{"id":64201,"date":"2020-07-27T15:00:00","date_gmt":"2020-07-27T20:00:00","guid":{"rendered":"https:\/\/eshop.macsales.com\/blog\/?p=64201"},"modified":"2020-09-16T16:36:00","modified_gmt":"2020-09-16T21:36:00","slug":"secure-boot-and-sip-guard-your-mac","status":"publish","type":"post","link":"https:\/\/eshop.macsales.com\/blog\/64201-secure-boot-and-sip-guard-your-mac\/","title":{"rendered":"How Secure Boot and System Integrity Protection Guard Your Mac From Malware"},"content":{"rendered":"\n

After reading the comments from my blog post about SoftRAID version 5.8.4<\/a>, I realized that there was some confusion about Secure Boot<\/strong> and how it protects your Mac from malware. When using SoftRAID on macOS 10.15 Catalina, on a Mac with a T2 chip, a user must disable Secure Boot for the correct version of the SoftRAID driver to load.<\/p>\n\n\n\n

Some users don’t want to disable Secure Boot because they believe it disables all<\/em> malware protection on their Mac. This belief is not correct, and Apple labeling the setting for disabling Secure Boot as “No Security<\/strong>” in the Startup System Security application doesn’t help. Even when Secure Boot is disabled, the T2 chip in your Mac is still protecting all the files on the internal SSD.<\/p>\n\n\n\n

\"Screenshot
Startup Security Settings for Secure Boot<\/figcaption><\/figure><\/div>\n\n\n\n

Actually, Secure Boot only protects your Mac for less than 2 minutes after the white Apple logo appears on the screen during startup. After 2 minutes, Secure Boot offers no protection.<\/p>\n\n\n\n

What is protecting your Mac from malware the entire time, is System Integrity Protection (SIP)<\/strong>. SIP starts protecting your Mac when it first boots up and continues for as long as your Mac is running. SIP ensures that software that runs on your Mac is only from developers recognized by Apple. Starting with macOS 10.14.6, SIP also assures that the software has been previously checked for malware by Apple’s malware scanning servers.<\/p>\n\n\n\n

In This Article:<\/strong><\/h2>\n\n\n\n
  1. This post explains how<\/em> macOS is protected from malware by Secure Boot and SIP and how they differ and why<\/em> we require that you disable Secure Boot while running SoftRAID.<\/li>
  2. It also describes why we think it is acceptable to disable Secure Boot but would never recommend that anyone disable SIP.<\/li>
  3. Lastly, it goes over the upcoming changes in Macs with Apple silicon, which will ship later this year.<\/li><\/ol>\n\n\n\n

    Secure Boot Explained:<\/strong><\/h2>\n\n\n\n

    Secure Boot is available only on Macs with T2 chips. As the name implies, it protects your Mac against malware infection at boot time (when your Mac is starting up). In fact, it ONLY protects your Mac at boot time. Two minutes later, Secure Boot stops safeguarding your Mac.<\/p>\n\n\n\n

    Secure Boot is designed to allow only drivers that Apple ships to be used for the startup volume. Starting with macOS 10.15, if a newer version of one of those drivers is installed on your startup volume, Secure Boot will load the older one<\/em> from the macOS installer instead. Unfortunately, this policy of only loading the driver included in the macOS installer also affects drivers not used for the startup volume \u2013 it affects all drivers<\/em> loaded in the first 2 minutes.<\/p>\n\n\n\n

    \"SoftRAID<\/figure><\/div>\n\n\n\n

    Apple has been shipping the SoftRAID driver as part of macOS for more than ten years. This allows users to connect a SoftRAID volume to their Mac and have the volume mount without first running an application to update the driver. SoftRAID has a reputation for being very responsive in providing bug fixes and enhancements when they are needed. So, we want to give users the ability to update their SoftRAID driver when a new release becomes available.<\/p>\n\n\n\n

    Unfortunately, this is where Secure Boot gets in the way. If a user has a Mac with a T2 chip, has Secure Boot enabled, and has their SoftRAID volume attached at startup time or connects it within the first 2 minutes, Secure Boot loads the older version of the SoftRAID driver included in the macOS installer. If they connect their SoftRAID volume more than 2 minutes after startup, then the correct, updated driver loads instead.<\/p>\n\n\n\n

    What is SIP?<\/strong><\/h2>\n\n\n\n
    \"\"<\/figure><\/div>\n\n\n\n

    Unlike Secure Boot, SIP (System Integrity Protection) is available on all Macs\u2014even those without T2 chips. In addition, it’s always running, both when your Mac first starts up and when it has been on for days, weeks, or months. It even runs if you have Secure Boot disabled. SIP has many different features that protect your Mac from malware, but the two I want to describe here are code signing<\/strong> and code notarization<\/strong>. (Code signing was introduced in Mac OS X 10.8 and code notarization in macOS 10.14.6.)<\/p>\n\n\n\n

    Code Signatures<\/strong><\/h3>\n\n\n\n

    When a developer signs an application or other software, a block of cryptographic data is appended to the application. This data, called a code signature, is the cryptographic result of processing all the application pieces in conjunction with a unique, large number that the developer has received from Apple. This unique, large number is a closely guarded secret protected by the developer.<\/p>\n\n\n\n

    When you first run an application on your Mac, SIP recalculates the code signature and checks to ensure it is the same as the one appended to the application. If the code signatures are not identical, SIP knows that the application has been changed by someone other than the original developer. SIP then prevents macOS from running the app and tells you why it cannot be run.<\/p>\n\n\n\n

    Code signatures act like the tamper-evident seals on the bottle of aspirin. They don’t prevent anyone from opening the bottle before buying it \u2013 they just make it obvious that someone has opened it before you. You know not to use the aspirin when the bottle’s seal is broken because what’s inside may be something different from the aspirin put in it at the factory.<\/p>\n\n\n\n

    Code Notarization<\/strong><\/h3>\n\n\n\n
    \"Xcode<\/figure><\/div>\n\n\n\n

    Code notarization takes protection against malware one step further and works in conjunction with code signatures. When an application is notarized, the developer sends it to Apple\u2019s security servers. These servers check the application for malware, and if it is malware-free, the software is signed by Apple. The signature that Apple generates is then returned to the developer, who then attaches it, and the code signature, to the application.<\/p>\n\n\n\n

    Just like the code signature, SIP also checks that the Apple signature is valid. If the Apple signature is missing or invalid, SIP knows that Apple’s security servers did not check the application for malware, and macOS will refuse to run the application.<\/p>\n\n\n\n

    Code notarization acts like the title company does when you sell your house. The title company searches for anyone who might claim they own your house. If they don’t find anyone, they certify that you are actually the owner, and then you can proceed with your house’s sale. Apple’s security servers act in the same way \u2013 they certify that a piece of software is safe to sell to users.<\/p>\n\n\n\n

    What we recommend:<\/strong><\/h2>\n\n\n\n

    We want to ensure that you are only running the latest version of the SoftRAID driver with all of the enhancements and fixes we have worked hard to develop and test. This means that if you are on a Mac with a T2 chip and running macOS 10.15, you must do one of the following to use the latest SoftRAID driver<\/strong>:<\/p>\n\n\n\n