Tutorial

Configuring Keyboard Settings on Mac Devices

Managing keyboard settings consistently across a Mac fleet is essential for maintaining productivity and user experience standards. This comprehensive guide provides shell scripts and techniques to configure various keyboard settings on macOS devices, including key repeat rates, delays, keyboard navigation, and auto-correct features.

Understanding Mac Keyboard Settings

macOS provides several keyboard configuration options that can significantly impact user productivity and comfort:

Key Repeat Rate

The speed at which a character is repeatedly registered when a key is held down. A higher rate means faster character repetition.

Delay Until Repeat

The amount of time the keyboard waits before starting to repeat a key when held down. A shorter delay means repetition begins sooner.

Keyboard Navigation

Allows users to navigate interface elements using the keyboard instead of mouse clicks, improving accessibility and workflow efficiency.

Auto-Correct

Automatically corrects misspelled words as you type, which can be helpful or disruptive depending on user preferences and use cases.

Prerequisites

Before configuring keyboard settings, ensure you have:

• Administrative privileges on the Mac
• Terminal or SSH access
• Understanding of user context requirements
• Backup of current settings (recommended)

Basic Keyboard Configuration Commands

Understanding the Configuration Tools

Mac keyboard settings are managed through several system components:

• defaults: Command-line interface to user defaults system
• launchctl: Interface to launchd for running commands in user context
• NSGlobalDomain: Domain for system-wide settings
• User context: Settings must be applied in the correct user session

Current User Detection

Most keyboard settings require user context. Here's how to detect the current user:

#!/bin/bash

# Get current console user
get_current_user() {
    local current_user=$(ls -l /dev/console | awk '/ / { print $3 }')
    echo "$current_user"
}

# Get user ID
get_user_id() {
    local username=$1
    local user_id=$(id -u "$username")
    echo "$user_id"
}

# Example usage
current_user=$(get_current_user)
user_id=$(get_user_id "$current_user")

echo "Current user: $current_user"
echo "User ID: $user_id"

Key Repeat Rate Configuration

Basic Key Repeat Rate Script

Configure the speed of key repetition:

#!/bin/bash

# Configure key repeat rate
# Values: 1-15 (1 = fastest, 15 = slowest)
KEY_REPEAT_RATE=2

echo "Configuring key repeat rate to: $KEY_REPEAT_RATE"

# Get current user and user ID
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

# Apply setting in user context
if launchctl asuser $CurrentUserUID sudo -iu "$CurrentUser" defaults write -g KeyRepeat -int $KEY_REPEAT_RATE; then
    echo "✓ Key repeat rate set successfully"
else
    echo "✗ Failed to set key repeat rate"
    exit 1
fi

echo "Changes will take effect after user logout/login"

Advanced Key Repeat Rate Script

More comprehensive script with validation and logging:

#!/bin/bash

# Advanced key repeat rate configuration script
LOG_FILE="/var/log/keyboard_settings.log"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# Function to log messages
log_message() {
    echo "[$TIMESTAMP] $1" | tee -a "$LOG_FILE"
}

# Function to validate key repeat rate
validate_key_repeat_rate() {
    local rate=$1
    
    if [[ ! "$rate" =~ ^[0-9]+$ ]]; then
        log_message "ERROR: Key repeat rate must be a number"
        return 1
    fi
    
    if [ "$rate" -lt 1 ] || [ "$rate" -gt 15 ]; then
        log_message "ERROR: Key repeat rate must be between 1-15"
        return 1
    fi
    
    return 0
}

# Function to get current key repeat rate
get_current_key_repeat_rate() {
    local current_user=$1
    local current_uid=$2
    
    local current_rate=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read -g KeyRepeat 2>/dev/null)
    
    if [ -n "$current_rate" ]; then
        echo "$current_rate"
    else
        echo "Not set"
    fi
}

# Function to set key repeat rate
set_key_repeat_rate() {
    local rate=$1
    local current_user=$2
    local current_uid=$3
    
    log_message "Setting key repeat rate to: $rate for user: $current_user"
    
    # Get current setting
    local current_rate=$(get_current_key_repeat_rate "$current_user" "$current_uid")
    log_message "Current key repeat rate: $current_rate"
    
    # Apply new setting
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write -g KeyRepeat -int $rate; then
        log_message "SUCCESS: Key repeat rate set to $rate"
        
        # Verify setting
        local new_rate=$(get_current_key_repeat_rate "$current_user" "$current_uid")
        log_message "Verified new key repeat rate: $new_rate"
        
        return 0
    else
        log_message "ERROR: Failed to set key repeat rate"
        return 1
    fi
}

# Main execution
KEY_REPEAT_RATE=${1:-2}  # Default to 2 if not specified

log_message "Starting key repeat rate configuration"

# Validate input
if ! validate_key_repeat_rate "$KEY_REPEAT_RATE"; then
    log_message "Invalid key repeat rate: $KEY_REPEAT_RATE"
    exit 1
fi

# Get current user
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

if [ -z "$CurrentUser" ] || [ "$CurrentUser" = "root" ]; then
    log_message "ERROR: No valid user session found"
    exit 1
fi

log_message "Current user: $CurrentUser (UID: $CurrentUserUID)"

# Set key repeat rate
if set_key_repeat_rate "$KEY_REPEAT_RATE" "$CurrentUser" "$CurrentUserUID"; then
    log_message "Key repeat rate configuration completed successfully"
else
    log_message "Key repeat rate configuration failed"
    exit 1
fi

log_message "Note: Changes will take effect after user logout/login"

Delay Until Repeat Configuration

Basic Delay Script

Configure the delay before key repetition begins:

#!/bin/bash

# Configure delay until repeat
# Values: 0-3 (0 = shortest delay, 3 = longest delay)
KEY_DELAY=1

echo "Configuring delay until repeat to: $KEY_DELAY"

# Get current user and user ID
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

# Apply setting in user context
if launchctl asuser $CurrentUserUID sudo -iu "$CurrentUser" defaults write -g InitialKeyRepeat -int $KEY_DELAY; then
    echo "✓ Delay until repeat set successfully"
else
    echo "✗ Failed to set delay until repeat"
    exit 1
fi

echo "Changes will take effect after user logout/login"

Advanced Delay Configuration Script

Comprehensive script with validation and multiple user support:

#!/bin/bash

# Advanced delay until repeat configuration script
LOG_FILE="/var/log/keyboard_settings.log"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# Function to log messages
log_message() {
    echo "[$TIMESTAMP] $1" | tee -a "$LOG_FILE"
}

# Function to validate delay value
validate_delay() {
    local delay=$1
    
    if [[ ! "$delay" =~ ^[0-9]+$ ]]; then
        log_message "ERROR: Delay must be a number"
        return 1
    fi
    
    if [ "$delay" -lt 0 ] || [ "$delay" -gt 3 ]; then
        log_message "ERROR: Delay must be between 0-3"
        return 1
    fi
    
    return 0
}

# Function to get current delay setting
get_current_delay() {
    local current_user=$1
    local current_uid=$2
    
    local current_delay=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read -g InitialKeyRepeat 2>/dev/null)
    
    if [ -n "$current_delay" ]; then
        echo "$current_delay"
    else
        echo "Not set"
    fi
}

# Function to set delay until repeat
set_delay_until_repeat() {
    local delay=$1
    local current_user=$2
    local current_uid=$3
    
    log_message "Setting delay until repeat to: $delay for user: $current_user"
    
    # Get current setting
    local current_delay=$(get_current_delay "$current_user" "$current_uid")
    log_message "Current delay until repeat: $current_delay"
    
    # Apply new setting
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write -g InitialKeyRepeat -int $delay; then
        log_message "SUCCESS: Delay until repeat set to $delay"
        
        # Verify setting
        local new_delay=$(get_current_delay "$current_user" "$current_uid")
        log_message "Verified new delay until repeat: $new_delay"
        
        return 0
    else
        log_message "ERROR: Failed to set delay until repeat"
        return 1
    fi
}

# Main execution
KEY_DELAY=${1:-1}  # Default to 1 if not specified

log_message "Starting delay until repeat configuration"

# Validate input
if ! validate_delay "$KEY_DELAY"; then
    log_message "Invalid delay value: $KEY_DELAY"
    exit 1
fi

# Get current user
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

if [ -z "$CurrentUser" ] || [ "$CurrentUser" = "root" ]; then
    log_message "ERROR: No valid user session found"
    exit 1
fi

log_message "Current user: $CurrentUser (UID: $CurrentUserUID)"

# Set delay until repeat
if set_delay_until_repeat "$KEY_DELAY" "$CurrentUser" "$CurrentUserUID"; then
    log_message "Delay until repeat configuration completed successfully"
else
    log_message "Delay until repeat configuration failed"
    exit 1
fi

log_message "Note: Changes will take effect after user logout/login"

Keyboard Navigation Configuration

Basic Keyboard Navigation Script

Enable keyboard navigation for better accessibility:

#!/bin/bash

# Enable keyboard navigation
echo "Enabling keyboard navigation..."

# Get current user and user ID
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

# Enable keyboard navigation (3 = full keyboard access)
if launchctl asuser $CurrentUserUID sudo -iu "$CurrentUser" defaults write NSGlobalDomain AppleKeyboardUIMode -int 3; then
    echo "✓ Keyboard navigation enabled successfully"
else
    echo "✗ Failed to enable keyboard navigation"
    exit 1
fi

echo "Keyboard navigation is now enabled"
echo "Note: This feature requires macOS 13.0 or later"

Advanced Keyboard Navigation Script

Comprehensive script with version checking and configuration options:

#!/bin/bash

# Advanced keyboard navigation configuration script
LOG_FILE="/var/log/keyboard_settings.log"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# Function to log messages
log_message() {
    echo "[$TIMESTAMP] $1" | tee -a "$LOG_FILE"
}

# Function to check macOS version
check_macos_version() {
    local version=$(sw_vers -productVersion)
    local major_version=$(echo "$version" | cut -d. -f1)
    
    log_message "macOS version: $version"
    
    if [ "$major_version" -ge 13 ]; then
        log_message "macOS version is compatible with keyboard navigation"
        return 0
    else
        log_message "WARNING: macOS version may not fully support keyboard navigation"
        return 1
    fi
}

# Function to get current keyboard navigation setting
get_keyboard_navigation_status() {
    local current_user=$1
    local current_uid=$2
    
    local current_setting=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read NSGlobalDomain AppleKeyboardUIMode 2>/dev/null)
    
    if [ -n "$current_setting" ]; then
        case "$current_setting" in
            0) echo "Disabled (text boxes and lists only)" ;;
            1) echo "Enabled (text boxes and lists only)" ;;
            2) echo "Enabled (controls when Tab key is pressed)" ;;
            3) echo "Enabled (all controls)" ;;
            *) echo "Unknown ($current_setting)" ;;
        esac
    else
        echo "Not set (default)"
    fi
}

