5 ms·

Can't change security policy or disable SIP with macOS 15 Sequoia

43 points by transpute 2y ago

deleted 2y ago
[deleted]
talldayo 2y ago
[flagged]
- adamtaylor_13 2y ago
  I don’t understand. Can you explain?
  - dijit 2y ago
    He’s suggesting that people shouldn’t buy apple products. Given that the only viable commercial alternative is Windows, with arguably much more egregious user-hostile behaviour (especially towards power users) I find his comment disingenuous. Edit: Downvoted for answering? Shame on you HN.
    - talldayo 2y ago
      Hey, if you don't want to admit that both OSes are metastasizing the same tumor it's not my problem. I don't use either MacOS or Windows nowadays, but my experience developing with WSL was ~10x more stable than any Mac environment I've made for the same purpose. For Docker, the performance differential is so wide it's embarrassing.
      - dijit 2y ago
        The alternatives are not commercially viable. (even though I am a Linux/OpenBSD user- and a loud one). MacOS is perfectly serviceable with things like colima. Calling MacOS user-hostile (due to SIP being enforced?!) is quite a bit different than the actual major usability issues that Windows has been pushing on users, it’s not fair to compare them like this. Commercially viable Linux desktops can’t come soon enough; though desktop computing is dying.
  - talldayo 2y ago
    [flagged]
    - gjsman-1000 2y ago
      > Stop using Apple products Remember that all of the above applies to any device with Secure Boot; including but not limited to all Android devices. Additionally, let's not pretend Windows is the paragon of user freedom.
      - talldayo 2y ago
        Wherever the bootloader is open, none of that really tends to matter. > Additionally, let's not pretend Windows is the paragon of user freedom. False dichotomy
        gjsman-1000 2y ago
        Fair dichotomy when modern computers have very hit-and-miss Linux compatibility. Who cares if the bootloader's unlocked when sleep doesn't work?
        zdragnar 2y ago
        I've been using Linux on laptops almost exclusively for years. I made two exceptions: 1) one job required mac laptops. The user experience was, for my tastes, subpar, and the performance was the same or worse. 2) I keep a windows install around for the rare case of playing a game. It really isn't that hard to look up hardware compatibility online, and of the three OSs, windows is easily the worst. Booting occasionally fails, sometimes reboot will shut down, or the shut down option will reboot instead. I've had less problems running Linux (currently fedora) than anything else in the last, I dunno, 8 years?
        gjsman-1000 2y ago
        > It really isn't that hard to look up hardware compatibility online Code for, “buy a new computer.” In which case my point stands even stronger: who cares if the boot loader is locked, if I can just buy a different computer with it unlocked? Also, good for you that Linux works. That’s not anywhere close to universal.
  - dialup_sounds 2y ago
    "I don't know the answer, but I have strong opinions about the question."
- spdustin 2y ago
  Please don't do this. It's not substantive or helpful. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - kamalamomala 2y ago
    [flagged]
unsnap_biceps 2y ago
Seems like this has happened occasionally for years. https://apple.stackexchange.com/questions/408016/local-policy-error-when-disabling-sip-on-big-sur-m1 https://apple.stackexchange.com/questions/408016/local-polic... There's an answer there on how they recovered. Worth a try.
- lapcat 2y ago
  It didn't work.
eksu 2y ago
I did a .ipsw restore of my M1 Mac mini to 15 Sequoia RC last week and have since gone in and lowered the Security Policy to install ZFS kexts. I wonder if your issue is a bug relating to your multi MacOS boot setup? Have you posted this on MacRumors or elsewhere?
DidYaWipe 2y ago
After upgrading, I was prompted to allow the AltTab utility to control something "for one month," or to open Settings. So I opened Settings and everything was already enabled. The question is who is clamoring for all this BS? The cynic would say that Apple is prepping us all for the eventual iOSification of Macs, where you can't do squat. Which will leave only Linux as a viable (AKA tolerable) computing platform.
- linuxguy2 2y ago
  and iTerm, Zoom, WebEx, Teams, talosctl... All kinds of prompts like that only to find everything enabled.
  - ocodo 2y ago
    It was when Apple started to imply that Chromium, LibreOffice etc was Malware... Yeah, sure Apple.... sure.
