18

How can you disable Gatekeeper via Terminal Commands in OS X 10.8 Mountain Lion? I am looking to replicate the Security & Privacy preference pane selection to allow applications downloaded from Anywhere to run:

enter image description here

By having a terminal command, I can write a script to do this task remotely rather than manually going to each Mac and changing these settings with a mouse and several clicks.

Improve this question

4 Answers 4

Reset to default
22

The spctl tool should do the job.

sudo spctl --master-disable will turn off the Gatekeeper checks, and sudo spctl --master-enable will re-enable them (to the default setting of App Store and signed apps — it doesn't appear that setting it to App Store-only is possible).

Note that it will not throw any error if you run it without sudo permissions, but sudo is in fact required.

Improve this answer
5
  • 1
    The man page says that spctl --disable --label "Mac App Store" Will disable installation of all Mac App Store Apps, so it would seem possible that it could --enable only M.A.S. apps.
    – Megan Walker
    Dec 20, 2012 at 1:23
  • @SamuelWalker I didn't notice that before, but what would really be required is a rule or label that's equivalent to all non-App Store apps. Otherwise it's moot, as you can't disable all other sources independently from what I can tell.
    – robmathers
    Dec 20, 2012 at 1:29
  • That's true. I've just looked in the actual SystemPolicy Database, and from what I can tell there's only a few labels that it uses. "GKE","Developer ID", "Mac App Store", "Apple System", "Apple Installer", "No Matching Rule". Although as these Strings are arbitrary [And may change in future OSX versions] this may be too hacky, but it seems possible that you could manually disable GKE and Developer ID.
    – Megan Walker
    Dec 20, 2012 at 1:45
  • @robmathers, thanks for your response! I learned another work-around: you can right click the installer and click open (which will open the app w/o checking w/ gatekeeper)
    – Brian McCarthy
    Dec 20, 2012 at 13:25
  • Yeah, that's definitely the easier way if you just need to run some something on a one-off basis.
    – robmathers
    Dec 20, 2012 at 17:43
4 
sudo spctl --master-disable

See the man page for spctl

Improve this answer
3

Either of these also disables the Gatekeeper dialogs (after restarting), but they don't change the setting shown in System Preferences.

sudo defaults write /var/db/SystemPolicy-prefs.plist enabled -string no
defaults write com.apple.LaunchServices LSQuarantine -bool false

I don't know if spctl --master-disable is somehow different from disabling Gatekeeper from System Preferences, but spctl --status changes to assessments disabled after disabling Gatekeeper in System Preferences.

Improve this answer
1

Update:

  • To disable Gatekeeper, use the command sudo spctl --global-disable.
  • To re-enable Gatekeeper, use the command sudo spctl --global-enable.

The command spctl --master-disable is no longer supported. This change was introduced in MacOS v10.15.7 (last version of Catalina).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .