Can't change security policy or disable SIP with macOS 15 Sequoia
lapcatsoftware.com
lapcatsoftware.com
It's incredible that it's 2024 and I can't cobble together anything vaguely container-like on macOS because:
* bind mounts don't exist (?!)
* clonefile() could maaaybe do the job but doesn't work cross-volume and a lot of the stuff outside of /Users is a different volume
* there's no filesystem namespace.
* chroot doesn't work either because /usr/lib/libsystem.B.dylib is required, but also pretend.
* And it sounds like chroot runs afoul of some SIP rule nowadays even if you can get past the above.
* A lot of this could be worked around with FUSE, but in order to turn that on, we'd have to turn off a lot of SIP.
The closest we can get without virtualization is sandbox-exec, which just allows allowing/denying file reads by path, with no path translation. And also is deprecated.
Nevermind that dtrace exists but you're not allowed to use it either.
Truly, the worst UNIX.
We did use virtualization for a bunch of stuff before the move to Apple Silicon, back when Hypervisor.framework and xhyve actually existed and were plausibly useful.
Those also fell by the wayside in the architecture migration and now virtualization has a massive performance cost.
Apparently the M4 chips are on ARMv9 which is apparently much better at virtualization, but it remains to be seen whether apple provides anything lightweight again.
In the Apple Silicon migration, obviously emulating x86_64 got slow, but even when we built ARM64 VMs, performance was still miserable: there was (is?) no way -- at least no way we ever figured out -- to get reasonable perf out of virtualization on a macbook.
It's possible that this changed post-M1 and it sounds likely it's set to change with M4.
EDIT: ok, I'm probably hallucinating more problem than there actually turned out to be based on the pain in the first year of the M1 chips.
But yes, virtualisaiton support for ARM (in general) was abysmal and Apple Silicon was the catalyst that pushed people over the edge towards improving it across aarch64 (also in general).
Anyway, even at that, virtualization isn't really my preferred way to solve any of the problems I have.
I guess your dainty, utopian senses are irrationally offended by something that works. Some types of virtualization offer hard isolation guarantees while cgroups, chroot, jails and the like provide pretend isolation lacking hard guarantees about either security or resource limits. KVM is tiny and so is Virtualization.framework. If you want perfect "containers", you're not going to find them anywhere because they try solve a problem (convenience, speed, and isolation) at the wrong level, in the wrong way. Type 1 Xen and VMware are the gold standards supporting all sorts of deduplication, replication, and migration options that containers can't touch. Type 2 Kata Containers is another option out there with stronger guarantees with the same interface as CRI. If these don't work for you, write a better solution that can divvy disk IOPS and latency, process manipulation, memory shares and bandwidth, network bandwidth and priority, and VFS fairly while sandboxing misbehaving processes from taking down other containers on the same host. I submit that these are essentially impossible goals with the architecture of Linux, which is why variants of virtualization providing paravirtualized guests is generally superior in providing service guarantees because there is out-of-band management exterior to fallible, DoSable containers.
1) What
It's MacOS, you fucking can't.
Didn't the latest MacOS update add something similar with userspace filesystems
Interesting, I hadn't heard of this. First impression skimming the docs is that they've gone to significant trouble to make it not generically useful as a FUSE replacement but I could be misreading.
The library is a drop-in replacement for libfuse and works great for me.
You're not losing anything, dtrace even without SIP has been broken and unusable for at least 2 major versions now.
You're not the target market.
:(
The question is who is clamoring for all this BS? The cynic would say that Apple is prepping us all for the eventual iOSification of Macs, where you can't do squat. Which will leave only Linux as a viable (AKA tolerable) computing platform.
Yeah, sure Apple.... sure.
I switched again, in Dec 2023 to Linux as desktop, due to the kind of issues we're discussing ITT, and also due to Apple's "buy new, you can't repair" effective hardware policy.
I setup a couple of Windows 11 machines with WSL too, and tend to use them a lot more than I expected. There's issues, and I'm still figuring some things out wrt to doing things in Windows (not WSL) but the experience is significantly better than expected.
