<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""></div> Maybe you could make this a MR?<div class=""><br class=""></div><div class=""> Barry</div><div class=""><br class=""></div><div class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Aug 28, 2020, at 2:17 PM, Hapla Vaclav <<a href="mailto:vaclav.hapla@erdw.ethz.ch" class="">vaclav.hapla@erdw.ethz.ch</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div class="">On MacOS, maybe you also have lots of firewall popups appearing/disappearing when running tests like</div>
<div class=""> Do you want the application "ex29" to accept incoming network connections?</div>
<div class=""><br class="">
</div>
<div class="">They are annoying, disturbing, slowing down, and virtually making any other work on the computer impossible (and driving me crazy).</div>
<div class=""><br class="">
</div>
<div class="">There is not much information about this issue. Usually the hints involve enabling each application separately in Firewall settings (no support for wildcards), which is virtually impossible to do with all PETSc test executables (and not really
working for me).</div>
<div class=""><br class="">
</div>
<div class="">Some guys suggest signing the app <a href="https://apple.stackexchange.com/a/150711" class="">using codesign</a> which also didn't work for me.</div>
<div class=""><br class="">
</div>
<div class="">But I have finally found a reliable solution. <span style="caret-color: rgb(0, 0, 0);" class="">So I'm sharing it, also for my own reference - not sure whether it could be added to PETSc directly in some form.</span></div>
<div class=""><br class="">
</div>
<div class="">It consists in applying a small makefile patch (below) which uses MacOS firewall CLI <span style="caret-color: rgb(0, 0, 0);" class="">(which is not much advertised)</span>. This way, make adds the executable to the firewall
whitelist right after it's produced by a linker. </div>
<div class=""><br class="">
</div>
<div class="">It uses sudo so it asks for your password for the first time.</div>
<div class=""><br class="">
</div>
<div class="">Please let me know if you have a better solution - except of disabling the firewall ;-) - or other comments/questions.</div>
<div class=""><br class="">
</div>
<div class="">See also</div>
<div class="">* <a href="http://www.manpagez.com/man/8/socketfilterfw/" class="">man socketfilterfw</a></div>
<div class="">* <a href="https://krypted.com/mac-security/command-line-firewall-management-in-os-x-10-10/" class="">https://krypted.com/mac-security/command-line-firewall-management-in-os-x-10-10/</a></div>
<div class=""><br class="">
</div>
<div class="">Vaclav</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">diff --git a/gmakefile.test b/gmakefile.test<br class="">
index 95ff59b4ab..c513a0bc0c 100644<br class="">
--- a/gmakefile.test<br class="">
+++ b/gmakefile.test<br class="">
@@ -192,18 +192,37 @@ $(TESTDIR)/snes/tests/ex1: PETSC_TEST_LIB = $(PETSC_SNES_LIB)<br class="">
$(TESTDIR)/ts/tests/ex2: PETSC_TEST_LIB = $(PETSC_TS_LIB)<br class="">
$(TESTDIR)/tao/tutorials/ex1: PETSC_TEST_LIB = $(PETSC_TAO_LIB)<br class="">
<br class="">
+define macos-firewall-register<br class="">
+ @APP=$(call abspath, $(1)); \<br class="">
+ FW=/usr/libexec/ApplicationFirewall/socketfilterfw; \<br class="">
+ if ! $$FW --getappblocked $$APP | grep 'is permitted' > /dev/null; then \<br class="">
+ sudo $$FW --add $$APP && \<br class="">
+ sudo $$FW --unblock $$APP; \<br class="">
+ fi<br class="">
+endef<br class="">
+<br class="">
+# Ensure mpiexec.hydra and test executable is on firewall list<br class="">
+define macos-firewall-fix<br class="">
+ $(call macos-firewall-register, $(shell which mpiexec.hydra))<br class="">
+ $(call macos-firewall-register, $(1))<br class="">
+endef<br class="">
+<br class="">
# Test executables<br class="">
$(testexe.F) $(testexe.F90) : $(TESTDIR)/% : $(TESTDIR)/%.o $$^ $(libpetscall)<br class="">
$(call quiet,FLINKER) -o $@ $^ $(PETSC_TEST_LIB)<br class="">
+ $(call macos-firewall-fix,$@)<br class="">
<br class="">
$(testexe.c) $(testexe.cu) : $(TESTDIR)/% : $(TESTDIR)/%.o $$^ $(libpetscall)<br class="">
$(call quiet,CLINKER) -o $@ $^ $(PETSC_TEST_LIB)<br class="">
+ $(call macos-firewall-fix,$@)<br class="">
<br class="">
$(testexe.kokkos.cxx) : $(TESTDIR)/% : $(TESTDIR)/%.o $$^ $(libpetscall)<br class="">
$(call quiet,PETSC_LINK.kokkos.cxx) -o $@ $^ $(PETSC_TEST_LIB)<br class="">
+ $(call macos-firewall-fix,$@)<br class="">
<br class="">
$(testexe.cxx) : $(TESTDIR)/% : $(TESTDIR)/%.o $$^ $(libpetscall)<br class="">
$(call quiet,CXXLINKER) -o $@ $^ $(PETSC_TEST_LIB)<br class="">
+ $(call macos-firewall-fix,$@)<br class="">
<br class="">
# Fortran source files need petsc*.mod, which isn't explicitly managed in the makefile.<br class="">
$(foreach pkg, $(pkgs), $(call concattestlang,$(pkg),F F90)) : $(libpetscall)</div>
</div>
</div></blockquote></div><br class=""></div></body></html>