# Function to set keyboard navigation
set_keyboard_navigation() {
    local mode=$1
    local current_user=$2
    local current_uid=$3
    
    log_message "Setting keyboard navigation mode to: $mode for user: $current_user"
    
    # Get current setting
    local current_status=$(get_keyboard_navigation_status "$current_user" "$current_uid")
    log_message "Current keyboard navigation: $current_status"
    
    # Apply new setting
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain AppleKeyboardUIMode -int $mode; then
        log_message "SUCCESS: Keyboard navigation set to mode $mode"
        
        # Verify setting
        local new_status=$(get_keyboard_navigation_status "$current_user" "$current_uid")
        log_message "Verified new keyboard navigation: $new_status"
        
        return 0
    else
        log_message "ERROR: Failed to set keyboard navigation"
        return 1
    fi
}

# Main execution
KEYBOARD_MODE=${1:-3}  # Default to 3 (full keyboard access) if not specified

log_message "Starting keyboard navigation configuration"

# Check macOS version
check_macos_version

# Validate mode
if [[ ! "$KEYBOARD_MODE" =~ ^[0-3]$ ]]; then
    log_message "ERROR: Invalid keyboard mode: $KEYBOARD_MODE (must be 0-3)"
    exit 1
fi

# Get current user
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

if [ -z "$CurrentUser" ] || [ "$CurrentUser" = "root" ]; then
    log_message "ERROR: No valid user session found"
    exit 1
fi

log_message "Current user: $CurrentUser (UID: $CurrentUserUID)"

# Set keyboard navigation
if set_keyboard_navigation "$KEYBOARD_MODE" "$CurrentUser" "$CurrentUserUID"; then
    log_message "Keyboard navigation configuration completed successfully"
else
    log_message "Keyboard navigation configuration failed"
    exit 1
fi

log_message "Keyboard navigation is now configured"

Auto-Correct Configuration

Basic Auto-Correct Disable Script

Disable automatic spelling correction:

#!/bin/bash

# Disable auto-correct
echo "Disabling auto-correct..."

# Get current user and user ID
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

# Disable auto-correct
if launchctl asuser $CurrentUserUID sudo -iu "$CurrentUser" defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -bool false; then
    echo "✓ Auto-correct disabled successfully"
else
    echo "✗ Failed to disable auto-correct"
    exit 1
fi

echo "Auto-correct is now disabled"
echo "Note: Changes will take effect after user logout/login"

Advanced Auto-Correct Management Script

Comprehensive script for managing various auto-correct features:

#!/bin/bash

# Advanced auto-correct configuration script
LOG_FILE="/var/log/keyboard_settings.log"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# Function to log messages
log_message() {
    echo "[$TIMESTAMP] $1" | tee -a "$LOG_FILE"
}

# Function to get current auto-correct settings
get_autocorrect_settings() {
    local current_user=$1
    local current_uid=$2
    
    log_message "Getting current auto-correct settings for user: $current_user"
    
    # Spelling correction
    local spelling_correction=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read NSGlobalDomain NSAutomaticSpellingCorrectionEnabled 2>/dev/null)
    
    # Capitalize words
    local capitalize_words=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read NSGlobalDomain NSAutomaticCapitalizationEnabled 2>/dev/null)
    
    # Add period with double-space
    local period_substitution=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read NSGlobalDomain NSAutomaticPeriodSubstitutionEnabled 2>/dev/null)
    
    # Smart quotes
    local smart_quotes=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled 2>/dev/null)
    
    # Smart dashes
    local smart_dashes=$(launchctl asuser $current_uid sudo -iu "$current_user" defaults read NSGlobalDomain NSAutomaticDashSubstitutionEnabled 2>/dev/null)
    
    echo "Current Auto-Correct Settings:"
    echo "  Spelling Correction: ${spelling_correction:-Not set}"
    echo "  Capitalize Words: ${capitalize_words:-Not set}"
    echo "  Period Substitution: ${period_substitution:-Not set}"
    echo "  Smart Quotes: ${smart_quotes:-Not set}"
    echo "  Smart Dashes: ${smart_dashes:-Not set}"
}

# Function to configure auto-correct features
configure_autocorrect() {
    local current_user=$1
    local current_uid=$2
    local spelling_correction=$3
    local capitalize_words=$4
    local period_substitution=$5
    local smart_quotes=$6
    local smart_dashes=$7
    
    log_message "Configuring auto-correct settings for user: $current_user"
    
    local success=0
    
    # Configure spelling correction
    if [ -n "$spelling_correction" ]; then
        if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -bool $spelling_correction; then
            log_message "SUCCESS: Spelling correction set to $spelling_correction"
        else
            log_message "ERROR: Failed to set spelling correction"
            success=1
        fi
    fi
    
    # Configure capitalize words
    if [ -n "$capitalize_words" ]; then
        if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticCapitalizationEnabled -bool $capitalize_words; then
            log_message "SUCCESS: Capitalize words set to $capitalize_words"
        else
            log_message "ERROR: Failed to set capitalize words"
            success=1
        fi
    fi
    
    # Configure period substitution
    if [ -n "$period_substitution" ]; then
        if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticPeriodSubstitutionEnabled -bool $period_substitution; then
            log_message "SUCCESS: Period substitution set to $period_substitution"
        else
            log_message "ERROR: Failed to set period substitution"
            success=1
        fi
    fi
    
    # Configure smart quotes
    if [ -n "$smart_quotes" ]; then
        if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool $smart_quotes; then
            log_message "SUCCESS: Smart quotes set to $smart_quotes"
        else
            log_message "ERROR: Failed to set smart quotes"
            success=1
        fi
    fi
    
    # Configure smart dashes
    if [ -n "$smart_dashes" ]; then
        if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticDashSubstitutionEnabled -bool $smart_dashes; then
            log_message "SUCCESS: Smart dashes set to $smart_dashes"
        else
            log_message "ERROR: Failed to set smart dashes"
            success=1
        fi
    fi
    
    return $success
}

# Main execution
log_message "Starting auto-correct configuration"

# Configuration options (change as needed)
SPELLING_CORRECTION=${1:-false}
CAPITALIZE_WORDS=${2:-false}
PERIOD_SUBSTITUTION=${3:-false}
SMART_QUOTES=${4:-false}
SMART_DASHES=${5:-false}

# Get current user
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

if [ -z "$CurrentUser" ] || [ "$CurrentUser" = "root" ]; then
    log_message "ERROR: No valid user session found"
    exit 1
fi

log_message "Current user: $CurrentUser (UID: $CurrentUserUID)"

# Show current settings
get_autocorrect_settings "$CurrentUser" "$CurrentUserUID"

# Configure auto-correct
if configure_autocorrect "$CurrentUser" "$CurrentUserUID" "$SPELLING_CORRECTION" "$CAPITALIZE_WORDS" "$PERIOD_SUBSTITUTION" "$SMART_QUOTES" "$SMART_DASHES"; then
    log_message "Auto-correct configuration completed successfully"
else
    log_message "Some auto-correct configurations failed"
    exit 1
fi

log_message "Note: Changes will take effect after user logout/login"

Comprehensive Keyboard Configuration

All-in-One Configuration Script

Script to configure all keyboard settings at once:

#!/bin/bash

# Comprehensive keyboard configuration script
LOG_FILE="/var/log/keyboard_settings.log"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# Configuration variables
KEY_REPEAT_RATE=2
KEY_DELAY=1
KEYBOARD_NAVIGATION=3
DISABLE_AUTOCORRECT=true
DISABLE_CAPITALIZE=true
DISABLE_PERIOD_SUB=true
DISABLE_SMART_QUOTES=true
DISABLE_SMART_DASHES=true

# Function to log messages
log_message() {
    echo "[$TIMESTAMP] $1" | tee -a "$LOG_FILE"
}

# Function to apply all keyboard settings
apply_keyboard_settings() {
    local current_user=$1
    local current_uid=$2
    
    log_message "Applying comprehensive keyboard settings for user: $current_user"
    
    local success=0
    
    # Key repeat rate
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write -g KeyRepeat -int $KEY_REPEAT_RATE; then
        log_message "SUCCESS: Key repeat rate set to $KEY_REPEAT_RATE"
    else
        log_message "ERROR: Failed to set key repeat rate"
        success=1
    fi
    
    # Delay until repeat
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write -g InitialKeyRepeat -int $KEY_DELAY; then
        log_message "SUCCESS: Delay until repeat set to $KEY_DELAY"
    else
        log_message "ERROR: Failed to set delay until repeat"
        success=1
    fi
    
    # Keyboard navigation
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain AppleKeyboardUIMode -int $KEYBOARD_NAVIGATION; then
        log_message "SUCCESS: Keyboard navigation set to $KEYBOARD_NAVIGATION"
    else
        log_message "ERROR: Failed to set keyboard navigation"
        success=1
    fi
    
    # Auto-correct features
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -bool $DISABLE_AUTOCORRECT; then
        log_message "SUCCESS: Auto-correct disabled"
    else
        log_message "ERROR: Failed to disable auto-correct"
        success=1
    fi
    
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticCapitalizationEnabled -bool $DISABLE_CAPITALIZE; then
        log_message "SUCCESS: Auto-capitalize disabled"
    else
        log_message "ERROR: Failed to disable auto-capitalize"
        success=1
    fi
    
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticPeriodSubstitutionEnabled -bool $DISABLE_PERIOD_SUB; then
        log_message "SUCCESS: Period substitution disabled"
    else
        log_message "ERROR: Failed to disable period substitution"
        success=1
    fi
    
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool $DISABLE_SMART_QUOTES; then
        log_message "SUCCESS: Smart quotes disabled"
    else
        log_message "ERROR: Failed to disable smart quotes"
        success=1
    fi
    
    if launchctl asuser $current_uid sudo -iu "$current_user" defaults write NSGlobalDomain NSAutomaticDashSubstitutionEnabled -bool $DISABLE_SMART_DASHES; then
        log_message "SUCCESS: Smart dashes disabled"
    else
        log_message "ERROR: Failed to disable smart dashes"
        success=1
    fi
    
    return $success
}

# Main execution
log_message "Starting comprehensive keyboard configuration"

# Get current user
CurrentUser=$(ls -l /dev/console | awk '/ / { print $3 }')
CurrentUserUID=$(id -u "$CurrentUser")

if [ -z "$CurrentUser" ] || [ "$CurrentUser" = "root" ]; then
    log_message "ERROR: No valid user session found"
    exit 1
fi

log_message "Current user: $CurrentUser (UID: $CurrentUserUID)"

# Apply all settings
if apply_keyboard_settings "$CurrentUser" "$CurrentUserUID"; then
    log_message "Comprehensive keyboard configuration completed successfully"
    echo "✓ All keyboard settings applied successfully"
else
    log_message "Some keyboard configurations failed"
    echo "⚠ Some settings may not have been applied. Check log: $LOG_FILE"
    exit 1
fi

log_message "Note: Changes will take effect after user logout/login"
echo "Note: Please log out and log back in for changes to take effect"

Enterprise Deployment Scripts

Multi-User Configuration Script

Script for applying settings to multiple users:

#!/bin/bash

# Multi-user keyboard configuration script
LOG_FILE="/var/log/keyboard_settings.log"
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')

# Configuration
KEY_REPEAT_RATE=2
KEY_DELAY=1
KEYBOARD_NAVIGATION=3
DISABLE_AUTOCORRECT=false

# Function to log messages
log_message() {
    echo "[$TIMESTAMP] $1" | tee -a "$LOG_FILE"
}

# Function to get all users
get_all_users() {
    # Get users with UID >= 500 (regular users)
    local users=$(dscl . -list /Users UniqueID | awk '$2 >= 500 { print $1 }')
    echo "$users"
}

# Function to configure user settings
configure_user_keyboard() {
    local username=$1
    local user_uid=$(id -u "$username" 2>/dev/null)
    
    if [ -z "$user_uid" ]; then
        log_message "ERROR: Cannot get UID for user: $username"
        return 1
    fi
    
    log_message "Configuring keyboard settings for user: $username (UID: $user_uid)"
    
    # Check if user has a home directory
    local home_dir=$(eval echo ~$username)
    if [ ! -d "$home_dir" ]; then
        log_message "WARNING: Home directory not found for user: $username"
        return 1
    fi
    
    # Apply settings
    launchctl asuser $user_uid sudo -iu "$username" defaults write -g KeyRepeat -int $KEY_REPEAT_RATE
    launchctl asuser $user_uid sudo -iu "$username" defaults write -g InitialKeyRepeat -int $KEY_DELAY
    launchctl asuser $user_uid sudo -iu "$username" defaults write NSGlobalDomain AppleKeyboardUIMode -int $KEYBOARD_NAVIGATION
    launchctl asuser $user_uid sudo -iu "$username" defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -bool $DISABLE_AUTOCORRECT
    
    log_message "SUCCESS: Keyboard settings configured for user: $username"
    return 0
}

# Main execution
log_message "Starting multi-user keyboard configuration"

# Get all users
users=$(get_all_users)

if [ -z "$users" ]; then
    log_message "ERROR: No users found"
    exit 1
fi

log_message "Found users: $users"

# Configure each user
successful=0
failed=0

for user in $users; do
    if configure_user_keyboard "$user"; then
        ((successful++))
    else
        ((failed++))
    fi
done

log_message "Multi-user configuration completed"
log_message "Successfully configured: $successful users"
log_message "Failed: $failed users"

echo "Configuration Summary:"
echo "  Successfully configured: $successful users"
echo "  Failed: $failed users"
echo "  Log file: $LOG_FILE"

Remote Deployment Script

Script for deploying configurations remotely:

#!/bin/bash

# Remote keyboard configuration deployment script
REMOTE_HOSTS=(
    "10.0.1.10"
    "10.0.1.11"
    "10.0.1.12"
    # Add more hosts as needed
)

SSH_USER="admin"
SSH_KEY_PATH="/path/to/ssh/key"
LOG_FILE="/var/log/remote_keyboard_deployment.log"

# Function to log messages
log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Function to deploy to remote host
deploy_to_host() {
    local host=$1
    
    log_message "Deploying keyboard configuration to host: $host"
    
    # Copy script to remote host
    if scp -i "$SSH_KEY_PATH" -o StrictHostKeyChecking=no ./keyboard_config.sh "$SSH_USER@$host:/tmp/"; then
        log_message "Script copied to $host"
    else
        log_message "ERROR: Failed to copy script to $host"
        return 1
    fi
    
    # Execute script on remote host
    if ssh -i "$SSH_KEY_PATH" -o StrictHostKeyChecking=no "$SSH_USER@$host" "chmod +x /tmp/keyboard_config.sh && sudo /tmp/keyboard_config.sh"; then
        log_message "SUCCESS: Configuration applied on $host"
        return 0
    else
        log_message "ERROR: Failed to apply configuration on $host"
        return 1
    fi
}

# Main execution
log_message "Starting remote keyboard configuration deployment"

successful=0
failed=0

for host in "${REMOTE_HOSTS[@]}"; do
    if deploy_to_host "$host"; then
        ((successful++))
    else
        ((failed++))
    fi
done

log_message "Remote deployment completed"
log_message "Successfully deployed: $successful hosts"
log_message "Failed: $failed hosts"

echo "Deployment Summary:"
echo "  Successfully deployed: $successful hosts"
echo "  Failed: $failed hosts"
echo "  Log file: $LOG_FILE"

Best Practices and Recommendations

1. User Context Management

• Always apply settings in the correct user context
• Use launchctl asuser for user-specific settings
• Verify current user before applying configurations

2. Setting Validation

• Validate input values before applying settings
• Check for existing settings before modification
• Verify settings after application

3. Error Handling

• Implement comprehensive error checking
• Log all operations for troubleshooting
• Provide clear error messages

4. Testing and Deployment

• Test scripts on individual devices before mass deployment
• Use staged rollouts for large environments
• Monitor for issues after deployment

5. Documentation

• Document all customizations
• Maintain configuration version control
• Keep logs of all changes

Conclusion

Effective keyboard configuration management is essential for maintaining consistent user experiences across Mac fleets. The scripts and techniques provided in this guide offer comprehensive solutions for various keyboard configuration scenarios.

Key takeaways:

• Use appropriate user context for setting application
• Implement proper validation and error handling
• Test configurations before mass deployment
• Monitor and log all configuration changes
• Consider user preferences and accessibility needs

Remember that keyboard settings are highly personal, so consider providing options for users to customize their experience while maintaining enterprise standards where necessary.

Manage Kernel Extensions on macOS

Monitor and manage kernel extensions across your Roundfleet devices using command-line tools. This tutorial covers displaying loaded kexts, loading/unloading extensions, finding specific extensions, and enterprise security monitoring.

Understanding macOS Kernel Extensions

Kernel Extensions (kexts) are drivers that enable the macOS kernel to communicate with hardware devices and system components. Understanding kext management is crucial for:

• Hardware compatibility - Device drivers and hardware communication
• System stability - Monitoring potentially problematic extensions
• Security assessment - Identifying unauthorized or malicious kexts
• Compliance requirements - Enterprise security and audit trails

Key tools for kext management:

• kextstat - Display loaded kernel extensions
• kextload - Load kernel extensions
• kextunload - Unload kernel extensions
• kextfind - Find kernel extensions by criteria

Display Loaded Kernel Extensions

List All Loaded Extensions

#!/bin/bash

# Display all currently loaded kernel extensions
kextstat

echo "Kernel extensions list retrieved successfully"

Show Specific Extension Details

#!/bin/bash

# Display details of a specific kernel extension by bundle ID
BUNDLE_ID="${1:-com.apple.kpi.bsd}"

echo "Searching for kernel extension: $BUNDLE_ID"
kextstat | grep "$BUNDLE_ID"

if [[ $? -eq 0 ]]; then
    echo "Extension found and loaded"
else
    echo "Extension not found or not loaded"
fi

List Third-Party Extensions Only

#!/bin/bash

# Display only third-party (non-Apple) kernel extensions
echo "=== Third-Party Kernel Extensions ==="
echo "Device: $(hostname)"
echo "Date: $(date)"
echo "====================================="

echo -e "\n🔍 Non-Apple Kernel Extensions:"
third_party_kexts=$(kextstat | grep -v com.apple)

if [[ -n "$third_party_kexts" ]]; then
    echo "$third_party_kexts"
    echo -e "\n📊 Third-party extension count: $(echo "$third_party_kexts" | wc -l)"
else
    echo "No third-party kernel extensions detected"
fi

Comprehensive Kext Analysis

#!/bin/bash

# Detailed kernel extension analysis
echo "=== Roundfleet Kernel Extension Analysis ==="
echo "Device: $(hostname)"
echo "OS Version: $(sw_vers -productVersion)"
echo "Kernel Version: $(uname -r)"
echo "Date: $(date)"
echo "=========================================="

# Total loaded extensions
total_kexts=$(kextstat | tail -n +2 | wc -l)
echo "🔧 Total loaded extensions: $total_kexts"

# Apple vs third-party breakdown
apple_kexts=$(kextstat | grep -c com.apple)
third_party_kexts=$(kextstat | grep -v com.apple | tail -n +2 | wc -l)

echo "🍎 Apple extensions: $apple_kexts"
echo "🔌 Third-party extensions: $third_party_kexts"

# Show third-party extensions if any
if [[ $third_party_kexts -gt 0 ]]; then
    echo -e "\n⚠️  Third-Party Extensions:"
    kextstat | grep -v com.apple | tail -n +2
fi

# Check for potentially suspicious extensions
echo -e "\n🔒 Security Analysis:"
suspicious_patterns=("hack" "crack" "cheat" "bypass" "inject")
for pattern in "${suspicious_patterns[@]}"; do
    suspicious=$(kextstat | grep -i "$pattern")
    if [[ -n "$suspicious" ]]; then
        echo "🚨 Suspicious extension detected: $suspicious"
    fi
done

echo "✅ Security analysis completed"

Load Kernel Extensions

Basic Extension Loading

#!/bin/bash

# Load a kernel extension by path
KEXT_PATH="${1}"

if [[ -z "$KEXT_PATH" ]]; then
    echo "Usage: $0 <path_to_kext>"
    echo "Example: $0 /System/Library/Extensions/FakeSMC.kext"
    exit 1
fi

if [[ ! -d "$KEXT_PATH" ]]; then
    echo "❌ Kernel extension not found: $KEXT_PATH"
    exit 1
fi

echo "Loading kernel extension: $KEXT_PATH"
if sudo kextload "$KEXT_PATH"; then
    echo "✅ Kernel extension loaded successfully"
else
    echo "❌ Failed to load kernel extension"
    exit 1
fi

Safe Extension Loading with Verification

#!/bin/bash

# Safely load kernel extension with verification
load_kext_safely() {
    local kext_path="$1"
    local bundle_id="$2"
    
    if [[ -z "$kext_path" ]]; then
        echo "❌ Kernel extension path required"
        return 1
    fi
    
    # Verify extension exists
    if [[ ! -d "$kext_path" ]]; then
        echo "❌ Kernel extension not found: $kext_path"
        return 1
    fi
    
    # Check if already loaded
    if [[ -n "$bundle_id" ]]; then
        if kextstat | grep -q "$bundle_id"; then
            echo "⚠️  Extension already loaded: $bundle_id"
            return 0
        fi
    fi
    