I'm not a fan of M$ but Apple are really taking the cake for anti-user hostility these days.
Did all the Betas - never had any problem. However, after installing the RC/final version of Sequoia, I suddenly had a popup after bootup about an updated extension from "Apple Inc." and to please allow the updated version.
In Settings --> Privacy I was able to "Allow" the extension, however, this also requires a reboot. And after the reboot, the same popup appeared again.
I've put in a ticket - FB15087179.
Apple replied and said to first, toggle Activation Lock/Find My and wait 5+ minutes in-between. (Either off - wait 5mins - on, or on - wait 5mins - off.) Then boot into the bootloader and turn SIP on, then back off again.
However, when trying to turn SIP on, I get the same error as OP:
SDErrorDomain error 104.
I've found another user on Twitter with the same issue: https://x.com/davidhsherman13/status/1833264669793923151
After reporting my findings in the Apple Feedback thing, I've yet to get further instructions to try.
I've noticed he disabled "Find My Mac" in the first step and only enabled it again after everything was done.
This seems to be the key. I suspect the "SDErrorDomain error 104" is related to the "Activation Lock" aka. "Find My Mac".
I've disabled Find My Mac, booted into recovery and was finally able to set it to "Full Security" and back to "Reduced Security" again without problems. After that and a fresh boot, the popup message about the updated extension was gone.
Enabled "Find My Mac" again (after setting the system to "Full Security" first - as that's the setting I intended to use) and all is well.
nb. SIP was enabled for me the whole time. It was the security mode running on "Reduced Security" (both checkboxes checked) which was probably the cause for the "updated extension" issue.
https://apple.stackexchange.com/questions/408016/local-polic...
There's an answer there on how they recovered. Worth a try.
People are kind of anchored to how Mac is / used to be etc, thinking of it as basically another unix. That's a historical blip in retrospect. Long term, their market really isn't developers & technical users, there are not enough of those to make concessions to.
In order to really help Aunt Sally keep her computer running and functional, they need to make sure that her nephew Billy can't make any complicated or potentially dangerous changes to the lower levels of the OS based on some internet forum post. If you need that kind of configurability, you really want a different OS. (Alternately, consider whether you really do need that configurability. Maybe you just think you do, and you'd much rather have a stable operating system that just works)
Even an appliance is a tool. A bicycle, as in "bicycle for the mind" does not become more useful and valid when it gains the ability to decide if it agrees with how and where it's being operated.
There are people who think that's a good thing, who think the ultimate form of life would be the wonderful order if all the bicycles kept anyone from going too fast, removing their hands from the handle bars, riding on sidewalks, ignoring traffic lights, etc...
But those bicycles are no longer human amplifiers. They are no longer tools, or they are tools but the user is not the person on the bike.
The order argument ignores the ultimate purpose of any tool, and ultimately the point of human existence itself. It's flatly invalid to forget that the person wields the tool, not the other way around. Sanity checks and guard rails and sane defaults etc are one thing, those are themselves tools that ultimately empower the wielder, as long as the user is the one who ultimately controls them.
Image the partitions to a backup location. Zero the entire drive. Clear nvram. Reinstall macOS 15. See if it’s resolved.
That's certainly one possibility.
> They don't have NVRAM you could clear.
`nvram -p` still works fine on Apple Silicon — though I'm pretty sure it's only modifiable by the kernel these days — but, I haven't had a Mac that needed that wiped for years and years, so I missed that this is all the system image's problem on Apple Silicon now — thanks!
> Once deleted, good luck getting your system working again.
Per the 2021 post linked:
> the only way to recover it is to restore the whole firmware and software image in DFU mode
That's not "good luck" — that is, literally, the documented and expected next step, same as all the other Apple CPU devices, whether they're handheld or laptop or desktop: boot into DFU mode and factory reset it using another device.
https://support.apple.com/en-us/108900
I know the author of the original post is aware of how to do that, and I recognize that they have chosen not to do so. I'm really glad that they explore all this stuff in depth; I don't have a development device to muck around with like they do!