5 ms·

Wait, did Apple actually add an option for unsigned boot on M1? I remember their WWDC overview saying they were only going to have either iPhone-style latest-ve

Wait, did Apple actually add an option for unsigned boot on M1? I remember their WWDC overview saying they were only going to have either iPhone-style latest-version-only or any-version options, and them later saying they'd only be supporting virtualization. If they have an owner override for the secure boot on M1, then that's absolutely fantastic, and I suppose puts more support around Apple's assertions that Microsoft needs to license Windows on ARM for M1 before we can have Boot Camp back.

Cu3PO42 6y ago
Yes, you can turn off all of the secure boot features. Booting other OSs is most likely coming.
- sethhochberg 6y ago
  Well, from what I understand its less "turn off secure boot features" and more "create/add a signature for your custom code to secure boot". https://mobile.twitter.com/never_released/status/1326315741080150016?prefetchtimestamp=1605311534821 https://mobile.twitter.com/never_released/status/13263157410... I can't find a primary source for the comment in the tweet, but it seems widely regarded as true at this point, so fingers crossed it pans out that way.
  - Cu3PO42 6y ago
    Hm, interesting. I can't seem to find my source anylonger either. The wording "kernel" does suggest to me that this is about a check a bootloader performs. If you were to boot another OS, you'd probably have a different boot loader as well. This tweet https://twitter.com/never_released/status/1332436771020435457 https://twitter.com/never_released/status/133243677102043545... from the same author suggests M1 is "not any more locked down than [...] Intel", so I'm not fully sure about the technical details, but in the end you should be able to boot your own code.
    - my123 6y ago
      The lowest security level, permissive, allows to mess with the Secure Boot policy at will. When you use kmutil to add a custom boot entry, enrolling the hash of your executable to the Secure Boot policy is handled automatically as part of the tool.
dan1234 6y ago
Yes, you can use recovery mode to set the ‘permissive’ security policy, which “Does not enforce any requirements on the bootable operating system”. https://support.apple.com/en-gb/guide/mac-help/mchl82829c17/11.0/mac/11.0#mchl9b13cbdc https://support.apple.com/en-gb/guide/mac-help/mchl82829c17/...
sigjuice 6y ago
https://developer.apple.com/videos/play/wwdc2020/10686/?time=1129 https://developer.apple.com/videos/play/wwdc2020/10686/?time... Reduced security allows you to run any version of macOS, including the versions that are no longer signed by Apple.
- saagarjha 6y ago
  You can go lower than that; this is the “medium” security setting.
rsynnott 6y ago
From the very twitter thread you're replying to: https://mobile.twitter.com/marcan42/status/1333126018068955136 https://mobile.twitter.com/marcan42/status/13331260180689551...

Cu3PO42 6y ago

Yes, you can turn off all of the secure boot features. Booting other OSs is most likely coming.

sethhochberg 6y ago
Well, from what I understand its less "turn off secure boot features" and more "create/add a signature for your custom code to secure boot". https://mobile.twitter.com/never_released/status/1326315741080150016?prefetchtimestamp=1605311534821 https://mobile.twitter.com/never_released/status/13263157410... I can't find a primary source for the comment in the tweet, but it seems widely regarded as true at this point, so fingers crossed it pans out that way.
- Cu3PO42 6y ago
  Hm, interesting. I can't seem to find my source anylonger either. The wording "kernel" does suggest to me that this is about a check a bootloader performs. If you were to boot another OS, you'd probably have a different boot loader as well. This tweet https://twitter.com/never_released/status/1332436771020435457 https://twitter.com/never_released/status/133243677102043545... from the same author suggests M1 is "not any more locked down than [...] Intel", so I'm not fully sure about the technical details, but in the end you should be able to boot your own code.
  - my123 6y ago
    The lowest security level, permissive, allows to mess with the Secure Boot policy at will. When you use kmutil to add a custom boot entry, enrolling the hash of your executable to the Secure Boot policy is handled automatically as part of the tool.

dan1234 6y ago

Yes, you can use recovery mode to set the ‘permissive’ security policy, which “Does not enforce any requirements on the bootable operating system”. https://support.apple.com/en-gb/guide/mac-help/mchl82829c17/11.0/mac/11.0#mchl9b13cbdc https://support.apple.com/en-gb/guide/mac-help/mchl82829c17/...

sigjuice 6y ago

https://developer.apple.com/videos/play/wwdc2020/10686/?time=1129 https://developer.apple.com/videos/play/wwdc2020/10686/?time... Reduced security allows you to run any version of macOS, including the versions that are no longer signed by Apple.

saagarjha 6y ago
You can go lower than that; this is the “medium” security setting.

rsynnott 6y ago

From the very twitter thread you're replying to: https://mobile.twitter.com/marcan42/status/1333126018068955136 https://mobile.twitter.com/marcan42/status/13331260180689551...