3 ms·
How does moving system files to a read-only volume provide any additional protection on top of SIP, which prevents unsigned processes from writing to system fil
by ghostpepper 7y ago
How does moving system files to a read-only volume provide any additional protection on top of SIP, which prevents unsigned processes from writing to system files?
https://support.apple.com/en-us/HT204899 https://support.apple.com/en-us/HT204899
- J5892 7y agoI'm not sure, but I believe Chrome's /var symlink bug would have been prevented by that.
- pram 7y agoSIP had numerous exploits over the years, basically. The new volume provides additional isolation and utilizes native mechanisms in APFS to make it transparent to the user space. 'Defense in depth'