Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

macOS Lockdown (mOSL)

Shellcheck GitHub Release

Bash script to audit and fix macOS Catalina (10.15.x) security settings

Inspired by and based on Lockdown by Patrick Wardle and osxlockdown by Scott Piper.


mOSL is being rewritten in Swift and the Bash version will be deprecated.. See: "The Future of mOSL".

  • Always run the latest release not the code in master!
  • This script will only ever support the latest macOS release
  • This script requires your password to invoke some commands with sudo


tap: 0xmachos/homebrew-mosl

To install mOSL via brew execute:

brew tap 0xmachos/homebrew-mosl
brew install mosl

mOSL will then be available as:


Threat Model(ish)

The main goal is to enforce already secure defaults and apply more strict non-default options.

It aims to reduce attack surface but it is pragmatic in this pursuit. The author utilises Bluetooth for services such as Handoff so it is left enabled.

There is no specific focus on enhancing privacy.

Finally, mOSL will not protect you from the FSB, MSS, DGSE, or FSM.

Full Disk Access Permission

In macOS Mojave and later certain application data is protected by the OS. For example, if wishes to access data must be given explicit permission via System Preferences > Security & Privacy > Privacy. However some application data cannot be accessed via a specific permission. Access to this data requires the Full Disk Access permission.

mOSL requires that be given the Full Disk Access permission. It needs this permission to audit/fix the following settings:

  • disable mail remote content
  • disable_auto_open_safe_downloads

These are currently the only settings which require Full Disk Access.

It is not possible to programatically get or prompt for this permission, it must be manually given by the user.

To give Full Disk Access:

System Preferences > Security & Privacy > Privacy > Full Disk Access > Add

Once you are done with mOSL you can revoke Full Disk Access for There's a small checkbox next to Terminal which you can uncheck to revoke the premssion without entirely removing from the list.

More info on macOS's new permission model:


The executable Lockdown file can be verified with Minisign:

minisign -Vm Lockdown -P RWTiYbJbLl7q6uQ70l1XCvGExizUgEBNDPH0m/1yMimcsfgh542+RDPU

Install via brew: brew install minisign


$ ./Lockdown 

  Audit or Fix macOS security settings🔒🍎

  Usage: ./Lockdown [list | audit {setting_index} | fix {setting_index} | debug]

    list         - List settings that can be audited/ fixed
    audit        - Audit the status of all or chosen setting(s) (Does NOT change settings)
    fix          - Attempt to fix all or chosen setting(s) (Does change settings)

    fix-force    - Same as 'fix' however bypasses user confirmation prompt
                   (Can be used to invoke Lockdown from other scripts)

    debug        - Print debug info for troubleshooting


See for a easy to read list of commands used to audit/ fix the below settings.

Settings that can be audited/ fixed:

  [0] enable automatic system updates
  [1] enable automatic app store updates
  [2] enable gatekeeper
  [3] enable firewall
  [4] enable admin password preferences
  [5] enable terminal secure entry
  [6] enable sip
  [7] enable filevault
  [8] disable firewall builin software
  [9] disable firewall downloaded signed
  [10] disable ipv6
  [11] disable mail remote content
  [12] disable remote apple events
  [13] disable remote login
  [14] disable auto open safe downloads
  [15] set airdrop contacts only
  [16] set appstore update check daily
  [17] set firmware password
  [18] check kext loading consent
  [19] check efi integrity
  [20] check if standard user


Bash script to audit and fix macOS Catalina (10.15.x) security settings




Security policy