How to check if your Apple Silicon Mac is booting securely • Hacker News Board

Re: How to check if your Apple Silicon Mac is booting securely

#11

Post by arcticbull » Mon, Aug 25, 2025, 3:19 AM UTC

userbinator wrote: post #2

s/booting securely/running only the code Apple approves of/g

Not exactly, distribution conversation aside this is specific to kernel extensions. Apple's been moving drivers out of kernel space and into user space for several years [1]. There's a lot of good reasons for doing so, and not a lot of drawbacks. I'd consider this to be a strongly worded API deprecation notice.

[1] https://developer.apple.com/documentation/driverkit

Re: How to check if your Apple Silicon Mac is booting securely

#12

Post by ostensible » Mon, Aug 25, 2025, 3:28 AM UTC

`man csrutil`

Re: How to check if your Apple Silicon Mac is booting securely

#13

Post by Gigachad » Mon, Aug 25, 2025, 3:56 AM UTC

bapak wrote: post #3

userbinator wrote: post #2

s/booting securely/running only the code Apple approves of/g

You can run unverified code if you build it yourself. You can distribute unverified code by just paying $99/year to Apple. Not great, but still no need for specific code approval.

You can run whatever scripts you want without paying anything. Pretty sure the signing thing only applies to .app programs.

Re: How to check if your Apple Silicon Mac is booting securely

#14

Post by cyberax » Mon, Aug 25, 2025, 4:06 AM UTC

Barbing wrote: post #8

cyberax wrote: post #7

Earlier quoted context omitted.

Not if you want to use some features like bridged networking. For that you need to go and beg Apple for an entitlement. Or you have to disable SIP entirely.

They respond to the begging as incredibly well as they respond to feedback/bug reports, right?

To be fair, they _do_ respond well in this particular case. But you have to write an email to a developer somewhere in Apple, as there is no established process.

Re: How to check if your Apple Silicon Mac is booting securely

#15

Post by saagarjha » Mon, Aug 25, 2025, 6:31 AM UTC

Note that checking anything in userspace on a compromised machine does not actually prove that the machine is not compromised. It is very easy to boot insecurely and then make everything lie that the boot was secure.

Re: How to check if your Apple Silicon Mac is booting securely

#16

Post by nottorp » Mon, Aug 25, 2025, 9:01 AM UTC

arcticbull wrote: post #10

Barbing wrote: post #6

Earlier quoted context omitted.

Interesting. They need that for lowest-possible latency? And it should be fairly safe?

Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple dr…

How about file system drivers? If there is such a thing any more... fuse and friends...

Re: How to check if your Apple Silicon Mac is booting securely

#17

Post by SebFender » Mon, Aug 25, 2025, 12:34 PM UTC

bduhan wrote: post #4

I had to do this today for a Universal Audio Apollo audio interface. Glad it’s on a dedicated machine. https://help.uaudio.com/hc/en-us/articles/360057137692-Apple...

UAD drivers have always been very creative... lol

Re: How to check if your Apple Silicon Mac is booting securely

#18

Post by Citizen8396 » Mon, Aug 25, 2025, 1:48 PM UTC

saagarjha wrote: post #15

Note that checking anything in userspace on a compromised machine does not actually prove that the machine is not compromised. It is very easy to boot insecurely and then make everything lie that the boot was secure.

Recovery exists in a separate partition protected by SIP; it's set up this way to so that 99.99% of scenarios require a local, physical attack. "recoveryOS" is also bound to the specific APFS volume of the device. There's more to it than that, but you can be reasonably sure that recoveryOS isn't lying to you.

Sure, you can make an argument someone gave you a special device with a fake OS... but anyone willing to do that has much more simple ways to fuck with you.

Re: How to check if your Apple Silicon Mac is booting securely

#19

Post by Citizen8396 » Mon, Aug 25, 2025, 1:49 PM UTC

Barbing wrote: post #5

Useful, thank you! Looks like the author just enjoys helping fellow nerds. Nice

His site is filled with gems like this one.

Re: How to check if your Apple Silicon Mac is booting securely

#20

Post by _mlbt » Mon, Aug 25, 2025, 1:58 PM UTC

nottorp wrote: post #16

arcticbull wrote: post #10

Earlier quoted context omitted.

Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple dr…

How about file system drivers? If there is such a thing any more... fuse and friends...

There is a port of FUSE for macOS, and Apple also has a first party API for this called FSKit…

https://developer.apple.com/documentation/fskit