    # Validate extension
    echo "🔍 Validating kernel extension..."
    if ! kextutil -t "$kext_path" 2>/dev/null; then
        echo "❌ Extension validation failed"
        return 1
    fi
    
    # Load the extension
    echo "📦 Loading kernel extension: $kext_path"
    if sudo kextload "$kext_path"; then
        echo "✅ Kernel extension loaded successfully"
        
        # Verify it's actually loaded
        if [[ -n "$bundle_id" ]]; then
            sleep 1
            if kextstat | grep -q "$bundle_id"; then
                echo "✅ Extension verified as loaded"
            else
                echo "⚠️  Extension load status unclear"
            fi
        fi
        
        return 0
    else
        echo "❌ Failed to load kernel extension"
        return 1
    fi
}

# Example usage
# load_kext_safely "/System/Library/Extensions/FakeSMC.kext" "com.apple.driver.FakeSMC"

Enterprise Extension Loading

#!/bin/bash

# Enterprise kernel extension loading with logging
LOG_FILE="/var/log/roundfleet_kext_operations.log"

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

load_enterprise_kext() {
    local kext_path="$1"
    local description="$2"
    
    log_action "=== Kernel Extension Load Operation ==="
    log_action "Device: $(hostname)"
    log_action "User: $(whoami)"
    log_action "Extension: $kext_path"
    log_action "Description: ${description:-No description provided}"
    
    # Pre-load checks
    if [[ ! -d "$kext_path" ]]; then
        log_action "ERROR: Extension not found at path: $kext_path"
        return 1
    fi
    
    # Check current system state
    local pre_count=$(kextstat | tail -n +2 | wc -l)
    log_action "Pre-load extension count: $pre_count"
    
    # Attempt to load
    log_action "Attempting to load extension..."
    if sudo kextload "$kext_path" 2>&1 | tee -a "$LOG_FILE"; then
        local post_count=$(kextstat | tail -n +2 | wc -l)
        log_action "SUCCESS: Extension loaded"
        log_action "Post-load extension count: $post_count"
        
        # Generate load report
        {
            echo "Roundfleet Kernel Extension Load Report"
            echo "Time: $(date)"
            echo "Extension: $kext_path"
            echo "Status: SUCCESS"
            echo "Pre-load count: $pre_count"
            echo "Post-load count: $post_count"
        } >> "$LOG_FILE"
        
        return 0
    else
        log_action "ERROR: Failed to load extension"
        return 1
    fi
}

# Usage: load_enterprise_kext "/path/to/extension.kext" "Description"

Unload Kernel Extensions

Basic Extension Unloading

#!/bin/bash

# Unload kernel extension by path
KEXT_PATH="${1}"

if [[ -z "$KEXT_PATH" ]]; then
    echo "Usage: $0 <path_to_kext>"
    echo "Example: $0 /System/Library/Extensions/FakeSMC.kext"
    exit 1
fi

echo "Unloading kernel extension: $KEXT_PATH"
if sudo kextunload "$KEXT_PATH"; then
    echo "✅ Kernel extension unloaded successfully"
else
    echo "❌ Failed to unload kernel extension"
    exit 1
fi

Unload by Bundle ID

#!/bin/bash

# Unload kernel extension by bundle identifier
BUNDLE_ID="${1}"

if [[ -z "$BUNDLE_ID" ]]; then
    echo "Usage: $0 <bundle_id>"
    echo "Example: $0 com.apple.driver.FakeSMC"
    exit 1
fi

# Check if extension is loaded
if ! kextstat | grep -q "$BUNDLE_ID"; then
    echo "⚠️  Extension not currently loaded: $BUNDLE_ID"
    exit 0
fi

echo "Unloading kernel extension: $BUNDLE_ID"
if sudo kextunload -b "$BUNDLE_ID"; then
    echo "✅ Kernel extension unloaded successfully"
    
    # Verify unload
    sleep 1
    if ! kextstat | grep -q "$BUNDLE_ID"; then
        echo "✅ Extension confirmed unloaded"
    else
        echo "⚠️  Extension may still be loaded"
    fi
else
    echo "❌ Failed to unload kernel extension"
    exit 1
fi

Safe Extension Unloading

#!/bin/bash

# Safely unload kernel extensions with dependency checking
unload_kext_safely() {
    local bundle_id="$1"
    local force_unload="${2:-false}"
    
    if [[ -z "$bundle_id" ]]; then
        echo "❌ Bundle ID required"
        return 1
    fi
    
    # Check if extension is loaded
    if ! kextstat | grep -q "$bundle_id"; then
        echo "ℹ️  Extension not loaded: $bundle_id"
        return 0
    fi
    
    # Check for Apple extensions (warn but allow)
    if [[ "$bundle_id" == com.apple.* ]]; then
        echo "⚠️  WARNING: Attempting to unload Apple system extension"
        echo "This may cause system instability"
        
        if [[ "$force_unload" != "true" ]]; then
            echo "❌ Aborting unload of Apple extension (use force_unload=true to override)"
            return 1
        fi
    fi
    
    # Show extension info before unload
    echo "🔍 Extension information:"
    kextstat | grep "$bundle_id"
    
    # Attempt unload
    echo "📤 Unloading extension: $bundle_id"
    if sudo kextunload -b "$bundle_id"; then
        echo "✅ Extension unloaded successfully"
        
        # Verify unload
        sleep 2
        if ! kextstat | grep -q "$bundle_id"; then
            echo "✅ Extension confirmed unloaded"
            return 0
        else
            echo "⚠️  Extension still appears to be loaded"
            return 1
        fi
    else
        echo "❌ Failed to unload extension"
        return 1
    fi
}

# Example usage
# unload_kext_safely "com.third.party.driver"
# unload_kext_safely "com.apple.driver.something" "true"  # Force Apple extension

Find Kernel Extensions

Find by Bundle ID

#!/bin/bash

# Find kernel extensions by bundle ID
BUNDLE_ID="${1}"

if [[ -z "$BUNDLE_ID" ]]; then
    echo "Usage: $0 <bundle_id>"
    echo "Example: $0 com.apple.driver.AppleHDA"
    exit 1
fi

echo "Searching for kernel extension: $BUNDLE_ID"
kextfind -b "$BUNDLE_ID"

# Also check if it's currently loaded
echo -e "\nLoad status:"
if kextstat | grep -q "$BUNDLE_ID"; then
    echo "✅ Extension is currently loaded"
    kextstat | grep "$BUNDLE_ID"
else
    echo "❌ Extension is not currently loaded"
fi

Comprehensive Extension Search

#!/bin/bash

# Comprehensive kernel extension search and analysis
search_kext_comprehensive() {
    local search_term="$1"
    
    if [[ -z "$search_term" ]]; then
        echo "Usage: search_kext_comprehensive <search_term>"
        return 1
    fi
    
    echo "=== Comprehensive Kernel Extension Search ==="
    echo "Search term: $search_term"
    echo "Device: $(hostname)"
    echo "Date: $(date)"
    echo "============================================="
    
    # Search by bundle ID
    echo -e "\n🔍 Searching by bundle ID:"
    local found_by_bundle=$(kextfind -b "*$search_term*" 2>/dev/null)
    if [[ -n "$found_by_bundle" ]]; then
        echo "$found_by_bundle"
    else
        echo "No extensions found matching bundle ID pattern"
    fi
    
    # Search loaded extensions
    echo -e "\n📋 Checking loaded extensions:"
    local loaded_matches=$(kextstat | grep -i "$search_term")
    if [[ -n "$loaded_matches" ]]; then
        echo "Found in loaded extensions:"
        echo "$loaded_matches"
    else
        echo "No loaded extensions match search term"
    fi
    
    # Search filesystem
    echo -e "\n💾 Searching filesystem:"
    echo "System extensions directory:"
    find /System/Library/Extensions -name "*$search_term*" -type d 2>/dev/null | head -10
    
    echo -e "\nLibrary extensions directory:"
    find /Library/Extensions -name "*$search_term*" -type d 2>/dev/null | head -10
    
    echo -e "\n✅ Search completed"
}

# Example usage
# search_kext_comprehensive "bluetooth"
# search_kext_comprehensive "audio"

Find Extensions by Pattern

#!/bin/bash

# Find kernel extensions matching various patterns
echo "=== Kernel Extension Pattern Search ==="

# Audio-related extensions
echo -e "\n🔊 Audio Extensions:"
kextstat | grep -i -E "(audio|sound|hda)"

# Network-related extensions
echo -e "\n🌐 Network Extensions:"
kextstat | grep -i -E "(network|wifi|ethernet|bluetooth)"

# Graphics-related extensions
echo -e "\n🖥️  Graphics Extensions:"
kextstat | grep -i -E "(graphics|display|amd|nvidia|intel)"

# USB-related extensions
echo -e "\n🔌 USB Extensions:"
kextstat | grep -i -E "(usb|port)"

# Security-related extensions
echo -e "\n🔒 Security Extensions:"
kextstat | grep -i -E "(security|firewall|antivirus)"

# Virtualization extensions
echo -e "\n☁️  Virtualization Extensions:"
kextstat | grep -i -E "(vmware|parallels|virtual|hypervisor)"

Enterprise Kernel Extension Monitoring

Security Monitoring Script

#!/bin/bash

# Enterprise kernel extension security monitoring
LOG_FILE="/var/log/roundfleet_kext_security.log"
ALERT_FILE="/var/log/roundfleet_kext_alerts.log"

# Logging function
log_security() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Alert function
send_alert() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - ALERT: $1" | tee -a "$ALERT_FILE"
}

# Security assessment
assess_kext_security() {
    log_security "=== Kernel Extension Security Assessment ==="
    log_security "Device: $(hostname)"
    log_security "OS Version: $(sw_vers -productVersion)"
    
    # Count extensions
    local total_kexts=$(kextstat | tail -n +2 | wc -l)
    local apple_kexts=$(kextstat | grep -c com.apple)
    local third_party=$(kextstat | grep -v com.apple | tail -n +2 | wc -l)
    
    log_security "Total extensions: $total_kexts"
    log_security "Apple extensions: $apple_kexts"
    log_security "Third-party extensions: $third_party"
    
    # Alert on high third-party count
    if [[ $third_party -gt 5 ]]; then
        send_alert "High number of third-party extensions: $third_party"
    fi
    
    # Check for suspicious extensions
    local suspicious_keywords=("hack" "crack" "cheat" "bypass" "inject" "hook" "patch")
    for keyword in "${suspicious_keywords[@]}"; do
        local matches=$(kextstat | grep -i "$keyword")
        if [[ -n "$matches" ]]; then
            send_alert "Suspicious extension detected ($keyword): $matches"
        fi
    done
    
    # Check for unsigned extensions
    echo -e "\n🔍 Checking extension signatures..."
    kextstat | grep -v com.apple | tail -n +2 | while read line; do
        local bundle_id=$(echo "$line" | awk '{print $6}')
        if [[ -n "$bundle_id" ]]; then
            # This is a simplified check - in reality, you'd want more sophisticated signature verification
            log_security "Third-party extension: $bundle_id"
        fi
    done
    
    log_security "Security assessment completed"
}

# Generate security report
generate_security_report() {
    local report_file="/tmp/kext_security_report_$(date +%Y%m%d_%H%M%S).txt"
    
    {
        echo "Roundfleet Kernel Extension Security Report"
        echo "Generated: $(date)"
        echo "Device: $(hostname)"
        echo "OS Version: $(sw_vers -productVersion)"
        echo "========================================"
        echo ""
        
        echo "📊 Extension Statistics:"
        echo "Total loaded: $(kextstat | tail -n +2 | wc -l)"
        echo "Apple extensions: $(kextstat | grep -c com.apple)"
        echo "Third-party: $(kextstat | grep -v com.apple | tail -n +2 | wc -l)"
        echo ""
        
        echo "🔍 Third-Party Extensions:"
        kextstat | grep -v com.apple | tail -n +2
        echo ""
        
        echo "🔒 Security Recommendations:"
        local third_party_count=$(kextstat | grep -v com.apple | tail -n +2 | wc -l)
        if [[ $third_party_count -eq 0 ]]; then
            echo "✅ No third-party extensions detected"
        else
            echo "⚠️  Review all third-party extensions for necessity"
            echo "⚠️  Verify digital signatures and sources"
            echo "⚠️  Consider removing unused extensions"
        fi
        
    } > "$report_file"
    
    echo "📋 Security report generated: $report_file"
}

# Main security monitoring
main() {
    assess_kext_security
    generate_security_report
}

# Execute monitoring
main "$@"

Extension Change Monitoring

#!/bin/bash

# Monitor kernel extension changes over time
BASELINE_FILE="/var/lib/roundfleet/kext_baseline.txt"
CHANGES_LOG="/var/log/roundfleet_kext_changes.log"

# Create directories if needed
sudo mkdir -p "$(dirname "$BASELINE_FILE")"
sudo mkdir -p "$(dirname "$CHANGES_LOG")"

# Logging function
log_change() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | sudo tee -a "$CHANGES_LOG"
}

# Create or update baseline
create_baseline() {
    echo "📋 Creating kernel extension baseline..."
    kextstat > "$BASELINE_FILE"
    log_change "Baseline created with $(kextstat | tail -n +2 | wc -l) extensions"
}

# Check for changes
check_changes() {
    if [[ ! -f "$BASELINE_FILE" ]]; then
        echo "⚠️  No baseline found, creating one..."
        create_baseline
        return
    fi
    
    local current_file="/tmp/kext_current_$(date +%Y%m%d_%H%M%S).txt"
    kextstat > "$current_file"
    
    # Compare with baseline
    local changes=$(diff "$BASELINE_FILE" "$current_file")
    
    if [[ -n "$changes" ]]; then
        log_change "Kernel extension changes detected:"
        echo "$changes" | sudo tee -a "$CHANGES_LOG"
        
        # Analyze changes
        local added=$(echo "$changes" | grep "^>" | wc -l)
        local removed=$(echo "$changes" | grep "^<" | wc -l)
        
        log_change "Extensions added: $added"
        log_change "Extensions removed: $removed"
        
        echo "🔄 Changes detected - check $CHANGES_LOG for details"
    else
        echo "✅ No changes detected since baseline"
    fi
    
    # Clean up
    rm -f "$current_file"
}

# Usage
case "${1:-check}" in
    "baseline")
        create_baseline
        ;;
    "check")
        check_changes
        ;;
    *)
        echo "Usage: $0 [baseline|check]"
        ;;
esac

Kernel Extension Reference

Common Extension Categories

Category	Bundle ID Pattern	Purpose
Audio	com.apple.driver.*HDA*	Audio hardware drivers
Graphics	com.apple.driver.*Graphics*	Display and GPU drivers
Network	com.apple.driver.*Ethernet*	Network interface drivers
USB	com.apple.driver.*USB*	USB device support
Storage	com.apple.driver.*Storage*	Disk and storage drivers
Bluetooth	com.apple.driver.*Bluetooth*	Bluetooth connectivity
Security	com.apple.security.*	Security frameworks

Command Reference

# List all loaded extensions
kextstat

# List with specific columns
kextstat -l

# Find extension by bundle ID
kextfind -b com.apple.driver.AppleHDA

# Load extension
sudo kextload /path/to/extension.kext

# Unload by path
sudo kextunload /path/to/extension.kext

# Unload by bundle ID
sudo kextunload -b com.example.driver

# Test extension without loading
kextutil -t /path/to/extension.kext

# Show extension dependencies
kextutil -d /path/to/extension.kext

Important Security Notes

• Apple Extensions - Generally safe but unloading may cause instability
• Third-party Extensions - Require careful security assessment
• Unsigned Extensions - Potential security risk, audit carefully
• Administrative Privileges - Loading/unloading requires sudo access
• System Impact - Extension changes can affect system stability
• Recovery Mode - May be needed if system becomes unstable

Troubleshooting

Common Issues

Extension Won't Load:

# Check extension validity
kextutil -t /path/to/extension.kext

# Check system logs
log show --predicate 'subsystem == "com.apple.kernel"' --last 1h

Extension Won't Unload:

# Check dependencies
kextutil -d /path/to/extension.kext

# Force unload (dangerous)
sudo kextunload -b bundle.id -f

Permission Denied:

# Ensure admin privileges
sudo -v

# Check System Integrity Protection
csrutil status

Remember to test kernel extension operations on individual devices before deploying across your Roundfleet environment, as improper kext management can cause system instability.

Install Unsigned Packages on macOS

Learn how to install unsigned packages on Mac devices using scripts. Unsigned packages are software packages that haven't been digitally signed by the developer, often required for specialized development tools and open-source software.

Basic Package Installation Script

Install an unsigned package from a URL:

#!/bin/bash

# Download and install unsigned package
PACKAGE_NAME="your_package"
DOWNLOAD_URL="https://example.com/package.pkg"

# Download package to temporary directory
curl -o /tmp/${PACKAGE_NAME}.pkg "${DOWNLOAD_URL}"

# Install package with admin privileges
sudo installer -verboseR -pkg /tmp/${PACKAGE_NAME}.pkg -target /

# Clean up
rm /tmp/${PACKAGE_NAME}.pkg

echo "Package installation completed"

Enhanced Installation with Validation

Script with error handling and validation:

#!/bin/bash

PACKAGE_NAME="your_package"
DOWNLOAD_URL="https://example.com/package.pkg"
TEMP_PATH="/tmp/${PACKAGE_NAME}.pkg"

# Function to log messages
log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S'): $1"
}

# Download package
log_message "Downloading package from ${DOWNLOAD_URL}"
if curl -f -o "${TEMP_PATH}" "${DOWNLOAD_URL}"; then
    log_message "Download successful"
else
    log_message "Download failed"
    exit 1
fi

# Verify file exists and has content
if [[ -f "${TEMP_PATH}" && -s "${TEMP_PATH}" ]]; then
    log_message "Package file validated"
else
    log_message "Package file validation failed"
    exit 1
fi

# Install package
log_message "Installing package"
if sudo installer -verboseR -pkg "${TEMP_PATH}" -target /; then
    log_message "Installation completed successfully"
else
    log_message "Installation failed"
    exit 1
fi

# Clean up
rm "${TEMP_PATH}"
log_message "Cleanup completed"

Usage with Roundfleet

1. Replace PACKAGE_NAME with your desired package name
2. Replace DOWNLOAD_URL with the actual package URL
3. Deploy the script through Roundfleet's remote script execution
4. Monitor installation progress through the action history

Security Considerations

Warning: Installing unsigned packages may compromise security as their authenticity cannot be verified. Only install packages from trusted sources.

• Verify package sources before deployment
• Test on a limited set of devices first
• Monitor for any security alerts post-installation

Troubleshooting

Installation fails: Check network connectivity and URL accessibility Permission denied: Ensure script runs with administrative privileges Package corrupted: Verify download completed successfully

---

Note: Always validate script execution on test systems before bulk deployment. Roundfleet is not responsible for system damage from unsigned package installations.

Install Latest Firefox Version on macOS Devices

This comprehensive guide demonstrates how to install and manage the latest Firefox version on macOS devices for enterprise deployment, automatic updates, and configuration management.

Overview

Firefox prioritizes user privacy, security, and provides extensive customization options for browsing according to organizational preferences, making it ideal for enterprise use. This guide provides scripts to ensure macOS devices are equipped with the latest Firefox version through automated installation and management.

Key Benefits

• Privacy-focused: Enhanced user privacy and data protection
• Security: Regular security updates and enterprise-grade protection
• Customization: Extensive configuration options for enterprise policies
• Cross-platform: Consistent experience across different operating systems
• Open source: Transparent development and security auditing

Basic Firefox Installation

Simple Firefox Installation Script

Create a basic script to install the latest Firefox version:

#!/bin/bash

# Basic Firefox installation script
# Usage: ./install_firefox.sh

install_firefox() {
    echo "Starting Firefox installation process..."
    
