5 ms·

Sincerely, why is this your recommendation? What does this protect against and why do you consider it a concern?

cj 3y ago
Help doc: https://support.apple.com/en-us/102149#:~:text=System%20Integrity%20Protection%20is%20a,and%20folders%20on%20your%20Mac https://support.apple.com/en-us/102149#:~:text=System%20Inte.... TLDR: it restricts even the root user from modifying system files. Like the ones that would otherwise be the target of malware.
- diogenes4 3y ago
  I understand that of course, I'm much more curious why you think this is a concern for people, and/or why you consider this an effective protection against said unknown actors.
  - digitalsushi 3y ago
    I want that feature on cause I dont want stuff I dont know about looking and changing stuff I dont know about, whether it's running with escalated privileges or not
    - diogenes4 3y ago
      I doubt you (or any human) is capable of enumerating what you don't want looked at. Frankly, I doubt most of this unknown area is covered by SIP at all, and it would be extremely odd if it did. Perhaps you might consider arguing for actual permissions rather than arbitrarily walling off the OS in a way that tangentially benefits the monopoly Apple holds over their own computers. Wouldn't it be far easier to enumerate what you want an app to access?
      - jmbwell 3y ago
        SIP means not messing with the system files, enumerated thusly: /System. Enumerating what I do want an app to access is handled by Gatekeeper.
        saagarjha 3y ago
        It's actually a larger list available in /System/Library/Sandbox/rootless.conf
        diogenes4 3y ago
        > SIP means not messing with the system files, enumerated thusly: /System. ...and all its children, which is effectively the entire operating system > Enumerating what I do want an app to access is handled by Gatekeeper. Gatekeeper is not capable of this.
        jmbwell 3y ago
        It's among the things Gatekeeper does, isn't it? As configured with PPPC?
    - rakoo 3y ago
      Why would it be running with escalated privileges if you don't know what it is ?
      - dkonofalski 3y ago
        I feel like you're assuming that applications have to be honest about what they are when they request a user-prompted permission. SIP makes that irrelevant.
        rakoo 3y ago
        No, I'm assuming that you know what you install and that apps run with the same rights your user has. Your user can't touch /System, so shouldn't the app
smcleod 3y ago
https://eclecticlight.co/2019/06/19/what-is-sip-and-when-is-it-safe-to-turn-it-off/ https://eclecticlight.co/2019/06/19/what-is-sip-and-when-is-... It’s a core part of how macOS is prevents unauthorised modifications to the operating system and file system by malicious software.

cj 3y ago

Help doc: https://support.apple.com/en-us/102149#:~:text=System%20Integrity%20Protection%20is%20a,and%20folders%20on%20your%20Mac https://support.apple.com/en-us/102149#:~:text=System%20Inte.... TLDR: it restricts even the root user from modifying system files. Like the ones that would otherwise be the target of malware.

diogenes4 3y ago
I understand that of course, I'm much more curious why you think this is a concern for people, and/or why you consider this an effective protection against said unknown actors.
- digitalsushi 3y ago
  I want that feature on cause I dont want stuff I dont know about looking and changing stuff I dont know about, whether it's running with escalated privileges or not
  - diogenes4 3y ago
    I doubt you (or any human) is capable of enumerating what you don't want looked at. Frankly, I doubt most of this unknown area is covered by SIP at all, and it would be extremely odd if it did. Perhaps you might consider arguing for actual permissions rather than arbitrarily walling off the OS in a way that tangentially benefits the monopoly Apple holds over their own computers. Wouldn't it be far easier to enumerate what you want an app to access?
    - jmbwell 3y ago
      SIP means not messing with the system files, enumerated thusly: /System. Enumerating what I do want an app to access is handled by Gatekeeper.
      - saagarjha 3y ago
        It's actually a larger list available in /System/Library/Sandbox/rootless.conf
      - diogenes4 3y ago
        > SIP means not messing with the system files, enumerated thusly: /System. ...and all its children, which is effectively the entire operating system > Enumerating what I do want an app to access is handled by Gatekeeper. Gatekeeper is not capable of this.
        jmbwell 3y ago
        It's among the things Gatekeeper does, isn't it? As configured with PPPC?
  - rakoo 3y ago
    Why would it be running with escalated privileges if you don't know what it is ?
    - dkonofalski 3y ago
      I feel like you're assuming that applications have to be honest about what they are when they request a user-prompted permission. SIP makes that irrelevant.
      - rakoo 3y ago
        No, I'm assuming that you know what you install and that apps run with the same rights your user has. Your user can't touch /System, so shouldn't the app

smcleod 3y ago

https://eclecticlight.co/2019/06/19/what-is-sip-and-when-is-it-safe-to-turn-it-off/ https://eclecticlight.co/2019/06/19/what-is-sip-and-when-is-... It’s a core part of how macOS is prevents unauthorised modifications to the operating system and file system by malicious software.