How to check if your Apple Silicon Mac is booting securely (opens in new tab)

(eclecticlight.co)

101 pointsshorden7mo ago22 comments

22 comments

Note that checking anything in userspace on a compromised machine does not actually prove that the machine is not compromised. It is very easy to boot insecurely and then make everything lie that the boot was secure.

Citizen83967mo ago

Recovery exists in a separate partition protected by SIP; it's set up this way to so that 99.99% of scenarios require a local, physical attack. "recoveryOS" is also bound to the specific APFS volume of the device. There's more to it than that, but you can be reasonably sure that recoveryOS isn't lying to you.

Sure, you can make an argument someone gave you a special device with a fake OS... but anyone willing to do that has much more simple ways to fuck with you.

bduhan7mo ago

I had to do this today for a Universal Audio Apollo audio interface. Glad it’s on a dedicated machine.

https://help.uaudio.com/hc/en-us/articles/360057137692-Apple...

Barbing7mo ago

Interesting. They need that for lowest-possible latency? And it should be fairly safe?

arcticbull7mo ago

Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple drops the hammer.

1 more reply

SebFender7mo ago

UAD drivers have always been very creative... lol

userbinator7mo ago

s/booting securely/running only the code Apple approves of/g

arcticbull7mo ago

Not exactly, distribution conversation aside this is specific to kernel extensions. Apple's been moving drivers out of kernel space and into user space for several years [1]. There's a lot of good reasons for doing so, and not a lot of drawbacks. I'd consider this to be a strongly worded API deprecation notice.

[1] https://developer.apple.com/documentation/driverkit

bapak7mo ago

You can run unverified code if you build it yourself. You can distribute unverified code by just paying $99/year to Apple. Not great, but still no need for specific code approval.

cyberax7mo ago

Not if you want to use some features like bridged networking. For that you need to go and beg Apple for an entitlement. Or you have to disable SIP entirely.

1 more reply

Gigachad7mo ago

You can run whatever scripts you want without paying anything. Pretty sure the signing thing only applies to .app programs.

Barbing7mo ago

Useful, thank you! Looks like the author just enjoys helping fellow nerds. Nice

8ig87mo ago

Dr Howard Oakley. I think of him as an OG Mac guy.

Citizen83967mo ago

His site is filled with gems like this one.

daft_pink7mo ago

The problem is if you enable filevault then you can’t ssh into the mac remotely until someone locally logs in.

Means I end up using filevault on my laptop, but not on my desktop.

ostensible7mo ago

`man csrutil`

j / k navigate · click thread line to collapse

22 comments

saagarjha7mo ago

Citizen83967mo ago

Sure, you can make an argument someone gave you a special device with a fake OS... but anyone willing to do that has much more simple ways to fuck with you.

bduhan7mo ago

I had to do this today for a Universal Audio Apollo audio interface. Glad it’s on a dedicated machine.

https://help.uaudio.com/hc/en-us/articles/360057137692-Apple...

Barbing7mo ago

Interesting. They need that for lowest-possible latency? And it should be fairly safe?

arcticbull7mo ago

1 more reply

SebFender7mo ago

UAD drivers have always been very creative... lol

userbinator7mo ago

s/booting securely/running only the code Apple approves of/g

arcticbull7mo ago

[1] https://developer.apple.com/documentation/driverkit

bapak7mo ago

You can run unverified code if you build it yourself. You can distribute unverified code by just paying $99/year to Apple. Not great, but still no need for specific code approval.

cyberax7mo ago

Not if you want to use some features like bridged networking. For that you need to go and beg Apple for an entitlement. Or you have to disable SIP entirely.

1 more reply

Gigachad7mo ago

You can run whatever scripts you want without paying anything. Pretty sure the signing thing only applies to .app programs.

Barbing7mo ago

Useful, thank you! Looks like the author just enjoys helping fellow nerds. Nice

8ig87mo ago

Dr Howard Oakley. I think of him as an OG Mac guy.

Citizen83967mo ago

His site is filled with gems like this one.

daft_pink7mo ago

The problem is if you enable filevault then you can’t ssh into the mac remotely until someone locally logs in.

Means I end up using filevault on my laptop, but not on my desktop.

ostensible7mo ago

`man csrutil`

j / k navigate · click thread line to collapse