- daft_pink 2y ago
  it’s pretty obnoxious especially when it’s something vital that I use my mac for everyday like displaylink or google chrome audio sharing or microsoft teams
- ocodo 2y ago
  To be fair, I switched away from Windows back in ~2004 and used Macos pretty much exclusively since then, with the exception of Linux, which wasn't feeling as good for desktop. I switched again, in Dec 2023 to Linux as desktop, due to the kind of issues we're discussing ITT, and also due to Apple's "buy new, you can't repair" effective hardware policy. I setup a couple of Windows 11 machines with WSL too, and tend to use them a lot more than I expected. There's issues, and I'm still figuring some things out wrt to doing things in Windows (not WSL) but the experience is significantly better than expected. I'm not a fan of M$ but Apple are really taking the cake for anti-user hostility these days.
burke 2y ago
As someone working in developer tools for a company with thousands of people developing software on MacBooks, MAN do I resent SIP. I've recently started calling it "Systems Implementation Prevention". It's incredible that it's 2024 and I can't cobble together anything vaguely container-like on macOS because: * bind mounts don't exist (?!) * clonefile() could maaaybe do the job but doesn't work cross-volume and a lot of the stuff outside of /Users is a different volume * there's no filesystem namespace. * chroot doesn't work either because /usr/lib/libsystem.B.dylib is required, but also pretend. * And it sounds like chroot runs afoul of some SIP rule nowadays even if you can get past the above. * A lot of this could be worked around with FUSE, but in order to turn that on, we'd have to turn off a lot of SIP. The closest we can get without virtualization is sandbox-exec, which just allows allowing/denying file reads by path, with no path translation. And also is deprecated. Nevermind that dtrace exists but you're not allowed to use it either. Truly, the worst UNIX.
- ChocolateGod 2y ago
  > * A lot of this could be worked around with FUSE, but in order to turn that on, we'd have to turn off a lot of SIP. Didn't the latest MacOS update add something similar with userspace filesystems
  - burke 2y ago
    File Provider: https://developer.apple.com/documentation/fileprovider/ https://developer.apple.com/documentation/fileprovider/ Interesting, I hadn't heard of this. First impression skimming the docs is that they've gone to significant trouble to make it not generically useful as a FUSE replacement but I could be misreading.
  - mbirth 2y ago
    Not macOS directly, but there’s fuse-t which works in userspace and just creates an NFS server which it automatically mounts via macOS-own capabilities. The library is a drop-in replacement for libfuse and works great for me. https://www.fuse-t.org https://www.fuse-t.org
- jsolson 2y ago
altairprime 2y ago
> How do I fix it? Image the partitions to a backup location. Zero the entire drive. Clear nvram. Reinstall macOS 15. See if it’s resolved.
- mbirth 2y ago
  You must have missed the part where it says that it's an M1 Mac. They don't have NVRAM you could clear. And zeroing the entire drive is also a bad idea as it also houses the "One True Recovery" - the only allowed pre-boot system. Once deleted, good luck getting your system working again. See: https://eclecticlight.co/2021/01/14/m1-macs-radically-change-boot-and-recovery/ https://eclecticlight.co/2021/01/14/m1-macs-radically-change...
  - altairprime 2y ago
    > You must have missed the part where it says that it's an M1 Mac. That's certainly one possibility. > They don't have NVRAM you could clear. `nvram -p` still works fine on Apple Silicon — though I'm pretty sure it's only modifiable by the kernel these days — but, I haven't had a Mac that needed that wiped for years and years, so I missed that this is all the system image's problem on Apple Silicon now — thanks! > Once deleted, good luck getting your system working again. Per the 2021 post linked: > the only way to recover it is to restore the whole firmware and software image in DFU mode That's not "good luck" — that is, literally, the documented and expected next step, same as all the other Apple CPU devices, whether they're handheld or laptop or desktop: boot into DFU mode and factory reset it using another device. https://support.apple.com/en-us/108900 https://support.apple.com/en-us/108900 I know the author of the original post is aware of how to do that, and I recognize that they have chosen not to do so. I'm really glad that they explore all this stuff in depth; I don't have a development device to muck around with like they do!
habitue 2y ago
The ideal state for Apple and their target audience is to make your computer an appliance. They really don't want a wide set of configuration options, that makes it harder to service and harder to test. People are kind of anchored to how Mac is / used to be etc, thinking of it as basically another unix. That's a historical blip in retrospect. Long term, their market really isn't developers & technical users, there are not enough of those to make concessions to. In order to really help Aunt Sally keep her computer running and functional, they need to make sure that her nephew Billy can't make any complicated or potentially dangerous changes to the lower levels of the OS based on some internet forum post. If you need that kind of configurability, you really want a different OS. (Alternately, consider whether you really do need that configurability. Maybe you just think you do, and you'd much rather have a stable operating system that just works)
- Brian_K_White 2y ago
  My definition of a tool that just works is not a hammer that will only hit some kinds of nails and refuses to break rocks. Even an appliance is a tool. A bicycle, as in "bicycle for the mind" does not become more useful and valid when it gains the ability to decide if it agrees with how and where it's being operated. There are people who think that's a good thing, who think the ultimate form of life would be the wonderful order if all the bicycles kept anyone from going too fast, removing their hands from the handle bars, riding on sidewalks, ignoring traffic lights, etc... But those bicycles are no longer human amplifiers. They are no longer tools, or they are tools but the user is not the person on the bike. The order argument ignores the ultimate purpose of any tool, and ultimately the point of human existence itself. It's flatly invalid to forget that the person wields the tool, not the other way around. Sanity checks and guard rails and sane defaults etc are one thing, those are themselves tools that ultimately empower the wielder, as long as the user is the one who ultimately controls them.
nativeit 2y ago
For everyone who reads the title and instantly assumes this is something Apple has done—this is a tech support request for an error this person has encountered.
lopkeny12ko 2y ago
[flagged]
mbirth 2y ago
I've got the same on a stock M1 MBP. At some point in the past I've disabled SIP - probably when I was playing around with FUSE. Did all the Betas - never had any problem. However, after installing the RC/final version of Sequoia, I suddenly had a popup after bootup about an updated extension from "Apple Inc." and to please allow the updated version. In Settings --> Privacy I was able to "Allow" the extension, however, this also requires a reboot. And after the reboot, the same popup appeared again. I've put in a ticket - FB15087179. Apple replied and said to first, toggle Activation Lock/Find My and wait 5+ minutes in-between. (Either off - wait 5mins - on, or on - wait 5mins - off.) Then boot into the bootloader and turn SIP on, then back off again. However, when trying to turn SIP on, I get the same error as OP: SDErrorDomain error 104. I've found another user on Twitter with the same issue: https://x.com/davidhsherman13/status/1833264669793923151 https://x.com/davidhsherman13/status/1833264669793923151 After reporting my findings in the Apple Feedback thing, I've yet to get further instructions to try.
- mbirth 2y ago
  A Reddit user found a solution: https://old.reddit.com/r/MacOSBeta/comments/1fhl39c/system_extensions_issue_with_latest_beta/lo4v4hc/ https://old.reddit.com/r/MacOSBeta/comments/1fhl39c/system_e... I've noticed he disabled "Find My Mac" in the first step and only enabled it again after everything was done. This seems to be the key. I suspect the "SDErrorDomain error 104" is related to the "Activation Lock" aka. "Find My Mac". I've disabled Find My Mac, booted into recovery and was finally able to set it to "Full Security" and back to "Reduced Security" again without problems. After that and a fresh boot, the popup message about the updated extension was gone. Enabled "Find My Mac" again (after setting the system to "Full Security" first - as that's the setting I intended to use) and all is well. nb. SIP was enabled for me the whole time. It was the security mode running on "Reduced Security" (both checkboxes checked) which was probably the cause for the "updated extension" issue.

