Executable file flag


Executables on macOS require a special "Executable flag".

If you have installed RR via Windows, it might be that this flag was not set on your fileserver.

In this case use the Royal Render Installer and start it on any macOS machine. 
Do not use it for re-installing Royal Render, just browse to the RR folder and use the button "Apply executable right only".



MacOS 10.15+  Security Restrictions


Allow file access


There is a new security feature to prevent applications from accessing files, network shares or control other applications.

You might not even be able to start any Royal Render application at all. (Error message like "Unable to access globalconfig.ini").


Most of the time macOS asks you if you want to add the application the first time you try to start it/try to render.

But this does not happen for all applications.


File access - Manual


Please open your macOS preferences "Security & Pricacy", tab "Privacy".


Then you have to select a section of Privacy in your macOS preference window.

And then DragNDrop a application from a Finder window into the prefs window.
You can use the Finder menu "Go/Go to Folder" to open the application folder (e.g. "/bin").

Some settings cannot be added manually, you have to start a render and wait for the macOS question dialog or use MDM


Application

Application to add

Privacy Section 

Royal Render - start any rrApp

/bin/bash

Full Disk Access

Royal Render - start any rrApp

[RR]/bin/macOS/rrStartlocal

Full Disk Access

After Effects - Rendering

/Applications/Adobe After Effects

Full Disk Access

Files and Folders - Network Volumes (only possible with MDM or macOS dialog)
Automation - Finder (only possible with MDM or macOS dialog)

Cinema4D - Job Submission

/bin/bash

Full Disk Access




Allow signed apps 



You have to allow your MacOS to run applications that are signed, but not downloaded via the app store.

Please open your System Preferences and verify that the Security Setting is "App Store and indetidied developers":








MDM Managed Macs


You can set these kind of preferences on MDM managed Macs by pushing signed profiles to preemptively white-list signed applications.
This isn’t feasible for a few machines if you’re not running a MDM.

The process is quite detailed, but it uses a well documented profile setup (175 pages to cover the basics)
Look at the section on page 64:   https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf#page64

Here is a very not short (but as short as can be reasonably made) guide for an engineer or team thinking about adding this to your MDM.

https://derflounder.wordpress.com/2018/08/31/creating-privacy-preferences-policy-control-profiles-for-macos/


There are some tools to create TCC profiles like this one:

https://github.com/jamf/PPPC-Utility





 Mount Fileserver shares


You have 3 options to mount your file shares.

1) You tell the rrClient to mount shares.

Please open rrConfig, tab "paths and drives" and add your fileserver share.

This does not work for the Royal Render share if you have installed the RR daemon. As the daemon starts the rrClient and the rrClient can then mount shares.


2) You login at the workstation and mount the drives via the users startup.

Then you start the rrClient in application mode (no background service).


3) You let the system mount all shares automatically

Please see next section.




Auto-Mount


If you want to use RR as background deamon, then you need to auto-mount the RR share at startup. (+the shares for your project data)


Before you auto-mount a share, you should always test if you can connect to the share with Finders menu item "Connect to Server" first.


There are a lot of forum post and tutorials  about how to mount a share automatically out there.

Please search for "auto_master".

There are even tutorials how to use a auto_smb script file to mount SMB/Samba shares.

But we have not found a way to mount a share that is usable by multiple users on the same system.

Therefore we recommend that you enable NFS shares on your fileserver.



Speed up SMB shares



There are a few settings you can tweak to make your SMB connection faster.


1. DS_Store files
Speed up Finder by disabling the creation, read and usage of DS_Store files.
Open a Terminal and execute this command 

defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool TRUE



2. Speed up SMB connection itself
Open a Terminal and execute
sudo nano /etc/nsmb.conf

to edit the config file for smb connections. (If the file does not exist, it is created).
We have added a description for each option, so you can choose which options you like.
Adding a # in front of an option disabled it.

After you are done with the changes, press [Control]-[X], then [y], then [return].
Then restart your Mac.



# Always required:

[default]


# Use NTFS streams if supported (neutral)

streams=yes


# Some Wi-Fi networks advertise faster speeds than the connected wired network.  (neutral)

mc_prefer_wired=yes


# Enable multi-channel support  (neutral)

mc_on=yes


# Use SMB version 3 only (improves security)
# All newer fileshares support it.
# You can check your current mount if you already use it with the Terminal command "smbutil statshares -a"

protocol_vers_map=4


# No SMB1, so we disable NetBIOS (improves security)

port445=no_netbios




# Disable signing (decreases security, man-in-the-middle attacks)

# Do not use in an open network that can be accessed by someone outside.
# Note that you can check if signing is used by your SMB connection or not. Open a Terminal and run the command

# smbutil statshares -a  
# It prints SIGNING_ON  (not to be confused with SIGNING_SUPPORTED)

signing_required=no


# Disable negotiation validation (decreases security, man-in-the-middle attacks)
# Do not use in an open network that can be accessed by someone outside.

validate_neg_off=yes




# Soft mount by default. (neutral, but could impact data availability)

# "Hard" mounts block the system if there is a connection issue. 

#  A "Soft" mount caches the data and returns an timeout error if the fileserver is not available

# soft=yes


# Disable directory caching (neutral, but impacts performance)

dir_cache_max_cnt=0

dir_cache_max=0

dir_cache_off=yes


# Disable change notifications (neutral, but might affect operational efficiency)

notify_off=yes