3 ms·
I think the issue is that SIP is supposed to be like “beyond root”. Because many installs (heck, going to a page with invalid cert in Safari!) ask for an admin
by iseanstevens 4y ago
I think the issue is that SIP is supposed to be like “beyond root”.
Because many installs (heck, going to a page with invalid cert in Safari!) ask for an admins password to install, which gives escalated privileges up to root.
So they added a level that requires higher than root access.
With this vulnerability, someone typing their password could allow beyond root privileges.
That is my simplified parsing of things.
Note - I didn’t read the article. I’m not in security. But I did live with Dan Kaminsky for close to 5 years. RIP :/
- GekkePrutser 4y agoThe problem with SIP though is that this higher than root access is not accessible to the user, only to Apple. You can turn it off completely but there is no way to make your own changes. It's trust Apple 100% or nothing. In contrast, alternative OSes implementations of mandatory access control do have a role that can be accessed by the user.