3 ms·

They can be configured to boot other operating systems, see https://support.apple.com/guide/mac-help/macos-recovery-a-mac-apple-silicon-mchl82829c17/11.0/mac/11

by my123 6y ago

They can be configured to boot other operating systems, see https://support.apple.com/guide/mac-help/macos-recovery-a-mac-apple-silicon-mchl82829c17/11.0/mac/11.0#mchl9b13cbdc https://support.apple.com/guide/mac-help/macos-recovery-a-ma....

Someone 6y ago
From that page: “Review the following security options: Full Security: Ensures that only your current OS, or signed operating system software currently trusted by Apple, can run. This mode requires a network connection at software installation time. Reduced Security: Allows any version of signed operating system software ever trusted by Apple to run.” ⇒ it appears ‘other’ still requires OSes signed by Apple, but it allows you to run an OS even if Apple has no longer trusts it. Or am I misreading that? So, there might be Apple-signed Linuxes, but I wouldn’t hold my breadth for that.
- my123 6y ago
  See this "option only appears when you run csrutil disable", which is the one that you need for third-party OSes, and doesn't impose any requirements on the OS that you boot.
  - EgoIncarnate 6y ago
    Looks like they removed "Permissive Security" mode from the support document in an update. You can still find it in https://web.archive.org/web/20201117164532/https://support.apple.com/guide/mac-help/macos-recovery-a-mac-apple-silicon-mchl82829c17/11.0/mac/11.0 https://web.archive.org/web/20201117164532/https://support.a.... Hope they don't remove this option in the firmware.
- zinekeller 6y ago
  Edit: so like Secure Boot with only Windows key, Secure Boot with Microsoft-approved key (note that the key used for Windows and key for Linux signing is different) and Secure Boot disable. Eh, I read reduced mode as basically how secure boot works on hardware with Microsoft-only keys in which MS signs a shim and it automatically blesses desendants (technically the OEM is not restricted to put other keys on the key database, but aside from business computers it seems that most machines have only Microsoft and OEM keys). Of course, Microsoft has a stronger incentive to sign these (or else they will be accused of antitrust violations), so Apple might not do that.

by my123 6y ago

Someone 6y ago

From that page: “Review the following security options: Full Security: Ensures that only your current OS, or signed operating system software currently trusted by Apple, can run. This mode requires a network connection at software installation time. Reduced Security: Allows any version of signed operating system software ever trusted by Apple to run.” ⇒ it appears ‘other’ still requires OSes signed by Apple, but it allows you to run an OS even if Apple has no longer trusts it. Or am I misreading that? So, there might be Apple-signed Linuxes, but I wouldn’t hold my breadth for that.

my123 6y ago
See this "option only appears when you run csrutil disable", which is the one that you need for third-party OSes, and doesn't impose any requirements on the OS that you boot.
- EgoIncarnate 6y ago
  Looks like they removed "Permissive Security" mode from the support document in an update. You can still find it in https://web.archive.org/web/20201117164532/https://support.apple.com/guide/mac-help/macos-recovery-a-mac-apple-silicon-mchl82829c17/11.0/mac/11.0 https://web.archive.org/web/20201117164532/https://support.a.... Hope they don't remove this option in the firmware.
zinekeller 6y ago
Edit: so like Secure Boot with only Windows key, Secure Boot with Microsoft-approved key (note that the key used for Windows and key for Linux signing is different) and Secure Boot disable. Eh, I read reduced mode as basically how secure boot works on hardware with Microsoft-only keys in which MS signs a shim and it automatically blesses desendants (technically the OEM is not restricted to put other keys on the key database, but aside from business computers it seems that most machines have only Microsoft and OEM keys). Of course, Microsoft has a stronger incentive to sign these (or else they will be accused of antitrust violations), so Apple might not do that.