5 ms·

Yeah, and this is why I've been tempted to bootstrap a de-Apple-ified OSX project. I'm getting sick of Apple's intrusiveness. I was staring at a red dot on the

Yeah, and this is why I've been tempted to bootstrap a de-Apple-ified OSX project. I'm getting sick of Apple's intrusiveness. I was staring at a red dot on the System Preferences because Apple decided that logging in with iCloud was important enough to remind me of daily.

sneak 6y ago
Due to the signed system volume, doing so is now impossible without disabling system integrity protection, one of the main platform security features of macOS. I made an effort to do this for Mojave, but macOS is not designed to be modular, and after a week of chasing weird bugs related to interdependencies of system services, I stopped my efforts. If you'd like to collaborate, reach out.
- mmastrac 6y ago
  It would be a "respin"-style project without Apple's keys at the root.
  - Wowfunhappy 6y ago
    I didn't realize you could actually leave SIP on but use a different chain of trust! Would you be recompiling XNU to do this?
    - comex 6y ago
      The chain of trust on macOS is… complicated. Too complicated. Apple binaries are validated in at least three different ways: 1. By the kernel using a root certificate hardcoded into the CoreTrust kext; 2. On Apple Silicon only, by the kernel using a trust cache that's supplied to the kernel by the bootloader; 3. By userland (amfid) using a root certificate hardcoded into Security.framework. You'd have to modify or intercept all of those things, and key components aren't open source (e.g. the AppleMobileFileIntegrity kext which is responsible for querying CoreTrust, the trust cache, and amfid). Probably best to do some targeted function hooking rather than recompiling anything. Of course, you would still have to turn off Secure Boot in order to load a modified kernel in the first place. But that's largely orthogonal to SIP.
      - saagarjha 6y ago
        It might be easier to patch AMFI to allow the "alternate trusted keys" mechanism to work.
- Wowfunhappy 6y ago
  > Due to the signed system volume, doing so is now impossible without disabling system integrity protection, one of the main platform security features of macOS. No, macOS is fine without SIP! SIP just defines a set of actions that Apple thinks no user, including root, should ever be able to perform. Consequently, disabling SIP empowers root users to do whatever they want, which is exactly what root is supposed to mean! You're still protected by the standard UNIX permission system—just don't grant root to software you don't absolutely trust! Security is all about layers—but in the case of SIP, the security comes from delegating control away from the user in favor of Apple. If you're a power user, I'm not convinced this is necessarily good, because you're giving Apple almost absolute trust. What if they get compromised? And, if you're the sort of person who would want a de-Apple-ified version of macOS, I would think you'd have already disabled SIP.
  - sneak 6y ago
    > No, macOS is fine without SIP! SIP just defines a set of actions that Apple thinks no user, including root, should ever be able to perform. I agree with Apple here. > Consequently, disabling SIP empowers root users to do whatever they want, without Apple having a say in the matter—but you're still protected by the standard UNIX permission system. It also empowers malware. The Creative Cloud, for example, installs as root and installs admin-permissioned services. The standard POSIX permissions system is crap, and SIP is a huge improvement and valuable tool against malware.
    - Wowfunhappy 6y ago
      > The Creative Cloud, for example, installs as root and installs admin-permissioned services. So don't use apps that do that! Creative Cloud has no business installing itself as root. I realize that's probably not feasible if you e.g. need Creative Cloud professionally, and that's a perfectly valid reason to leave SIP on, if applicable. Although Adobe and similar vendors still need to be yelled at. I think SIP—like Gatekeeper—is a great default setting for novices, who should trust Apple over themselves. But if you're a power user, turning off SIP is not going to spell disaster. It leaves you with equivalent security to most Linux distros like Debian. More importantly, there's no way to have a feature like SIP while also granting users full control. I get really frustrated when I see people say they're switching to Linux because macOS is too locked down. If you want to switch to Linux, that's wonderful, Linux is great! But if you otherwise prefer macOS, just go ahead and open it up for yourself.
- cercatrova 6y ago
  I actively disable SIP on every Mac I own.

sneak 6y ago

Due to the signed system volume, doing so is now impossible without disabling system integrity protection, one of the main platform security features of macOS. I made an effort to do this for Mojave, but macOS is not designed to be modular, and after a week of chasing weird bugs related to interdependencies of system services, I stopped my efforts. If you'd like to collaborate, reach out.

mmastrac 6y ago
It would be a "respin"-style project without Apple's keys at the root.
- Wowfunhappy 6y ago
  I didn't realize you could actually leave SIP on but use a different chain of trust! Would you be recompiling XNU to do this?
  - comex 6y ago
    The chain of trust on macOS is… complicated. Too complicated. Apple binaries are validated in at least three different ways: 1. By the kernel using a root certificate hardcoded into the CoreTrust kext; 2. On Apple Silicon only, by the kernel using a trust cache that's supplied to the kernel by the bootloader; 3. By userland (amfid) using a root certificate hardcoded into Security.framework. You'd have to modify or intercept all of those things, and key components aren't open source (e.g. the AppleMobileFileIntegrity kext which is responsible for querying CoreTrust, the trust cache, and amfid). Probably best to do some targeted function hooking rather than recompiling anything. Of course, you would still have to turn off Secure Boot in order to load a modified kernel in the first place. But that's largely orthogonal to SIP.
    - saagarjha 6y ago
      It might be easier to patch AMFI to allow the "alternate trusted keys" mechanism to work.
Wowfunhappy 6y ago
> Due to the signed system volume, doing so is now impossible without disabling system integrity protection, one of the main platform security features of macOS. No, macOS is fine without SIP! SIP just defines a set of actions that Apple thinks no user, including root, should ever be able to perform. Consequently, disabling SIP empowers root users to do whatever they want, which is exactly what root is supposed to mean! You're still protected by the standard UNIX permission system—just don't grant root to software you don't absolutely trust! Security is all about layers—but in the case of SIP, the security comes from delegating control away from the user in favor of Apple. If you're a power user, I'm not convinced this is necessarily good, because you're giving Apple almost absolute trust. What if they get compromised? And, if you're the sort of person who would want a de-Apple-ified version of macOS, I would think you'd have already disabled SIP.
- sneak 6y ago
  > No, macOS is fine without SIP! SIP just defines a set of actions that Apple thinks no user, including root, should ever be able to perform. I agree with Apple here. > Consequently, disabling SIP empowers root users to do whatever they want, without Apple having a say in the matter—but you're still protected by the standard UNIX permission system. It also empowers malware. The Creative Cloud, for example, installs as root and installs admin-permissioned services. The standard POSIX permissions system is crap, and SIP is a huge improvement and valuable tool against malware.
  - Wowfunhappy 6y ago
    > The Creative Cloud, for example, installs as root and installs admin-permissioned services. So don't use apps that do that! Creative Cloud has no business installing itself as root. I realize that's probably not feasible if you e.g. need Creative Cloud professionally, and that's a perfectly valid reason to leave SIP on, if applicable. Although Adobe and similar vendors still need to be yelled at. I think SIP—like Gatekeeper—is a great default setting for novices, who should trust Apple over themselves. But if you're a power user, turning off SIP is not going to spell disaster. It leaves you with equivalent security to most Linux distros like Debian. More importantly, there's no way to have a feature like SIP while also granting users full control. I get really frustrated when I see people say they're switching to Linux because macOS is too locked down. If you want to switch to Linux, that's wonderful, Linux is great! But if you otherwise prefer macOS, just go ahead and open it up for yourself.
cercatrova 6y ago
I actively disable SIP on every Mac I own.