    # Check if Firefox is already installed
    if [ -d "/Applications/Firefox.app" ]; then
        echo "Firefox is already installed."
        exit 0
    fi
    
    # Firefox download URL
    firefox_url="https://download.mozilla.org/?product=firefox-latest&os=osx&lang=en-US"
    download_dir="$HOME/Applications"
    
    # Create download directory
    mkdir -p "$download_dir"
    
    echo "Downloading Firefox..."
    curl -L -o "$download_dir/Firefox.dmg" "$firefox_url"
    
    echo "Mounting the Firefox disk image..."
    hdiutil attach "$download_dir/Firefox.dmg"
    
    echo "Installing Firefox..."
    cp -r "/Volumes/Firefox/Firefox.app" "/Applications/"
    
    echo "Unmounting the Firefox disk image..."
    hdiutil detach "/Volumes/Firefox"
    
    echo "Cleaning up..."
    rm "$download_dir/Firefox.dmg"
    
    echo "Firefox installation complete."
}

# Execute installation
install_firefox

Enhanced Firefox Installation with Validation

#!/bin/bash

# Enhanced Firefox installation with validation and logging
# Usage: ./enhanced_firefox_install.sh

enhanced_firefox_install() {
    local log_file="/var/log/roundfleet_firefox_install.log"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    local download_dir="/tmp/roundfleet_firefox"
    
    # Create log directory
    mkdir -p /var/log
    mkdir -p "$download_dir"
    
    echo "[$timestamp] Enhanced Firefox installation started" >> "$log_file"
    
    # Check if running as root (recommended for enterprise deployment)
    if [ "$EUID" -ne 0 ]; then
        echo "Warning: Running as user. Some features may be limited."
        echo "[$timestamp] Running as user, not root" >> "$log_file"
    fi
    
    # Check existing Firefox installation
    check_existing_firefox
    
    # Download and install Firefox
    download_firefox
    install_firefox_app
    verify_installation
    cleanup_installation
    
    echo "[$timestamp] Enhanced Firefox installation completed" >> "$log_file"
}

check_existing_firefox() {
    echo "Checking for existing Firefox installation..."
    
    if [ -d "/Applications/Firefox.app" ]; then
        local current_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        
        echo "Firefox is already installed (Version: $current_version)"
        echo "[$timestamp] Firefox already installed - Version: $current_version" >> "$log_file"
        
        read -p "Do you want to update to the latest version? (y/N): " update_choice
        if [ "$update_choice" != "y" ] && [ "$update_choice" != "Y" ]; then
            echo "Installation cancelled."
            exit 0
        fi
        
        echo "Proceeding with Firefox update..."
    else
        echo "No existing Firefox installation found."
        echo "[$timestamp] No existing Firefox installation found" >> "$log_file"
    fi
}

download_firefox() {
    echo "Downloading latest Firefox..."
    
    local firefox_url="https://download.mozilla.org/?product=firefox-latest&os=osx&lang=en-US"
    local firefox_dmg="$download_dir/Firefox.dmg"
    
    # Check network connectivity
    if ! ping -c 1 download.mozilla.org >/dev/null 2>&1; then
        echo "Error: No network connectivity to Mozilla servers"
        echo "[$timestamp] Network connectivity check failed" >> "$log_file"
        exit 1
    fi
    
    # Download Firefox with progress and error handling
    if curl -L --progress-bar -o "$firefox_dmg" "$firefox_url"; then
        echo "Firefox download completed successfully"
        echo "[$timestamp] Firefox download completed" >> "$log_file"
    else
        echo "Error: Failed to download Firefox"
        echo "[$timestamp] Firefox download failed" >> "$log_file"
        exit 1
    fi
    
    # Verify download
    if [ -f "$firefox_dmg" ]; then
        local file_size=$(stat -f%z "$firefox_dmg" 2>/dev/null || echo "0")
        echo "Downloaded file size: $file_size bytes"
        echo "[$timestamp] Downloaded file size: $file_size bytes" >> "$log_file"
        
        if [ "$file_size" -lt 50000000 ]; then  # Less than 50MB indicates potential issue
            echo "Warning: Downloaded file seems too small. Possible download issue."
            echo "[$timestamp] Downloaded file size warning" >> "$log_file"
        fi
    else
        echo "Error: Download file not found"
        echo "[$timestamp] Download file not found" >> "$log_file"
        exit 1
    fi
}

install_firefox_app() {
    echo "Installing Firefox application..."
    
    local firefox_dmg="$download_dir/Firefox.dmg"
    local mount_point="/tmp/firefox_mount"
    
    # Create mount point
    mkdir -p "$mount_point"
    
    # Mount the DMG file
    if hdiutil attach "$firefox_dmg" -mountpoint "$mount_point" -quiet; then
        echo "Firefox disk image mounted successfully"
        echo "[$timestamp] Firefox disk image mounted" >> "$log_file"
    else
        echo "Error: Failed to mount Firefox disk image"
        echo "[$timestamp] Failed to mount Firefox disk image" >> "$log_file"
        exit 1
    fi
    
    # Copy Firefox application
    if [ -d "$mount_point/Firefox.app" ]; then
        echo "Copying Firefox application to /Applications..."
        
        # Remove existing installation if present
        if [ -d "/Applications/Firefox.app" ]; then
            rm -rf "/Applications/Firefox.app"
        fi
        
        # Copy new Firefox application
        if cp -R "$mount_point/Firefox.app" "/Applications/"; then
            echo "Firefox application copied successfully"
            echo "[$timestamp] Firefox application copied successfully" >> "$log_file"
        else
            echo "Error: Failed to copy Firefox application"
            echo "[$timestamp] Failed to copy Firefox application" >> "$log_file"
            hdiutil detach "$mount_point" -quiet
            exit 1
        fi
    else
        echo "Error: Firefox.app not found in disk image"
        echo "[$timestamp] Firefox.app not found in disk image" >> "$log_file"
        hdiutil detach "$mount_point" -quiet
        exit 1
    fi
    
    # Unmount the disk image
    if hdiutil detach "$mount_point" -quiet; then
        echo "Firefox disk image unmounted successfully"
        echo "[$timestamp] Firefox disk image unmounted" >> "$log_file"
    else
        echo "Warning: Failed to unmount Firefox disk image"
        echo "[$timestamp] Failed to unmount Firefox disk image" >> "$log_file"
    fi
}

verify_installation() {
    echo "Verifying Firefox installation..."
    
    if [ -d "/Applications/Firefox.app" ]; then
        local installed_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        local bundle_id=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleIdentifier 2>/dev/null || echo "Unknown")
        
        echo "Firefox installation verified:"
        echo "  Version: $installed_version"
        echo "  Bundle ID: $bundle_id"
        echo "  Location: /Applications/Firefox.app"
        
        echo "[$timestamp] Firefox installation verified - Version: $installed_version" >> "$log_file"
        
        # Test Firefox launch (optional)
        echo "Testing Firefox launch..."
        if timeout 10 /Applications/Firefox.app/Contents/MacOS/firefox --version >/dev/null 2>&1; then
            echo "Firefox launch test successful"
            echo "[$timestamp] Firefox launch test successful" >> "$log_file"
        else
            echo "Warning: Firefox launch test failed or timed out"
            echo "[$timestamp] Firefox launch test failed" >> "$log_file"
        fi
    else
        echo "Error: Firefox installation verification failed"
        echo "[$timestamp] Firefox installation verification failed" >> "$log_file"
        exit 1
    fi
}

cleanup_installation() {
    echo "Cleaning up installation files..."
    
    if [ -d "$download_dir" ]; then
        rm -rf "$download_dir"
        echo "Installation files cleaned up"
        echo "[$timestamp] Installation files cleaned up" >> "$log_file"
    fi
}

# Execute enhanced installation
enhanced_firefox_install

Advanced Firefox Management

Enterprise Firefox Deployment Manager

#!/bin/bash

# Enterprise Firefox deployment manager
# Usage: ./enterprise_firefox_manager.sh

enterprise_firefox_manager() {
    local config_file="/etc/roundfleet/firefox_config.conf"
    local log_file="/var/log/roundfleet_firefox_enterprise.log"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    
    # Check if running as root
    if [ "$EUID" -ne 0 ]; then
        echo "Error: This script must be run as root for enterprise deployment"
        exit 1
    fi
    
    # Create configuration directory
    mkdir -p /etc/roundfleet
    
    # Load or create configuration
    if [ -f "$config_file" ]; then
        source "$config_file"
    else
        create_enterprise_config
        source "$config_file"
    fi
    
    echo "[$timestamp] Enterprise Firefox manager started" >> "$log_file"
    
    # Display enterprise menu
    display_enterprise_menu
}

create_enterprise_config() {
    cat > "/etc/roundfleet/firefox_config.conf" << 'EOF'
# Roundfleet Enterprise Firefox Configuration

# Organization settings
ORGANIZATION_NAME="Roundfleet Organization"
IT_CONTACT="[email protected]"

# Firefox installation settings
FIREFOX_LANGUAGE="en-US"
FIREFOX_CHANNEL="release"  # release, beta, nightly
AUTO_UPDATE_ENABLED="true"
SILENT_INSTALL="true"

# Enterprise policies
ENABLE_ENTERPRISE_POLICIES="true"
DISABLE_TELEMETRY="true"
DISABLE_STUDIES="true"
BLOCK_ABOUT_CONFIG="false"
HOMEPAGE_URL="https://www.roundfleet.com"

# Security settings
ENABLE_SECURITY_POLICIES="true"
BLOCK_DANGEROUS_DOWNLOADS="true"
ENABLE_SAFE_BROWSING="true"
DISABLE_DEVELOPER_TOOLS="false"

# Network settings
PROXY_ENABLED="false"
PROXY_TYPE="system"
PROXY_HOST=""
PROXY_PORT=""

# Logging and monitoring
ENABLE_DETAILED_LOGGING="true"
LOG_RETENTION_DAYS="30"
SEND_DEPLOYMENT_REPORTS="true"
EOF
    
    echo "configuration created at /etc/roundfleet/firefox_config.conf"
}

display_enterprise_menu() {
    while true; do
        clear
        echo "======================================="
        echo "Roundfleet Enterprise Firefox Manager"
        echo "======================================="
        echo ""
        echo "Organization: $ORGANIZATION_NAME"
        echo "Contact: $IT_CONTACT"
        echo ""
        echo "Available Actions:"
        echo "1. Install/Update Firefox"
        echo "2. Configure Enterprise Policies"
        echo "3. Deploy to Multiple Devices"
        echo "4. Check Firefox Status"
        echo "5. Generate Deployment Report"
        echo "6. Manage Firefox Profiles"
        echo "7. View Configuration"
        echo "8. Exit"
        echo ""
        read -p "Select an option (1-8): " choice
        
        case $choice in
            1)
                install_update_firefox
                ;;
            2)
                configure_enterprise_policies
                ;;
            3)
                deploy_multiple_devices
                ;;
            4)
                check_firefox_status
                ;;
            5)
                generate_deployment_report
                ;;
            6)
                manage_firefox_profiles
                ;;
            7)
                view_configuration
                ;;
            8)
                echo "Exiting Enterprise Firefox Manager."
                exit 0
                ;;
            *)
                echo "Invalid option. Please try again."
                ;;
        esac
        
        echo ""
        read -p "Press Enter to continue..."
    done
}

install_update_firefox() {
    echo "======================================="
    echo "Install/Update Firefox"
    echo "======================================="
    
    local current_version=""
    if [ -d "/Applications/Firefox.app" ]; then
        current_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        echo "Current Firefox version: $current_version"
    else
        echo "Firefox not currently installed"
    fi
    
    echo ""
    echo "Installation options:"
    echo "1. Install/Update to latest stable version"
    echo "2. Install/Update to latest beta version"
    echo "3. Install/Update to latest nightly version"
    echo "4. Cancel"
    echo ""
    read -p "Select installation option (1-4): " install_choice
    
    case $install_choice in
        1)
            install_firefox_version "release"
            ;;
        2)
            install_firefox_version "beta"
            ;;
        3)
            install_firefox_version "nightly"
            ;;
        4)
            echo "Installation cancelled."
            ;;
        *)
            echo "Invalid option."
            ;;
    esac
}

install_firefox_version() {
    local channel="$1"
    local download_dir="/tmp/roundfleet_firefox_enterprise"
    
    echo "Installing Firefox $channel version..."
    
