Hacker News Reader

How often are the SHA-256 hashes on the System volume snapshot checked? Could something that can write to the drive root, and understood APFS, silently change the file without updating its recorded metadata (including hash)? Or is the hash checked every time a file is opened?

View on HN

Checked all the time, it's a Merkle tree structure.

You can modify the seal when the Sealed System Volume feature is off. (which requires Secure Boot to be set to Permissive Security, and FileVault to be off at the time of disabling)

Why is it possible to turn Sealed System Volume off? Is there a way that malware might be able to turn it off?

Reading https://support.apple.com/en-us/HT208198, the official way to do it requires booting from Mac OS recovery and entering an administrator password.

⇒ there may of course be bugs, but Apple’s intent is there isn’t any way for malware to do that

Reply on news.ycombinator.com