rakendus praktiliselt nii Chat, Code ja Cowork funktsioonidega
* Claude rakenduse Chat funktsioon on analoogne veebikoha https://claude.ai/ kasutamisele
* Claude Desktop app ei sisalda otseselt käsurea kasutamise st terminalis töötamise võimalust (nii, et visuaalselt on prompt kasutada)

Misc

* https://claude.com/ - korporatiivne veebikoht (info kasutajaks saamise kohta, tarkvara allalaadimine, kasutusjuhised jne)
* https://claude.ai/ - online chat teenus

===Tööpõhimõte===

====Claude Chat režiim====

Claude Desktop App kasutamine Chat režiimis paistab välja selline

[[Fail:20260717-cc-app-macos-03.png|800px]]

kus

* TODO

====Claude Code režiim====

Claude Desktop App kasutamine Code režiimis paistab välja selline

[[Fail:20260717-cc-app-macos-04.png|800px]]

kus

* käsundamine toimub selles operatsioonisüsteemis, kus claude desktop protsess töötab st macos operatsioonisüsteemis enda (mitte mõnes virtuaalses arvutis)

Tegevustega seotud tulemused asuvad kaustas (mis esmakordsel käivitamisel saab rakendusele ütlelda, st et toimetagu '/Users/imreoolberg/cc-01' kaustas ja sealt edasi

<pre>
imreoolberg@Imres-MacBook-Air cc-01 % pwd
/Users/imreoolberg/cc-01

imreoolberg@Imres-MacBook-Air cc-01 % find . -ls
123993344 0 drwxr-xr-x 3 imreoolberg staff 96 Jul 17 14:04 .
123993560 0 drwxr-xr-x 4 imreoolberg staff 128 Jul 17 14:13 ./imre-test-01
123995650 8 -rw-r--r-- 1 imreoolberg staff 822 Jul 17 14:13 ./imre-test-01/random.auul.pri.ee.cert.pem
123995649 8 -rw-r--r-- 1 imreoolberg staff 227 Jul 17 14:13 ./imre-test-01/random.auul.pri.ee.key.pem
</pre>

====Claude Cowork režiim====

Väited

* cowork režiim on turvalisem kui claude-code režiim, sest tegevused toimuvad eraldi abistavas virtuaalses arvutis
* cowork virtuaalne arvuti ei saa tavalises mõttes võrku (tcp/ip mõttes) - suhtlemine ümbrusega toimub connectorite abil
* abistavad vahendid on plugins, connectors ja skills (plugin kombineerib hulga skille ja konnektoreid)

Cowork režiimis esmalt moodustatakse projekt ning seostada folderiga

[[Fail:20260721-cc-app-macos-03.png|450px]]

seejärel palve midagi teha, nt 'please create self-signed x509 certificate for dns name p-cowork-03.auul.pri.ee, rsa crypto, 2048 bit and 1 year expiration, save certificate and key in this project associated shared folder'

[[Fail:20260721-cc-app-macos-04.png|1100px]]

seejärel palve tulemust esitada nimekirja kujul, kui tulemus paluda salvestada faili, siis saab seda esitada eraldi paremal olevas kolmandas paneelis

[[Fail:20260721-cc-app-macos-05.png|1100px]]

ja lõpuks palve midagi väljendada enda keskkonna kohta - siis saab kinnituse, et tegu on macos peal töötava ajutise abistama Ubuntu v. 22.04 virtuaalse arvutiga

[[Fail:20260721-cc-app-macos-06.png|1100px]]

Lõpuks on kogunenud projekti kataloogi sellised failid, macos poolelt vaadates

<pre>
imreoolberg@Imres-MacBook-Air ~ % find p-cowork-03-fld-01 -type f -ls
124551478 8 -rw------- 1 imreoolberg staff 1704 Jul 21 15:22 p-cowork-03-fld-01/p-cowork-03.auul.pri.ee.key
124551676 8 -rw-r--r-- 1 imreoolberg staff 386 Jul 21 15:24 p-cowork-03-fld-01/cat-os-release.txt
124551477 8 -rw------- 1 imreoolberg staff 1200 Jul 21 15:22 p-cowork-03-fld-01/p-cowork-03.auul.pri.ee.crt
124551577 8 -rw-r--r-- 1 imreoolberg staff 484 Jul 21 15:23 p-cowork-03-fld-01/find-ls.txt
</pre>

Komponent joonis (claude.ai tehtud)

[[Fail:20260721-cc-app-macos-02.png|900px]]

kus

* Claude Desktop ja Claude Code kasutamisel osa tegevusi toimub taustal töötavas virtuaalses arvutis - MacOS puhul VZ virtuaalses arvutis

Kasulikud lisamaterjalid

* https://aaddrick.com/blog/claude-desktop-cowork-mode-vm-architecture-analysis

===Claude teenusele ligipääs===

Claude teenusele ligipääsu ostmine toimub https://claude.com/ veebikohas

[[Fail:20260722-cc-app-macos-01.png|900px]]

kus

* realistliku toimetamise jaoks võiks olla sobiv Pro ligipääs

===Paigaldamine - Claude Desktop App===

Claude app kasutamiseks tuleb tarkvara kopeerida tootja veebikohast

[[Fail:20260717-cc-app-macos-02.png|800px]]

kus

* navigeerides 'https://claude.com/ -> Meet Claude -> Claude Code'
* või navigeerides 'https://claude.com/ -> Meet Claude -> Claude Cowork'
* tundub, et kõigil juhtudel pakutakse alla laadida sama Claude.dmg fail (320 MBait)

Paigaldamine toimub nö tavaliselt .dmg viisil

[[Fail:20260717-cc-app-macos-01.png|800px]]

kus

* TODO

===Käivitamine ja seadistamine===

Esmakordsel käivitamisel küsitakse autentimist isandaga, nt Google kaudu

[[Fail:20260717-cc-app-macos-05.png|800px]]

kus

* TODO

Tulemusena saab rakenduse käivitada ja paistab Tööpõhimõte punktis esitatud pilt, arvutis töötavad sellised protsessid

<pre>
imreoolberg@Imres-MacBook-Air ~ % ps aux | grep -i claude | grep -v grep
imreoolberg 21245 0.1 1.4 1951100112 230368 ?? S 1:02PM 0:02.89 /Applications/Claude.app/Contents/MacOS/Claude
imreoolberg 21278 0.0 0.4 1949258624 65536 ?? S 1:02PM 0:00.09 /Applications/Claude.app/Contents/Frameworks/Claude Helper.app/Contents/MacOS/Claude Helper --type=utility --utility-sub-type=node.mojom.NodeService ...
...
</pre>

kus

* saab aimu, et tegu on javascript vms põhise lahendusega

nt logitakse sellistesse failidesse

<pre>
imreoolberg@Imres-MacBook-Air cc-01 % lsof -p 21245 -P -n | grep log
Claude 21245 imreoolberg 36w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 37w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 42w REG 1,20 6944 124005039 /Users/imreoolberg/Library/Application Support/Claude/Local Storage/leveldb/000183.log
Claude 21245 imreoolberg 47w REG 1,20 311739 123983838 /Users/imreoolberg/Library/Logs/Claude/main.log
Claude 21245 imreoolberg 48w REG 1,20 68 123983932 /Users/imreoolberg/Library/Application Support/Claude/Partitions/cowork-file-preview/Local Storage/leveldb/000003.log
Claude 21245 imreoolberg 51w REG 1,20 68 123983933 /Users/imreoolberg/Library/Application Support/Claude/Partitions/launch-preview-static/Local Storage/leveldb/000003.log
Claude 21245 imreoolberg 67w REG 1,20 30 123983949 /Users/imreoolberg/Library/Application Support/Claude/Partitions/launch-preview-static/Session Storage/000003.log
Claude 21245 imreoolberg 84w REG 1,20 9994 123984082 /Users/imreoolberg/Library/Application Support/Claude/Session Storage/000003.log
Claude 21245 imreoolberg 89w REG 1,20 224 123984215 /Users/imreoolberg/Library/Logs/Claude/ssh.log
Claude 21245 imreoolberg 90w REG 1,20 626 123984216 /Users/imreoolberg/Library/Logs/Claude/cowork_vm_node.log
Claude 21245 imreoolberg 92w REG 1,20 1032 123987914 /Users/imreoolberg/Library/Logs/Claude/unknown-window.log
Claude 21245 imreoolberg 97w REG 1,20 2012 123984251 /Users/imreoolberg/Library/Logs/Claude/claude.ai-web.log
Claude 21245 imreoolberg 98w REG 1,20 231448 123984147 /Users/imreoolberg/Library/Application Support/Claude/IndexedDB/https_claude.ai_0.indexeddb.leveldb/000003.log
</pre>

===Tarkvara uuendamine===

Claude Desktop tarkvara uuendamiseks sobib

[[Fail:20260722-cc-app-macos-02.png|800px]]

kus

* pressida ühte või teist Update nuppu

===Teenuse kättesaadavus===

Claude teenuse erinevatest komponentidest annab aimu avalik https://status.claude.com/

[[Fail:20260719-cc-app-macos-01.png|700px]]

kus töökohaarvutil puudub võrguühndus, siis Desktop app ei tööta

[[Fail:20260720-cc-app-macos-01.png|700px]]

kui on outage

[[Fail:20261027-status-claude-ai-01.png|700px]]

Samal ajal väljendab claude code cli rakendus nt midagi sellist

[[Fail:20261027-status-claude-ai-02.png|900px]]

* api error

===Claude Code CLI - kasutaja õigustes===

Claude Code CLI paigaldamine MacOS peale on võimalik mitmel viisil

* tarkvara paigaldatakse nö ülesüsteemselt
* tarkvara paigaldatakse kasutaja kodukataloogi

Käesoleval juhtumil kirjeldatakse paigaldamist kodukataloogi kuna tuleb paigaldada kaks tarkvara, ja nad kumbki ei ole väga naturaalselt macos jaoks ettevalmistatud (st pole nö visuaalset vms installerit, ametlik juhend soovitab lausa pimedalt shellida, 'curl -fsSL https://claude.ai/install.sh | bash'

* node
* node moodul-pakett-jne - claude

====Tarkvara kopeerimine, paigaldamine ja käivitamine====

TODO

<pre>
imreoolberg@Imres-MacBook-Air ~ % cp -a Downloads/node-v24.19.0-darwin-arm64 .local/node
imreoolberg@Imres-MacBook-Air ~ % ./.local/node/bin/node -v
v24.19.0

imreoolberg@Imres-MacBook-Air ~ % export PATH="$HOME/.local/node/bin:$PATH"
imreoolberg@Imres-MacBook-Air ~ % npm install -g cowsay

imreoolberg@Imres-MacBook-Air ~ % ./.local/node/bin/cowsay -y "hello world"
_____________
< hello world >
-------------
\ ^__^
\ (..)\_______
(__)\ )\/\
||----w |
|| ||

imreoolberg@Imres-MacBook-Air ~ % npm list -g
/Users/imreoolberg/.local/node/lib
├── corepack@0.35.0
├── cowsay@1.6.0
└── npm@11.17.0

imreoolberg@Imres-MacBook-Air ~ % cd /tmp
imreoolberg@Imres-MacBook-Air /tmp %
imreoolberg@Imres-MacBook-Air ~ % npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code
imreoolberg@Imres-MacBook-Air /tmp % cd ~

imreoolberg@Imres-MacBook-Air ~ % mkdir cc-local
imreoolberg@Imres-MacBook-Air ~ % cd cc-local

imreoolberg@Imres-MacBook-Air ~ % claude

imreoolberg@Imres-MacBook-Air cc-local % claude daemon status
pid: 8316
version: 2.1.240
uptime: 3008s
origin: transient — started on-demand by `claude` (pid 82547) in /Users/imreoolberg/cc-local
config: /Users/imreoolberg/.claude/daemon.json
log: /Users/imreoolberg/.claude/daemon.log

bg sessions:
sock dir: /tmp/cc-daemon-501/c67e4872
control.sock: reachable
bg workers: 5 running (control.sock), 5 in roster.json
roster.json: updated 77s ago
daemon.log: 8.8KB at /Users/imreoolberg/.claude/daemon.log

holding this daemon open:
5 bg workers running (daemon waits for them to settle)

to let it idle-exit: wait for (or cancel) bg workers and close any `claude agents`
imreoolberg@Imres-MacBook-Air cc-local %
</pre>

====Playwright kasutamine====

Playwright võimaldab nö visuaalset kontakti veebirakendusega (ehk natuke sarnane Selenium lahendusega).

<pre>
imreoolberg@Imres-MacBook-Air ~ % mkdir ~/playwright-mcp
imreoolberg@Imres-MacBook-Air ~ % cd ~/playwright-mcp
imreoolberg@Imres-MacBook-Air playwright-mcp % npm init -y
imreoolberg@Imres-MacBook-Air playwright-mcp % npm install playwright
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright install chromium
imreoolberg@Imres-MacBook-Air playwright-mcp % npm install -D @playwright/test
</pre>

Sessiooni salvestamine

<pre>
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright codegen -o my-jenkins-flow.spec.js https://jenkins.auul.pri.ee/
</pre>

Ja taasesitamine

<pre>
imreoolberg@Imres-MacBook-Air playwright-mcp % npx playwright test --headed my-jenkins-flow.spec.js
</pre>

Teine võimalik kasutusala on Claude Code CLI programmile öelda nt, et palun tekita kolm kasutajat aadressile https://gitlab.auul.pri.ee/

CCC juurest kasutamiseks sobib mcp

<pre>
$ claude mcp add playwright -- npx -y @playwright/mcp@latest
</pre>

====Kasutamine====

Uue teemaga algamine

<pre>
imreoolberg@Imres-MacBook-Air ~ % export PATH="$HOME/.local/node/bin:$PATH"
imreoolberg@Imres-MacBook-Air ~ % mkdir cc-moraal-mail
imreoolberg@Imres-MacBook-Air ~ % cd cc-moraal-mail
imreoolberg@Imres-MacBook-Air cc-moraal-mail % CLAUDE_CONFIG_DIR=~/.claude-cc-moraal-mail claude
</pre>

kus

* ~/cc-moraal-mail - working directory
* /.claude-cc-moraal-mail - memory and stuff

===Temp===

<pre>
imreoolberg@Imres-MacBook-Air ~ % ls -ld .claude-cc-*/projects/-Users-imreoolberg-cc-*/memory/MEMORY.md
-rw-r--r--@ 1 imreoolberg staff 543 Sep 10 00:30 .claude-cc-crm/projects/-Users-imreoolberg-cc-crm/memory/MEMORY.md
-rw-r--r--@ 1 imreoolberg staff 677 Sep 16 21:18 .claude-cc-moraal-devops/projects/-Users-imreoolberg-cc-moraal-devops/memory/MEMORY.md
-rw-r--r--@ 1 imreoolberg staff 1526 Sep 5 09:29 .claude-cc-moraal-mail/projects/-Users-imreoolberg-cc-moraal-mail/memory/MEMORY.md
-rw-r--r--@ 1 imreoolberg staff 533 Aug 30 20:20 .claude-cc-npl-dns/projects/-Users-imreoolberg-cc-npl-dns/memory/MEMORY.md
-rw-r--r--@ 1 imreoolberg staff 449 Sep 1 12:27 .claude-cc-npl-samba-fs/projects/-Users-imreoolberg-cc-npl-samba-fs/memory/MEMORY.md

imreoolberg@Imres-MacBook-Air ~ % ls -ld cc-*
drwxr-xr-x@ 3 imreoolberg staff 96 Sep 9 13:25 cc-crm
drwxr-xr-x@ 4 imreoolberg staff 128 Jul 26 11:42 cc-lllm
drwxr-xr-x@ 19 imreoolberg staff 608 Sep 4 08:42 cc-local
drwxr-xr-x@ 8 imreoolberg staff 256 Sep 16 21:20 cc-moraal-devops
drwxr-xr-x@ 7 imreoolberg staff 224 Sep 6 12:18 cc-moraal-mail
drwxr-xr-x@ 5 imreoolberg staff 160 Aug 29 22:00 cc-npl-dns
drwxr-xr-x@ 5 imreoolberg staff 160 Sep 1 12:35 cc-npl-samba-fs
drwxr-xr-x@ 4 imreoolberg staff 128 Jul 26 11:42 cc-ollama
drwxr-xr-x@ 4 imreoolberg staff 128 Jul 22 10:06 cc-tarmo

imreoolberg@Imres-MacBook-Air ~ % cd cc-moraal-devops
imreoolberg@Imres-MacBook-Air cc-moraal-devops % pwd
/Users/imreoolberg/cc-moraal-devops
imreoolberg@Imres-MacBook-Air cc-moraal-devops % CLAUDE_CONFIG_DIR=~/.claude-cc-moraal-devops claude --continue
</pre>

===Kasulikud lisamaterjalid===

* https://www.auul.pri.ee/wiki/LiteLLM