The Purpose of Gatekeeper
In the early days of macOS, users could download arbitrary software from the internet and execute it immediately. This led to massive malware outbreaks (like the MacDefender trojan). To secure the ecosystem, Apple introduced Gatekeeper.
Gatekeeper is a core security technology that enforces code signing. By default, macOS will only execute applications downloaded from the official Mac App Store or applications signed by a known Apple Developer ID. Furthermore, Apple introduced Notarization. Even if a developer has a valid ID, they must upload their compiled application to Apple’s servers for an automated malware scan. Only if it passes does Apple staple a “Notarization ticket” to the binary. If a binary is unsigned or unnotarized, Gatekeeper blocks it and displays a warning dialog.
While this protects average consumers, it is incredibly frustrating for enterprise developers building custom internal tools, or system administrators deploying legacy software that predates Notarization. The graphical System Settings only provides a button to allow an app after it has been blocked. To manage these rules programmatically and bypass restrictions securely, administrators use the spctl (System Policy Control) command.
Step 1: Checking the Status of Gatekeeper
Before modifying any rules, you should verify the current status of the Gatekeeper subsystem.
Open the Terminal and run:
spctl --statusThe output will typically say assessments enabled. This means Gatekeeper is actively verifying signatures and notarization tickets before allowing any application to execute.
(Historically, users could run sudo spctl --master-disable to completely turn off Gatekeeper and return the “Anywhere” option to System Preferences. Apple has heavily restricted this in modern macOS versions, and disabling Gatekeeper globally is considered a massive security violation.)
Step 2: Assessing an Application’s Signature
If you download a custom bash script or a proprietary enterprise binary and it fails to launch, you can use spctl to interrogate exactly why Gatekeeper rejected it.
Use the -a (assess) and -v (verbose) flags against the application bundle:
spctl -a -v /Applications/CustomTool.appIf the application is perfectly signed and notarized, the output will state:
/Applications/CustomTool.app: accepted
source=Notarized Developer IDIf the application lacks a notarization ticket or has a corrupted signature, the output will state rejected with an error code.
Step 3: Whitelisting a Specific Unsigned Application
Suppose you have an internally developed, unsigned diagnostic utility that your IT department must run on every Mac. Gatekeeper will block it. Instead of asking every single user to open System Settings, navigate to Privacy & Security, and click “Open Anyway”, you can use spctl to explicitly whitelist the specific application path.
You add an explicit add rule to the system policy database:
sudo spctl --add /Applications/InternalDiagTool.appOnce this command is executed, Gatekeeper registers an exception for that specific binary at that specific path. The user can now double-click the application, and it will launch immediately without any security warnings.
Step 4: Managing the Policy Database
The spctl command manages an underlying SQLite database of rules. When you use the --add flag, you are creating a permanent record.
To view every explicit exception currently registered in the Gatekeeper database, use the list command:
spctl --listThis will output a massive list of allowed developer certificates and custom application paths.
If you later discover that the InternalDiagTool.app contains a critical vulnerability and you want to revoke its execution privileges instantly, you can remove the exception from the database:
sudo spctl --remove /Applications/InternalDiagTool.appThe next time a user attempts to launch it, Gatekeeper will slam the door shut and display the standard blocking dialog.
Step 5: Managing Installer Packages (.pkg)
Gatekeeper doesn’t just protect applications (.app bundles); it also heavily polices installer packages (.pkg files) executed by the installer command or double-clicked by the user.
If you are deploying a custom .pkg via an MDM solution and it is failing to execute because it lacks a modern developer signature, you can assess the package explicitly by specifying the install type:
spctl -a -v --type install /Users/Shared/LegacyInstaller.pkgIf it is rejected, you can apply the same --add logic to the package path to allow the installation to proceed silently in the background.
Conclusion
Gatekeeper and App Notarization are arguably the most effective anti-malware mechanisms ever implemented in a desktop operating system. By mastering the spctl command, macOS administrators can navigate these strict security boundaries, intelligently interrogating failed binaries and explicitly whitelisting trusted internal tools without requiring end-users to override graphical security warnings.