43 points by transpute 2y ago

deleted 2y ago

[deleted]

talldayo 2y ago

[flagged]

adamtaylor_13 2y ago
I don’t understand. Can you explain?
- dijit 2y ago
  He’s suggesting that people shouldn’t buy apple products. Given that the only viable commercial alternative is Windows, with arguably much more egregious user-hostile behaviour (especially towards power users) I find his comment disingenuous. Edit: Downvoted for answering? Shame on you HN.
  - talldayo 2y ago
    Hey, if you don't want to admit that both OSes are metastasizing the same tumor it's not my problem. I don't use either MacOS or Windows nowadays, but my experience developing with WSL was ~10x more stable than any Mac environment I've made for the same purpose. For Docker, the performance differential is so wide it's embarrassing.
    - dijit 2y ago
      The alternatives are not commercially viable. (even though I am a Linux/OpenBSD user- and a loud one). MacOS is perfectly serviceable with things like colima. Calling MacOS user-hostile (due to SIP being enforced?!) is quite a bit different than the actual major usability issues that Windows has been pushing on users, it’s not fair to compare them like this. Commercially viable Linux desktops can’t come soon enough; though desktop computing is dying.
- talldayo 2y ago
  [flagged]
  - gjsman-1000 2y ago
    > Stop using Apple products Remember that all of the above applies to any device with Secure Boot; including but not limited to all Android devices. Additionally, let's not pretend Windows is the paragon of user freedom.
    - talldayo 2y ago
      Wherever the bootloader is open, none of that really tends to matter. > Additionally, let's not pretend Windows is the paragon of user freedom. False dichotomy
      - gjsman-1000 2y ago
        Fair dichotomy when modern computers have very hit-and-miss Linux compatibility. Who cares if the bootloader's unlocked when sleep doesn't work?
        zdragnar 2y ago
        I've been using Linux on laptops almost exclusively for years. I made two exceptions: 1) one job required mac laptops. The user experience was, for my tastes, subpar, and the performance was the same or worse. 2) I keep a windows install around for the rare case of playing a game. It really isn't that hard to look up hardware compatibility online, and of the three OSs, windows is easily the worst. Booting occasionally fails, sometimes reboot will shut down, or the shut down option will reboot instead. I've had less problems running Linux (currently fedora) than anything else in the last, I dunno, 8 years?
        gjsman-1000 2y ago
        > It really isn't that hard to look up hardware compatibility online Code for, “buy a new computer.” In which case my point stands even stronger: who cares if the boot loader is locked, if I can just buy a different computer with it unlocked? Also, good for you that Linux works. That’s not anywhere close to universal.
- dialup_sounds 2y ago
  "I don't know the answer, but I have strong opinions about the question."
spdustin 2y ago
Please don't do this. It's not substantive or helpful. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- kamalamomala 2y ago
  [flagged]

unsnap_biceps 2y ago

Seems like this has happened occasionally for years. https://apple.stackexchange.com/questions/408016/local-policy-error-when-disabling-sip-on-big-sur-m1 https://apple.stackexchange.com/questions/408016/local-polic... There's an answer there on how they recovered. Worth a try.

lapcat 2y ago
It didn't work.

eksu 2y ago

I did a .ipsw restore of my M1 Mac mini to 15 Sequoia RC last week and have since gone in and lowered the Security Policy to install ZFS kexts. I wonder if your issue is a bug relating to your multi MacOS boot setup? Have you posted this on MacRumors or elsewhere?

DidYaWipe 2y ago

After upgrading, I was prompted to allow the AltTab utility to control something "for one month," or to open Settings. So I opened Settings and everything was already enabled. The question is who is clamoring for all this BS? The cynic would say that Apple is prepping us all for the eventual iOSification of Macs, where you can't do squat. Which will leave only Linux as a viable (AKA tolerable) computing platform.

linuxguy2 2y ago
and iTerm, Zoom, WebEx, Teams, talosctl... All kinds of prompts like that only to find everything enabled.
- ocodo 2y ago
  It was when Apple started to imply that Chromium, LibreOffice etc was Malware... Yeah, sure Apple.... sure.
daft_pink 2y ago
it’s pretty obnoxious especially when it’s something vital that I use my mac for everyday like displaylink or google chrome audio sharing or microsoft teams
ocodo 2y ago
To be fair, I switched away from Windows back in ~2004 and used Macos pretty much exclusively since then, with the exception of Linux, which wasn't feeling as good for desktop. I switched again, in Dec 2023 to Linux as desktop, due to the kind of issues we're discussing ITT, and also due to Apple's "buy new, you can't repair" effective hardware policy. I setup a couple of Windows 11 machines with WSL too, and tend to use them a lot more than I expected. There's issues, and I'm still figuring some things out wrt to doing things in Windows (not WSL) but the experience is significantly better than expected. I'm not a fan of M$ but Apple are really taking the cake for anti-user hostility these days.

burke 2y ago

As someone working in developer tools for a company with thousands of people developing software on MacBooks, MAN do I resent SIP. I've recently started calling it "Systems Implementation Prevention". It's incredible that it's 2024 and I can't cobble together anything vaguely container-like on macOS because: * bind mounts don't exist (?!) * clonefile() could maaaybe do the job but doesn't work cross-volume and a lot of the stuff outside of /Users is a different volume * there's no filesystem namespace. * chroot doesn't work either because /usr/lib/libsystem.B.dylib is required, but also pretend. * And it sounds like chroot runs afoul of some SIP rule nowadays even if you can get past the above. * A lot of this could be worked around with FUSE, but in order to turn that on, we'd have to turn off a lot of SIP. The closest we can get without virtualization is sandbox-exec, which just allows allowing/denying file reads by path, with no path translation. And also is deprecated. Nevermind that dtrace exists but you're not allowed to use it either. Truly, the worst UNIX.

ChocolateGod 2y ago
> * A lot of this could be worked around with FUSE, but in order to turn that on, we'd have to turn off a lot of SIP. Didn't the latest MacOS update add something similar with userspace filesystems
- burke 2y ago
  File Provider: https://developer.apple.com/documentation/fileprovider/ https://developer.apple.com/documentation/fileprovider/ Interesting, I hadn't heard of this. First impression skimming the docs is that they've gone to significant trouble to make it not generically useful as a FUSE replacement but I could be misreading.
- mbirth 2y ago
  Not macOS directly, but there’s fuse-t which works in userspace and just creates an NFS server which it automatically mounts via macOS-own capabilities. The library is a drop-in replacement for libfuse and works great for me. https://www.fuse-t.org https://www.fuse-t.org
jsolson 2y ago

altairprime 2y ago

> How do I fix it? Image the partitions to a backup location. Zero the entire drive. Clear nvram. Reinstall macOS 15. See if it’s resolved.

mbirth 2y ago
You must have missed the part where it says that it's an M1 Mac. They don't have NVRAM you could clear. And zeroing the entire drive is also a bad idea as it also houses the "One True Recovery" - the only allowed pre-boot system. Once deleted, good luck getting your system working again. See: https://eclecticlight.co/2021/01/14/m1-macs-radically-change-boot-and-recovery/ https://eclecticlight.co/2021/01/14/m1-macs-radically-change...
- altairprime 2y ago
  > You must have missed the part where it says that it's an M1 Mac. That's certainly one possibility. > They don't have NVRAM you could clear. `nvram -p` still works fine on Apple Silicon — though I'm pretty sure it's only modifiable by the kernel these days — but, I haven't had a Mac that needed that wiped for years and years, so I missed that this is all the system image's problem on Apple Silicon now — thanks! > Once deleted, good luck getting your system working again. Per the 2021 post linked: > the only way to recover it is to restore the whole firmware and software image in DFU mode That's not "good luck" — that is, literally, the documented and expected next step, same as all the other Apple CPU devices, whether they're handheld or laptop or desktop: boot into DFU mode and factory reset it using another device. https://support.apple.com/en-us/108900 https://support.apple.com/en-us/108900 I know the author of the original post is aware of how to do that, and I recognize that they have chosen not to do so. I'm really glad that they explore all this stuff in depth; I don't have a development device to muck around with like they do!

