CyberStack

Guides / Terminal on a sealed Mac

macOS commands

Most Linux file commands work here as BSD variants. open, pbcopy, defaults, diskutil, and SIP are the Mac-specific surface. Do not disable SIP to clear a hurdle.

macOS commands: files, SIP/perms, processmacOS Terminal shares Unix file and process habits with Linux, plus Mac-native bridges and System Integrity Protection.SIPRUNPATHFilesls · open · tarSIPSIP / Permschmod · csrutilPIDProcessps · ActivityTERMINAL ON A SEALED MACBSD cousins of the Linux verbs. open and pbcopy bridge GUI. SIP stays on.csrutil status — do not disable SIP to clear a hurdle.

macOS Terminal is a Unix shell on an Apple desktop. ls, cd, cp, mv, rm, cat, less, tar, ps, and kill behave like their Linux cousins, with BSD flag differences you will meet in man pages. This page covers the shared domains and the Mac-specific tools you actually use day to day.

First principles

System Integrity Protection (SIP) keeps critical system paths honest. csrutil status reports it; do not disable SIP to make software install. Prefer signed apps, notarised packages, and Homebrew under your home prefix for optional CLI tools. Permissions still matter: chmod and chown work, and TCC privacy prompts gate camera, mic, and Full Disk Access for apps — including Terminal helpers you grant.

Navigate and move files

pwd
ls -la
cd ~/Documents
cp -R src/ dest/
mv oldname newname
rm file.txt
cat notes.txt
less /var/log/system.log
du -sh *
df -h
open .
open -a "TextEdit" notes.txt

open launches Finder on a directory, or the default app for a file. open -a names the application. That is the Mac-native jump from shell to GUI. BSD cp uses -R for recursive; GNU users reaching for -a will want man cp on this host.

Clipboard, defaults, Homebrew

pbcopy < notes.txt
pbpaste > out.txt
defaults read com.apple.dock
# Homebrew (common optional package path — install only from the official site)
brew install jq
brew update && brew upgrade

pbcopy and pbpaste bridge shell and clipboard. defaults reads and writes preference domains — change only keys you understand; a bad write can unset a UI you rely on. Homebrew is not part of macOS; it is the usual path for extra CLI tools when the system package set is not enough.

Permissions and SIP

ls -l file
chmod 644 file
chown $(whoami):staff file
csrutil status
diskutil list
diskutil info /

Same octal story as Linux: 644 files, 755 dirs and scripts, never 777 on shared paths. csrutil status should show SIP enabled on a normal Mac. diskutil is the disk and volume tool — list, info, and verified eject — not a casual erase utility.

Processes

ps aux | less
top
kill PID
killall AppName

Activity Monitor is the GUI peer to top and ps. killall matches by process name — be precise; a broad name hits more than one process. Prefer Activity Monitor when you are unsure which PID is which.

House rules

  • Do not disable SIP to clear an install or permission problem. Fix the package path or the TCC grant instead.
  • rm and rm -R are permanent here too. Prefer moving to Trash from Finder, or open a directory and delete in the GUI when you are unsure.
  • defaults write without a backup of the domain is how a preference vanishes. Read first, write second.
  • Homebrew under your user is yours to keep updated. System directories under SIP are not a dumping ground for unsigned binaries.

Informed by Apple — Terminal User Guide.