0

I know about <command> <l>, pkgutil --files, and lsbom. I know also that installer packages are really a XAR archive.

What I do not know yet, is that whether running a .pkg installer packages guarantees that all the files produced as a result of running it will be tracked?

For instance, when a .pkg installer package ran some arbitrary scripts, will the files be tracked by macOS? I tried searching and there does not seems to be any official documentation on this.

Some unofficial guides:

https://matthew-brett.github.io/docosx/flat_packages.html

http://s.sudre.free.fr/Stuff/Ivanhoe/FLAT.html

Although not explicitly mentioned, these guides seems to be indicating that the files won't be tracked, is this correct?

Also, are there any official answer on this?

5
  • 1
    What do you mean by tracked?
    – mmmmmm
    Jun 16, 2021 at 12:45
  • 1
    @mmmmmm IF it is tracked, it should be possible to generate a list of all the files produced as a result of running the installer. ( note: Including scripts! )
    – ed9w2in6
    Jun 16, 2021 at 12:50
  • 1
    Again what do you mean by tracked?
    – mmmmmm
    Jun 16, 2021 at 13:05
  • @mmmmmm I am not an expert on macOS. I do not know how files are tracked, may that be via any API or daemon. I do not want to define the word tracked, so I described it agnostic to the actual operation, but rather stating what I hope to achieve as a result, just like in formal methods. I hope you can understand what I meant without me describing how macOS does things, which I cannot do so, since if I know how it does, I would not be asking this question.
    – ed9w2in6
    Jun 16, 2021 at 17:21
  • 2
    If you can't tell us what you mean by "tracked", can you rewrite the question to use a different word that you can explain? I don't really know what you're asking otherwise...
    – Cody
    Jun 16, 2021 at 18:24

2 Answers 2

2

There is no official answer, because it is not a feature offered by macOS's Installer. Most packages are digitally signed; if problems are found, the signing organisation can be contacted and held responsible.

Installer

Files created or modified by scripts within a package are not tracked. macOS's installer does not record or monitor the true impact of the package on the destination.

You may be looking for a File Alteration Monitor.

FSEvents and kqueue

For macOS computer wide file system change notifications, see FSEvents.

macOS's built-in fs_usage reports system calls and page faults related to filesystem activity in real-time:

 sudo fs_usage -f filesys

See 10.4: Monitor file system events in real time:

OS X 10.4 has a private API that's used by Spotlight to monitor file system events such as file creation, renaming, and permission changes. Several command line and GUI tools are now available that can suscribe to the event notification system and provide a log of the events. These are useful for, e.g., monitoring files created by installers, and so forth.

FSEvents on macOS are implemented using BSD's kqueue:

Kqueue not only handles file descriptor events but is also used for various other notifications such as file modification monitoring, signals, asynchronous I/O events (AIO), child process state change monitoring, and timers which support nanosecond resolution, furthermore kqueue provides a way to use user-defined events in addition to the ones provided by the kernel.

2
  • They will be tracked and accessible via fsevents API
    – mmmmmm
    Jun 16, 2021 at 14:47
  • @mmmmmm Interesting, I looked into fsevents and it seems to do what I was looking for. If you write up an answer on this, I will accept it. If you don't I can write up one myself, after I read more into it on my own.
    – ed9w2in6
    Jun 16, 2021 at 17:28
1

The issue is what do you mean by track.

At the file system level macOS does track any file changes however this is not saved for all time. Files directly installed by the installer will have metadata set on them saying which package installed them in. You can also use pkgutil to see what files the package says it will install. As in the other answer you can run installer ti install the package and it will log these chnages.

However if the installer runs a script or executable that creates files then the last few methods will not pick this up.

There is an API that can see all the file changes https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/FSEvents_ProgGuide/UsingtheFSEventsFramework/UsingtheFSEventsFramework.html. (yes it is in archive but Apple's new documantation does not have overviews and I think is still up to date). Thus you can write an application to see what files the installer changes.

I have not used this API or used any tool to view the events.

But I think you always need to register watching before you run the installer. There do exist many language libraries with example simple apps e.g. python and also full applications that use this API and provide a user GUI to see the changes.

This webpage suggest you can see then using Finder. I think Instruments.app in Xcode can also do this

The stand alone application examples I found or was pointed to are paid applications are https://fsmonitor.com/ and https://rixstep.com/4/0/tracker/

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .