4

So I made a really stupid mistake and while trying to delete a gatekeeper rule from the command line I managed to delete all of them.

Command I ran

spctl --remove

New Output of List

Nathaniels-MacBook-Pro:~ nathanielsuchy$ spctl --list
error: no matches for search or update operation

Before it had a ton of rules. How do I reset gatekeeper to factory defaults?

3

Luckily for me I knew how to read the man pages. From that I found a default copy was at /var/db/SystemPolicy-default and was able to copy it to the normal system policy location

Command To Run:

Nathaniels-MacBook-Pro:~ nathanielsuchy$ sudo cp /var/db/.SystemPolicy-default /var/db/SystemPolicy

From the Man Pages

FILES
     /var/db/SystemPolicy  The system policy database.
     /var/db/.SystemPolicy-default
                           A copy of the initial distribution version of the
                           system policy database.  Useful for starting over
                           if the database gets messed up beyond recognition.

The developers included a default copy to ensure that if you mess up the database, you can simply copy the default database to the database location, reboot, and be ready to roll.

However there is an even easier way to do this, it's also the recommended way. See the man pages:

 --reset-default
          Unconditionally reset the system policy database to its default
          value. This discards all changes made by administrators. It also
          heals any corruption to the database. It does not implicitly
          either enable or disable the facility. This must be done as the
          super user. Reboot after use.

Just run:

sudo spctl --reset-default

and then reboot your Mac and everything will be back to normal.

Fixed Output: system enabled with default rules again

Now everything's back to normal: screenshot of blocked execution As shown I cannot install any new apps that are not from the App Store. While the gatekeeper system is disabled or if it has no rules, I can load the app without an issue. Thought disabling gatekeeper isn't recommended from a security context, it's better to grant exemptions to trusted and verified apps that are not signed, though the best and most security friendly way to do things is to sign your apps without an exeception.

In the future always be careful when adjusting gatekeeper rules though I'm glad there's a simple way to reset it back to the default set of rules. It could of been a lot worse without a copy of the default rule set.

  • 1
    Thank you for sharing this but it seems like this does not really work, at least in Sierra. I tried both (--reset-default and replacing the file) but either way the applications that I approved before can still be run. This is not really a reset then I suppose. Any idea why this is? – Jan Aug 22 '17 at 9:12
  • @Jan Hey are you still having this problem? – Nathaniel Suchy Jan 23 '18 at 18:03
  • Didn't work. Tried on macOS Mojave. As @Jan notes, macOS just opens an app that I previously approved, even after doing sudo spctl --reset-default + restart. – Jonny Sep 10 at 7:33
  • @Jonny I've only tested on macOS Sierra and High Sierra. The manpages states: " --reset-default Unconditionally reset the system policy database to its default value. This discards all changes made by administrators. It also heals any corruption to the database. It does not implicitly either enable or disable the facility. This must be done as the super user. Reboot after use." Have you tried sudo reboot perhaps they need that type of reboot? – Nathaniel Suchy Sep 11 at 22:44
  • @Jonny Alternatively try sudo cp /var/db/.SystemPolicy-default /var/db/SystemPolicy && sudo reboot and see if that works. – Nathaniel Suchy Sep 11 at 22:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .