1

I've been trying to setup launchd to block several websites on OS X 10.11.6

The /etc/hosts list is changed on schedule but a browser can still access the blocked sites.

Another strange behavior is that launchd seems to execute the commands when I load the plist, but does not execute the commands during the scheduled time.

Some googling suggested that I might need to reset the DNS cache:

sudo dscacheutil -flushcache;sudo killall -HUP mDNSResponder

When I run that from the command line I can still access the sites that should be blocked. I don't know how to add this to the launchd plist program arguments either if it were to work.

$ cat /Library/LaunchDaemons/local.hosts.blockingAM.plist

<?xml version="1.0" encoding="UTF-8"?>  
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">  
<plist version="1.0">  
<dict>  
    <key>Label</key>  
    <string>local.hosts.blockingAM</string>  
    <key>ProgramArguments</key>  
    <array>  
        <string>cp</string>  
        <string>/etc/hosts_BLOCKED_sites.txt</string>  
        <string>/etc/hosts</string>  
    </array>  
    <key>RunAtLoad</key>  
    <true/>  
    <key>StartCalendarInterval</key>  
    <array>  
        <dict>  
            <key>Hour</key>  
            <integer>8</integer>  
            <key>Minute</key>  
            <integer>15</integer>  
            <key>Weekday</key>  
            <integer>1</integer>  
        </dict>  
        <dict>  
            <key>Hour</key>  
            <integer>8</integer>  
            <key>Minute</key>  
            <integer>15</integer>  
            <key>Weekday</key>  
            <integer>2</integer>  
        </dict>  
        <dict>  
            <key>Hour</key>  
            <integer>9</integer>  
            <key>Minute</key>  
            <integer>35</integer>  
            <key>Weekday</key>  
            <integer>3</integer>  
        </dict>  
        <dict>  
            <key>Hour</key>  
            <integer>8</integer>  
            <key>Minute</key>  
            <integer>15</integer>  
            <key>Weekday</key>  
            <integer>4</integer>  
        </dict>  
        <dict>  
            <key>Hour</key>  
            <integer>8</integer>  
            <key>Minute</key>  
            <integer>15</integer>  
            <key>Weekday</key>  
            <integer>5</integer>  
        </dict>  
    </array>  

    <key>StandardErrorPath</key>  
    <string>/tmp/local.hosts.blocking.err</string>                                                           
    <key>StandardOutPath</key>   
    <string>/tmp/local.hosts.blocking.out</string>    
    </dict>  
    </plist>  

Here are the permissions:
$ ls -la /Library/LaunchDaemons/local.hosts.blockingAM.plist

-rw-r--r--@ 1 root  wheel  1474 Sep  8 09:33 /Library/LaunchDaemons/local.hosts.blockingAM.plist

I load up the plist with:

$ sudo launchctl load /Library/LaunchDaemons/local.hosts.blockingAM.plist   

There are no errors recorded:
$ cat /tmp/local.hosts.blocking.err

Here is the file containing blocked sites:
$ cat /etc/hosts_BLOCKED_sites.txt

##  
# Host Database  
#  
# localhost is used to configure the loopback interface  
# when the system is booting.  Do not change this entry.  
##  
127.0.0.1   localhost  
255.255.255.255 broadcasthost  
::1             localhost   


# Blocked sites redirected to 0.0.0.0  
0.0.0.0 reddit.com www.reddit.com  
0.0.0.0 facebook.com www.facebook.com  

What am I doing wrong?

  • 1
    Is the browser using a proxy? (Then your hosts file won't matter.) Does the hosts file have world-readable permissions (0644)? Is the hosts file a symbolic link? Does the hosts file contain CRLF, and not just LF line endings? Off topic, but related, dnsmasq is awesome for domain banning, even wildcard banning. – Christopher Sep 12 '16 at 15:27
  • Original settings: -rw------- 1 root wheel 567 Sep 12 09:05 /etc/hosts – BryanWheelock Sep 12 '16 at 16:46
  • Changed too: -rw-r--r-- 1 root wheel 274 Sep 12 12:44 /etc/hosts – BryanWheelock Sep 12 '16 at 16:46
  • I ran sudo dscacheutil -flushcache;sudo killall -HUP mDNSResponder and I can still access the blocked sites. – BryanWheelock Sep 12 '16 at 16:47
  • The browser should not be using a proxy, I never set that up. – BryanWheelock Sep 12 '16 at 16:47
1

Have you actually checked your /etc/hosts to be certain that it's being modified? As a test, I dropped 127.0.0.1 foo.com www.foo.com into my /etc/hosts and tried loading the site; it immediately went to localhost as expected. You might not be doing anything wrong with the /etc/hosts code at all; however, there's a good chance the changes you are requesting are never making their way into the file in the first place.

I'd also try mv instead of cp. mv won't change file permissions, it just unlinks the target and renames the source: so you'll need to remember to swap first (e.g. mv /etc/hosts /etc/hosts_default && mv /etc/hosts_BLOCKED_sites.txt /etc/hosts, reverse the order when you want to unblock, remember to flush DNS cache after each change, and ensure that /etc/hosts_BLOCKED_sites.txt has the same permissions/ownership as /etc/hosts before starting)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .