4 ms·

There actually is a middle ground, in some cases - csrutil can, for instance, allow you to disable unsigned kext blocking but keep the rest of SIP enabled.

GekkePrutser 5y ago
I thought those were entirely separate things? There's now a GUI option for the unsigned kernel extension block (in the startup security utility). I don't think that's part of SIP per se. It's also the one you need to run any other OS. Whereas SIP is a thing within the OS itself as far as I know. But I have to admit this is where my knowledge gets fuzzy :) The kind of control I'd want is allowing to add a signator for approved kernel extensions. So that I could add my own key and sign kernel extensions myself. Or trust another party to do this. Just like you can add your own keys to Secure Boot on a PC. The same with the app notarisation. Another feature that's essentially great, but fully under the control of Apple. For example, as a corporate admin it'd be great to be able to notarise which apps I'd allow our employees to use. These security tools would be super powerful and useful if we would be allowed to configure them more.
- easton 5y ago
  If you’re a corporate admin you can whitelist kernel extensions via MDM, maybe that would help? https://support.apple.com/guide/mdm/kernel-extension-policy-payload-settings-mdm88f99b98a/web https://support.apple.com/guide/mdm/kernel-extension-policy-...
  - beermonster 5y ago
    Many years ago, when it wasn’t possible to set a strong iPhone password, I worked out I could construct an Exchange ActiveSync profile enabling a strong password policy instead of a four digit number. I didn’t have a corporate Exchange server so I pushed it to the device using the fantastic and open source z-push. A strange length to have to go to mind. I also used this method to force full device encryption and wiping device after 10 failed attempts. All of these are now possible to configure in settings now and device encryption is on by default.
  - GekkePrutser 5y ago
    I know! And I do (it prevents popping up a user with a gazillion prompts to accept when they enrol) But this is just kernel extension stuff. We know users use some software (not with kernel or system extensions) that's not allowed in our environment. Zoom for example (people are allowed to use it in the browser only for contact with external parties but many people install the full thing anyway). Our security department has banned the full client because of the backdoor it introduced. Right now we mark it as malware in our antivirus, but it would be great to be able to prevent it altogether.

GekkePrutser 5y ago

I thought those were entirely separate things? There's now a GUI option for the unsigned kernel extension block (in the startup security utility). I don't think that's part of SIP per se. It's also the one you need to run any other OS. Whereas SIP is a thing within the OS itself as far as I know. But I have to admit this is where my knowledge gets fuzzy :) The kind of control I'd want is allowing to add a signator for approved kernel extensions. So that I could add my own key and sign kernel extensions myself. Or trust another party to do this. Just like you can add your own keys to Secure Boot on a PC. The same with the app notarisation. Another feature that's essentially great, but fully under the control of Apple. For example, as a corporate admin it'd be great to be able to notarise which apps I'd allow our employees to use. These security tools would be super powerful and useful if we would be allowed to configure them more.

easton 5y ago
If you’re a corporate admin you can whitelist kernel extensions via MDM, maybe that would help? https://support.apple.com/guide/mdm/kernel-extension-policy-payload-settings-mdm88f99b98a/web https://support.apple.com/guide/mdm/kernel-extension-policy-...
- beermonster 5y ago
  Many years ago, when it wasn’t possible to set a strong iPhone password, I worked out I could construct an Exchange ActiveSync profile enabling a strong password policy instead of a four digit number. I didn’t have a corporate Exchange server so I pushed it to the device using the fantastic and open source z-push. A strange length to have to go to mind. I also used this method to force full device encryption and wiping device after 10 failed attempts. All of these are now possible to configure in settings now and device encryption is on by default.
- GekkePrutser 5y ago
  I know! And I do (it prevents popping up a user with a gazillion prompts to accept when they enrol) But this is just kernel extension stuff. We know users use some software (not with kernel or system extensions) that's not allowed in our environment. Zoom for example (people are allowed to use it in the browser only for contact with external parties but many people install the full thing anyway). Our security department has banned the full client because of the backdoor it introduced. Right now we mark it as malware in our antivirus, but it would be great to be able to prevent it altogether.