    # Create download directory
    mkdir -p "$download_dir"
    
    # Determine download URL based on channel
    local firefox_url
    case $channel in
        "release")
            firefox_url="https://download.mozilla.org/?product=firefox-latest&os=osx&lang=$FIREFOX_LANGUAGE"
            ;;
        "beta")
            firefox_url="https://download.mozilla.org/?product=firefox-beta-latest&os=osx&lang=$FIREFOX_LANGUAGE"
            ;;
        "nightly")
            firefox_url="https://download.mozilla.org/?product=firefox-nightly-latest&os=osx&lang=$FIREFOX_LANGUAGE"
            ;;
        *)
            echo "Error: Invalid Firefox channel"
            return 1
            ;;
    esac
    
    echo "Downloading Firefox $channel..."
    local firefox_dmg="$download_dir/Firefox-$channel.dmg"
    
    if curl -L --progress-bar -o "$firefox_dmg" "$firefox_url"; then
        echo "Download completed successfully"
        echo "[$timestamp] Firefox $channel download completed" >> "$log_file"
    else
        echo "Error: Download failed"
        echo "[$timestamp] Firefox $channel download failed" >> "$log_file"
        return 1
    fi
    
    # Install Firefox
    echo "Installing Firefox..."
    local mount_point="/tmp/firefox_${channel}_mount"
    mkdir -p "$mount_point"
    
    if hdiutil attach "$firefox_dmg" -mountpoint "$mount_point" -quiet; then
        # Remove existing installation
        if [ -d "/Applications/Firefox.app" ]; then
            rm -rf "/Applications/Firefox.app"
        fi
        
        # Copy new installation
        if cp -R "$mount_point/Firefox.app" "/Applications/"; then
            echo "Firefox $channel installed successfully"
            echo "[$timestamp] Firefox $channel installed successfully" >> "$log_file"
            
            # Apply enterprise policies if enabled
            if [ "$ENABLE_ENTERPRISE_POLICIES" = "true" ]; then
                apply_enterprise_policies
            fi
        else
            echo "Error: Installation failed"
            echo "[$timestamp] Firefox $channel installation failed" >> "$log_file"
        fi
        
        hdiutil detach "$mount_point" -quiet
    else
        echo "Error: Failed to mount disk image"
        echo "[$timestamp] Failed to mount Firefox $channel disk image" >> "$log_file"
    fi
    
    # Cleanup
    rm -rf "$download_dir"
}

configure_enterprise_policies() {
    echo "======================================="
    echo "Configure Enterprise Policies"
    echo "======================================="
    
    local policies_dir="/Applications/Firefox.app/Contents/Resources/distribution"
    local policies_file="$policies_dir/policies.json"
    
    echo "Creating enterprise policies configuration..."
    
    # Create distribution directory
    mkdir -p "$policies_dir"
    
    # Generate policies.json
    cat > "$policies_file" << EOF
{
  "policies": {
    "DisableTelemetry": $DISABLE_TELEMETRY,
    "DisableFirefoxStudies": $DISABLE_STUDIES,
    "BlockAboutConfig": $BLOCK_ABOUT_CONFIG,
    "Homepage": {
      "URL": "$HOMEPAGE_URL",
      "Locked": true
    },
    "DisableSystemAddonUpdate": true,
    "DisableAppUpdate": $([ "$AUTO_UPDATE_ENABLED" = "true" ] && echo "false" || echo "true"),
    "NoDefaultBookmarks": true,
    "OfferToSaveLogins": false,
    "PasswordManagerEnabled": false,
    "DisableDeveloperTools": $DISABLE_DEVELOPER_TOOLS,
    "DisablePrivateBrowsing": false,
    "DisableProfileImport": true,
    "DisableFeedbackCommands": true,
    "DisableFirefoxAccounts": false,
    "DisableForgetButton": true,
    "DisablePocket": true,
    "DisableSetDesktopBackground": true,
    "DisplayBookmarksToolbar": false,
    "DontCheckDefaultBrowser": true,
    "EnableTrackingProtection": {
      "Value": true,
      "Locked": true
    }
  }
}
EOF
    
    echo "policies configuration created"
    echo "[$timestamp] Enterprise policies configured" >> "$log_file"
    
    # Set appropriate permissions
    chmod 644 "$policies_file"
    
    echo "policies applied to Firefox installation"
}

apply_enterprise_policies() {
    echo "Applying enterprise policies..."
    configure_enterprise_policies
}

check_firefox_status() {
    echo "======================================="
    echo "Firefox Status Report"
    echo "======================================="
    
    local device_name=$(scutil --get ComputerName)
    local os_version=$(sw_vers -productVersion)
    
    echo "Device: $device_name"
    echo "macOS Version: $os_version"
    echo "Timestamp: $(date)"
    echo ""
    
    if [ -d "/Applications/Firefox.app" ]; then
        local firefox_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        local bundle_id=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleIdentifier 2>/dev/null || echo "Unknown")
        
        echo "Firefox Status: INSTALLED"
        echo "Version: $firefox_version"
        echo "Bundle ID: $bundle_id"
        echo "Installation Path: /Applications/Firefox.app"
        
        # Check if Firefox is running
        if pgrep -x "firefox" >/dev/null; then
            echo "Process Status: RUNNING"
        else
            echo "Process Status: NOT RUNNING"
        fi
        
        # Check enterprise policies
        local policies_file="/Applications/Firefox.app/Contents/Resources/distribution/policies.json"
        if [ -f "$policies_file" ]; then
            echo "Policies: CONFIGURED"
        else
            echo "Policies: NOT CONFIGURED"
        fi
        
        # Check application permissions
        echo "Application Permissions:"
        ls -la /Applications/Firefox.app | head -1
        
    else
        echo "Firefox Status: NOT INSTALLED"
    fi
}

generate_deployment_report() {
    echo "======================================="
    echo "Generate Deployment Report"
    echo "======================================="
    
    local report_file="/tmp/firefox_deployment_report_$(date +%Y%m%d_%H%M%S).txt"
    
    cat > "$report_file" << EOF
Roundfleet Firefox Deployment Report
Generated: $(date)
Organization: $ORGANIZATION_NAME

Device Information:
  Computer Name: $(scutil --get ComputerName)
  macOS Version: $(sw_vers -productVersion)
  Hardware Model: $(system_profiler SPHardwareDataType | grep "Model Name" | cut -d: -f2 | xargs)

Firefox Installation:
EOF
    
    if [ -d "/Applications/Firefox.app" ]; then
        local firefox_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        
        echo "  Status: Installed" >> "$report_file"
        echo "  Version: $firefox_version" >> "$report_file"
        echo "  Installation Date: $(stat -f "%Sm" /Applications/Firefox.app)" >> "$report_file"
        
        # Check enterprise policies
        local policies_file="/Applications/Firefox.app/Contents/Resources/distribution/policies.json"
        if [ -f "$policies_file" ]; then
            echo "  Enterprise Policies: Configured" >> "$report_file"
        else
            echo "  Enterprise Policies: Not Configured" >> "$report_file"
        fi
    else
        echo "  Status: Not Installed" >> "$report_file"
    fi
    
    cat >> "$report_file" << EOF

Configuration:
  Language: $FIREFOX_LANGUAGE
  Channel: $FIREFOX_CHANNEL
  Auto Update: $AUTO_UPDATE_ENABLED
  Enterprise Policies: $ENABLE_ENTERPRISE_POLICIES

Contact: $IT_CONTACT
EOF
    
    echo "Deployment report generated: $report_file"
}

manage_firefox_profiles() {
    echo "======================================="
    echo "Manage Firefox Profiles"
    echo "======================================="
    
    local profiles_dir="$HOME/Library/Application Support/Firefox/Profiles"
    
    echo "Firefox profiles directory: $profiles_dir"
    
    if [ -d "$profiles_dir" ]; then
        echo "Found Firefox profiles:"
        ls -la "$profiles_dir"
        
        echo ""
        echo "Profile management options:"
        echo "1. List all profiles"
        echo "2. Create new profile"
        echo "3. Remove profile"
        echo "4. Export profile"
        echo "5. Import profile"
        echo "6. Back to main menu"
        
        read -p "Select option (1-6): " profile_choice
        
        case $profile_choice in
            1)
                list_firefox_profiles
                ;;
            2)
                create_firefox_profile
                ;;
            3)
                remove_firefox_profile
                ;;
            4)
                export_firefox_profile
                ;;
            5)
                import_firefox_profile
                ;;
            6)
                return
                ;;
            *)
                echo "Invalid option."
                ;;
        esac
    else
        echo "No Firefox profiles directory found."
        echo "Firefox may not have been launched yet."
    fi
}

list_firefox_profiles() {
    echo "Firefox Profiles:"
    /Applications/Firefox.app/Contents/MacOS/firefox -ProfileManager -no-remote &
    sleep 2
    pkill -f "firefox.*ProfileManager"
}

create_firefox_profile() {
    read -p "Enter profile name: " profile_name
    if [ -n "$profile_name" ]; then
        /Applications/Firefox.app/Contents/MacOS/firefox -CreateProfile "$profile_name"
        echo "Profile '$profile_name' created successfully"
    else
        echo "Profile name cannot be empty"
    fi
}

remove_firefox_profile() {
    echo "Warning: This will permanently delete the profile and all its data."
    read -p "Enter profile name to remove: " profile_name
    if [ -n "$profile_name" ]; then
        read -p "Are you sure you want to remove profile '$profile_name'? (y/N): " confirm
        if [ "$confirm" = "y" ] || [ "$confirm" = "Y" ]; then
            # Profile removal logic would go here
            echo "Profile removal functionality would be implemented here"
        else
            echo "Profile removal cancelled"
        fi
    fi
}

export_firefox_profile() {
    echo "Profile export functionality would be implemented here"
}

import_firefox_profile() {
    echo "Profile import functionality would be implemented here"
}

view_configuration() {
    echo "======================================="
    echo "Current Configuration"
    echo "======================================="
    
    if [ -f "/etc/roundfleet/firefox_config.conf" ]; then
        cat "/etc/roundfleet/firefox_config.conf"
    else
        echo "No configuration file found."
    fi
}

# Execute enterprise manager
enterprise_firefox_manager

Mass Deployment and Automation

Automated Firefox Update System

#!/bin/bash

# Automated Firefox update system
# Usage: ./automated_firefox_updater.sh

automated_firefox_updater() {
    local config_file="/etc/roundfleet/firefox_auto_update.conf"
    local log_file="/var/log/roundfleet_firefox_updates.log"
    local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
    
    # Check if running as root
    if [ "$EUID" -ne 0 ]; then
        echo "Error: This script must be run as root"
        exit 1
    fi
    
