4 ms·
How often are the SHA-256 hashes on the System volume snapshot checked? Could something that can write to the drive root, and understood APFS, silently change t
by ericbarrett 5y ago
How often are the SHA-256 hashes on the System volume snapshot checked? Could something that can write to the drive root, and understood APFS, silently change the file without updating its recorded metadata (including hash)? Or is the hash checked every time a file is opened?
- my123 5y agoChecked all the time, it's a Merkle tree structure. You can modify the seal when the Sealed System Volume feature is off. (which requires Secure Boot to be set to Permissive Security, and FileVault to be off at the time of disabling)
- qPM9l3XJrF 5y agoWhy is it possible to turn Sealed System Volume off? Is there a way that malware might be able to turn it off?
- Someone 5y agoReading https://support.apple.com/en-us/HT208198 https://support.apple.com/en-us/HT208198, the official way to do it requires booting from Mac OS recovery and entering an administrator password. ⇒ there may of course be bugs, but Apple’s intent is there isn’t any way for malware to do that