1

Any change I made to /private/etc/hosts file can't be persisted. After a while(like 10 minitues), the file will be overwritten. How can I find out the root cause of this problem? Or can I make the file immutable like using chattr under Linux?

No suspicious software(like cisco VPN) is installed. No strange file exists(like /etc/hosts.ac). I do have installed some VPN software like tunnelblick and pulse secure.

1

It turns out to be same problem with VPN software on this link

In my situation, it's /etc/pulse-hosts.bak. I suggest use ls -lha /etc/*hosts* to list all suspicious files so you can't miss anyone.

Tools to trace file modification:sudo opensnoop 2>/dev/null | grep hosts

Tools to disable change to hosts file(in case you can't find any clue): sudo chflags schg /etc/hosts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.