    # Create configuration if it doesn't exist
    if [ ! -f "$config_file" ]; then
        create_update_config
    fi
    
    source "$config_file"
    
    echo "[$timestamp] Automated Firefox updater started" >> "$log_file"
    
    # Check if updates are enabled
    if [ "$ENABLE_AUTO_UPDATES" = "true" ]; then
        check_and_update_firefox
    else
        echo "Automatic updates are disabled"
        echo "[$timestamp] Automatic updates are disabled" >> "$log_file"
    fi
}

create_update_config() {
    mkdir -p /etc/roundfleet
    
    cat > "/etc/roundfleet/firefox_auto_update.conf" << 'EOF'
# Roundfleet Firefox Auto-Update Configuration

# Update settings
ENABLE_AUTO_UPDATES="true"
UPDATE_CHANNEL="release"
CHECK_INTERVAL="daily"
UPDATE_TIME="02:00"

# Safety settings
BACKUP_PROFILES="true"
BACKUP_RETENTION_DAYS="7"
REQUIRE_USER_CONSENT="false"
SKIP_IF_RUNNING="true"

# Notification settings
SEND_NOTIFICATIONS="true"
NOTIFICATION_EMAIL="[email protected]"
NOTIFY_ON_SUCCESS="true"
NOTIFY_ON_FAILURE="true"

# Enterprise settings
MAINTAIN_POLICIES="true"
PRESERVE_CUSTOMIZATIONS="true"
VERIFY_INSTALLATION="true"
EOF
    
    echo "Auto-update configuration created at /etc/roundfleet/firefox_auto_update.conf"
}

check_and_update_firefox() {
    echo "[$timestamp] Checking for Firefox updates" >> "$log_file"
    
    # Check if Firefox is installed
    if [ ! -d "/Applications/Firefox.app" ]; then
        echo "Firefox is not installed. Installing latest version..."
        install_firefox_latest
        return
    fi
    
    # Get current version
    local current_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
    
    # Check if Firefox is running and skip if configured
    if [ "$SKIP_IF_RUNNING" = "true" ] && pgrep -x "firefox" >/dev/null; then
        echo "Firefox is currently running. Skipping update."
        echo "[$timestamp] Firefox is running - update skipped" >> "$log_file"
        return
    fi
    
    # Create backup if enabled
    if [ "$BACKUP_PROFILES" = "true" ]; then
        backup_firefox_profiles
    fi
    
    # Download and check latest version
    local download_dir="/tmp/roundfleet_firefox_update"
    mkdir -p "$download_dir"
    
    local firefox_url="https://download.mozilla.org/?product=firefox-latest&os=osx&lang=en-US"
    local firefox_dmg="$download_dir/Firefox-latest.dmg"
    
    echo "Downloading latest Firefox version for comparison..."
    if curl -L -s -o "$firefox_dmg" "$firefox_url"; then
        # Mount and check version
        local mount_point="/tmp/firefox_update_mount"
        mkdir -p "$mount_point"
        
        if hdiutil attach "$firefox_dmg" -mountpoint "$mount_point" -quiet; then
            local latest_version=$(defaults read "$mount_point/Firefox.app/Contents/Info.plist" CFBundleShortVersionString 2>/dev/null || echo "Unknown")
            
            echo "Current version: $current_version"
            echo "Latest version: $latest_version"
            
            if [ "$current_version" != "$latest_version" ]; then
                echo "Update available. Updating Firefox..."
                echo "[$timestamp] Update available - Current: $current_version, Latest: $latest_version" >> "$log_file"
                
                # Perform update
                update_firefox_installation "$mount_point"
                
                # Verify update
                if verify_firefox_update "$latest_version"; then
                    echo "Firefox updated successfully to version $latest_version"
                    echo "[$timestamp] Firefox updated successfully to version $latest_version" >> "$log_file"
                    
                    if [ "$SEND_NOTIFICATIONS" = "true" ] && [ "$NOTIFY_ON_SUCCESS" = "true" ]; then
                        send_update_notification "success" "$current_version" "$latest_version"
                    fi
                else
                    echo "Firefox update verification failed"
                    echo "[$timestamp] Firefox update verification failed" >> "$log_file"
                    
                    if [ "$SEND_NOTIFICATIONS" = "true" ] && [ "$NOTIFY_ON_FAILURE" = "true" ]; then
                        send_update_notification "failure" "$current_version" "$latest_version"
                    fi
                fi
            else
                echo "Firefox is already up to date (version $current_version)"
                echo "[$timestamp] Firefox is already up to date (version $current_version)" >> "$log_file"
            fi
            
            hdiutil detach "$mount_point" -quiet
        else
            echo "Failed to mount Firefox disk image"
            echo "[$timestamp] Failed to mount Firefox disk image for update check" >> "$log_file"
        fi
    else
        echo "Failed to download Firefox for version check"
        echo "[$timestamp] Failed to download Firefox for version check" >> "$log_file"
    fi
    
    # Cleanup
    rm -rf "$download_dir"
}

install_firefox_latest() {
    echo "Installing latest Firefox version..."
    
    local download_dir="/tmp/roundfleet_firefox_install"
    mkdir -p "$download_dir"
    
    local firefox_url="https://download.mozilla.org/?product=firefox-latest&os=osx&lang=en-US"
    local firefox_dmg="$download_dir/Firefox.dmg"
    
    if curl -L --progress-bar -o "$firefox_dmg" "$firefox_url"; then
        local mount_point="/tmp/firefox_install_mount"
        mkdir -p "$mount_point"
        
        if hdiutil attach "$firefox_dmg" -mountpoint "$mount_point" -quiet; then
            if cp -R "$mount_point/Firefox.app" "/Applications/"; then
                local installed_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
                echo "Firefox installed successfully (version $installed_version)"
                echo "[$timestamp] Firefox installed successfully (version $installed_version)" >> "$log_file"
                
                # Apply enterprise policies if needed
                if [ "$MAINTAIN_POLICIES" = "true" ]; then
                    apply_enterprise_policies
                fi
            else
                echo "Failed to install Firefox"
                echo "[$timestamp] Failed to install Firefox" >> "$log_file"
            fi
            
            hdiutil detach "$mount_point" -quiet
        else
            echo "Failed to mount Firefox disk image"
            echo "[$timestamp] Failed to mount Firefox disk image for installation" >> "$log_file"
        fi
    else
        echo "Failed to download Firefox"
        echo "[$timestamp] Failed to download Firefox for installation" >> "$log_file"
    fi
    
    rm -rf "$download_dir"
}

update_firefox_installation() {
    local mount_point="$1"
    
    echo "Updating Firefox installation..."
    
    # Remove old installation
    if [ -d "/Applications/Firefox.app" ]; then
        rm -rf "/Applications/Firefox.app"
    fi
    
    # Install new version
    if cp -R "$mount_point/Firefox.app" "/Applications/"; then
        echo "Firefox application updated successfully"
        
        # Restore enterprise policies if enabled
        if [ "$MAINTAIN_POLICIES" = "true" ]; then
            apply_enterprise_policies
        fi
        
        # Preserve customizations if enabled
        if [ "$PRESERVE_CUSTOMIZATIONS" = "true" ]; then
            restore_customizations
        fi
        
        return 0
    else
        echo "Failed to update Firefox application"
        return 1
    fi
}

verify_firefox_update() {
    local expected_version="$1"
    
    if [ -d "/Applications/Firefox.app" ]; then
        local actual_version=$(defaults read /Applications/Firefox.app/Contents/Info.plist CFBundleShortVersionString 2>/dev/null || echo "Unknown")
        
        if [ "$actual_version" = "$expected_version" ]; then
            return 0
        else
            echo "Version mismatch - Expected: $expected_version, Actual: $actual_version"
            return 1
        fi
    else
        echo "Firefox application not found after update"
        return 1
    fi
}

backup_firefox_profiles() {
    echo "Creating backup of Firefox profiles..."
    
    local profiles_dir="$HOME/Library/Application Support/Firefox"
    local backup_dir="/var/backups/roundfleet/firefox_profiles"
    local backup_timestamp=$(date +%Y%m%d_%H%M%S)
    
    mkdir -p "$backup_dir"
    
    if [ -d "$profiles_dir" ]; then
        if tar -czf "$backup_dir/firefox_profiles_backup_$backup_timestamp.tar.gz" -C "$HOME/Library/Application Support" "Firefox"; then
            echo "Firefox profiles backed up successfully"
            echo "[$timestamp] Firefox profiles backed up" >> "$log_file"
            
            # Clean up old backups
            find "$backup_dir" -name "firefox_profiles_backup_*.tar.gz" -mtime +$BACKUP_RETENTION_DAYS -delete
        else
            echo "Failed to backup Firefox profiles"
            echo "[$timestamp] Failed to backup Firefox profiles" >> "$log_file"
        fi
    else
        echo "Firefox profiles directory not found"
    fi
}

send_update_notification() {
    local status="$1"
    local old_version="$2"
    local new_version="$3"
    
    local notification_title="Roundfleet Firefox Update"
    local notification_message
    
    case $status in
        "success")
            notification_message="Firefox updated successfully from $old_version to $new_version"
            ;;
        "failure")
            notification_message="Firefox update failed - attempted to update from $old_version to $new_version"
            ;;
        *)
            notification_message="Firefox update status: $status"
            ;;
    esac
    
    # Use osascript to display notification
    osascript -e "display notification \"$notification_message\" with title \"$notification_title\""
    
    echo "[$timestamp] Update notification sent - Status: $status" >> "$log_file"
}

apply_enterprise_policies() {
    echo "Applying enterprise policies..."
    # This would call the enterprise policy configuration function
    # Implementation depends on the specific policy requirements
}

restore_customizations() {
    echo "Restoring customizations..."
    # This would restore any custom configurations
    # Implementation depends on the specific customization requirements
}

# Execute automated updater
automated_firefox_updater

Troubleshooting and Best Practices

Common Issues and Solutions

1. Network Connectivity: Ensure stable internet connection for downloads
2. Permissions: Run installation scripts with appropriate privileges
3. Disk Space: Verify sufficient disk space before installation
4. Existing Processes: Check for running Firefox processes before updates
5. Enterprise Policies: Validate policy configurations after deployment

Best Practices

• Test Deployments: Always test in controlled environments first
• Backup Profiles: Create backups before major updates
• Monitor Installations: Use logging and monitoring for enterprise deployments
• Version Control: Track Firefox versions across your fleet
• Security Updates: Prioritize security updates and patches

Conclusion

Firefox deployment and management on macOS requires careful planning and execution. These scripts provide comprehensive solutions for installing, updating, and managing Firefox across Mac fleets. From basic installations to enterprise-grade automation, these tools ensure consistent and secure Firefox deployments while maintaining organizational policies and user preferences.