habitue 2y ago

The ideal state for Apple and their target audience is to make your computer an appliance. They really don't want a wide set of configuration options, that makes it harder to service and harder to test. People are kind of anchored to how Mac is / used to be etc, thinking of it as basically another unix. That's a historical blip in retrospect. Long term, their market really isn't developers & technical users, there are not enough of those to make concessions to. In order to really help Aunt Sally keep her computer running and functional, they need to make sure that her nephew Billy can't make any complicated or potentially dangerous changes to the lower levels of the OS based on some internet forum post. If you need that kind of configurability, you really want a different OS. (Alternately, consider whether you really do need that configurability. Maybe you just think you do, and you'd much rather have a stable operating system that just works)

Brian_K_White 2y ago
My definition of a tool that just works is not a hammer that will only hit some kinds of nails and refuses to break rocks. Even an appliance is a tool. A bicycle, as in "bicycle for the mind" does not become more useful and valid when it gains the ability to decide if it agrees with how and where it's being operated. There are people who think that's a good thing, who think the ultimate form of life would be the wonderful order if all the bicycles kept anyone from going too fast, removing their hands from the handle bars, riding on sidewalks, ignoring traffic lights, etc... But those bicycles are no longer human amplifiers. They are no longer tools, or they are tools but the user is not the person on the bike. The order argument ignores the ultimate purpose of any tool, and ultimately the point of human existence itself. It's flatly invalid to forget that the person wields the tool, not the other way around. Sanity checks and guard rails and sane defaults etc are one thing, those are themselves tools that ultimately empower the wielder, as long as the user is the one who ultimately controls them.

nativeit 2y ago

For everyone who reads the title and instantly assumes this is something Apple has done—this is a tech support request for an error this person has encountered.

lopkeny12ko 2y ago

[flagged]

mbirth 2y ago

I've got the same on a stock M1 MBP. At some point in the past I've disabled SIP - probably when I was playing around with FUSE. Did all the Betas - never had any problem. However, after installing the RC/final version of Sequoia, I suddenly had a popup after bootup about an updated extension from "Apple Inc." and to please allow the updated version. In Settings --> Privacy I was able to "Allow" the extension, however, this also requires a reboot. And after the reboot, the same popup appeared again. I've put in a ticket - FB15087179. Apple replied and said to first, toggle Activation Lock/Find My and wait 5+ minutes in-between. (Either off - wait 5mins - on, or on - wait 5mins - off.) Then boot into the bootloader and turn SIP on, then back off again. However, when trying to turn SIP on, I get the same error as OP: SDErrorDomain error 104. I've found another user on Twitter with the same issue: https://x.com/davidhsherman13/status/1833264669793923151 https://x.com/davidhsherman13/status/1833264669793923151 After reporting my findings in the Apple Feedback thing, I've yet to get further instructions to try.

mbirth 2y ago
A Reddit user found a solution: https://old.reddit.com/r/MacOSBeta/comments/1fhl39c/system_extensions_issue_with_latest_beta/lo4v4hc/ https://old.reddit.com/r/MacOSBeta/comments/1fhl39c/system_e... I've noticed he disabled "Find My Mac" in the first step and only enabled it again after everything was done. This seems to be the key. I suspect the "SDErrorDomain error 104" is related to the "Activation Lock" aka. "Find My Mac". I've disabled Find My Mac, booted into recovery and was finally able to set it to "Full Security" and back to "Reduced Security" again without problems. After that and a fresh boot, the popup message about the updated extension was gone. Enabled "Find My Mac" again (after setting the system to "Full Security" first - as that's the setting I intended to use) and all is well. nb. SIP was enabled for me the whole time. It was the security mode running on "Reduced Security" (both checkboxes checked) which was probably the cause for the "updated extension" issue.