How to Use the bless Command in macOS Terminal to Configure Startup Disks and Boot Targets

While standard Mac users select their startup disk through the graphical System Settings menu (General > Startup Disk) or by holding the physical Power button/Option key during boot, system administrators, enterprise deployment engineers, and advanced terminal power users often need to configure boot parameters programmatically. Under macOS, the underlying system utility responsible for making volumes bootable and informing firmware which operating system to load is bless.

Located in /usr/sbin/bless, this legacy utility manages the core EFI boot pointers, “blessed” system folders, bootloader paths, and boot options for APFS volume groups and external disks. This guide explains how bless functions, its essential command syntax, how it interacts with modern Apple Silicon security, and how to safely inspect and modify boot targets.

What Does “Blessing” a Disk Mean?

In macOS architecture, simply copying an operating system or kernel onto a formatted APFS container does not make the disk bootable. The motherboard firmware (EFI on Intel Macs; iBoot/Secure Enclave on Apple Silicon) requires explicit cryptographic pointers and boot manifest records indicating which Mach-O binary to execute upon initialization.

When you “bless” a volume, the bless command:

• Writes volume directory IDs and inode metadata into the volume’s superblock or preboot volume.
• Specifies the precise path to the boot.efi bootloader binary.
• Updates NVRAM firmware variables (such as efi-boot-device) so the Mac automatically boots into the designated volume without presenting a boot picker menu.
• Sets custom boot flags, such as booting into recovery mode or single-user diagnostic mode.

Permissions and System Integrity Protection (SIP) Considerations

Because modifying boot targets directly alters firmware variables, executing bless commands requires superuser privileges via sudo. Furthermore, on modern macOS versions with System Integrity Protection (SIP) and the Signed System Volume (SSV), blessing sealed system snapshots or modifying the active boot path often requires running within recoveryOS or authenticating with Secure Enclave owner credentials.

Essential bless Commands and Practical Syntax

1. Inspecting the Current Boot Device

To view which volume and bootloader binary are currently blessed as the default startup target, execute:

sudo bless --info --getBoot

To inspect a specific mounted APFS volume or external drive:

sudo bless --info /Volumes/ExternalmacOS

The command outputs the blessed folder inode, the path to boot.efi, and the firmware EFI device path string.

2. Setting a Startup Disk and Immediately Rebooting

To select an alternate mounted volume as the permanent startup disk and trigger an immediate reboot:

sudo bless --mount /Volumes/ProductionHD --setBoot --nextonly

Parameter breakdown:

• --mount <path>: Points to the root mount point of the target macOS volume.
• --setBoot: Updates the Mac’s NVRAM to make this volume the permanent default startup disk for future power cycles.
• --nextonly: Configures the designated volume for the very next boot cycle only. Subsequent restarts will automatically revert to your standard system drive. This is invaluable when testing operating system upgrades or installer partitions remotely.

3. Blessing an External Bootable Installer Flash Drive

When creating custom bootable USB installers or diagnostic environments from the command line:

sudo bless --folder "/Volumes/Install macOS/System/Library/CoreServices" --booter "/Volumes/Install macOS/System/Library/CoreServices/boot.efi" --create-snapshot

Comparing Key bless Flags and Capabilities

Flag / Option	Function	Primary Use Case
--info [<path>]	Prints the blessed folder and bootloader path	Auditing active boot targets and diagnosing unbootable drives
--mount <path>	Specifies the mount point of the target volume	Standard volume targeting in APFS environments
--setBoot	Permanently updates NVRAM default boot device	Switching default operating systems across dual-boot setups
--nextonly	Restricts boot change strictly to the next reboot	Safe automated patch testing and maintenance reboot scripts
--netboot	Configures the Mac to boot from an authorized network server	Legacy enterprise deployment and remote network imaging

Apple Silicon Architecture Differences

On Apple Silicon Macs (M1/M2/M3/M4), the boot architecture differs fundamentally from legacy Intel EFI:

• Apple Silicon does not rely purely on NVRAM variables to determine boot targets. Instead, the Secure Enclave enforces Local Boot Policies (LocalPolicy) cryptographically signed by an owner identity.
• While bless --mount <path> --setBoot remains functional in terminal scripts on Apple Silicon, macOS prompts for an authorized administrator password to sign the LocalPolicy update.
• For low-level security adjustments (such as enabling third-party kernel extensions or permissive security), pair bless with the specialized bputil utility in recoveryOS.

Troubleshooting Unbootable Drives with bless

If a cloned or restored macOS installation fails to appear in the Startup Disk menu or boots to a flashing folder with a question mark:

1. Boot your Mac into recoveryOS (hold Power button on Apple Silicon; hold Cmd + R on Intel).
2. Launch Terminal from the Utilities menu.
3. Verify that the volume is mounted: diskutil list.
4. Re-bless the volume explicitly:

   bless --mount "/Volumes/Macintosh HD" --setBoot

5. Restart the computer to confirm the firmware recognizes the restored boot path.