Unit 1: How a Mac protects itself · Lesson 2 of 5 · 20 min

The sealed system volume and SIP

Prove to yourself that macOS cannot be modified, even by root, and find the one place that stays writable.

mission

You are
You are the IT security lead at Lumen Studio.
Situation
A developer claims he needs to switch off SIP to install a tool. You want to show him what SIP and the sealed system volume actually protect before you answer.
Goal
Show which parts of the disk are read-only, sealed or protected, and which are not.
Hand in
Three findings you can explain to the developer in plain words.
01

See how / is mounted

The system volume is mounted from a sealed snapshot, read-only.

sam@lumen-mbp-02
mount | grep sealed
/dev/disk3s1s1 on / (apfs, sealed, local, read-only, journaled)
diskutil info / | grep -E 'Sealed|Read-Only|Snapshot'
   Volume Read-Only:          Yes (read-only mount flag set)
   Snapshot:                  Yes
   Sealed:                    Yes

you should see The root filesystem is sealed, read-only and a snapshot. Data lives on a separate volume.

02

Try to write as root

Root normally can do anything. Here it cannot, for two different reasons.

sam@lumen-mbp-02
sudo touch /usr/bin/rootlearn-test
Password:
touch: /usr/bin/rootlearn-test: Read-only file system
sudo touch /Library/Apple/rootlearn-test
Password:
touch: /Library/Apple/rootlearn-test: Operation not permitted

you should see The system volume is read-only. /Library/Apple sits on the data volume but SIP still says Operation not permitted.

defender tip Read-only file system means the seal; Operation not permitted means SIP. Learn both messages, they tell you which guard stopped you.

03

Find what stays writable

Tools you install go to /usr/local or /opt, which are on the data volume and need an admin.

sam@lumen-mbp-02
touch /usr/local/rootlearn-test
touch: /usr/local/rootlearn-test: Permission denied

you should see Permission denied for a standard user. With admin rights it would work, which is why admin rights matter.

A company Mac and lumen-mbp-19

SIP disabled
csrutil status
System Integrity Protection status: disabled.

Any root process can patch system binaries, load unsigned kernel code paths and hide.

SIP enabled
csrutil status
System Integrity Protection status: enabled.

Malware with root still cannot touch the system. Developers use a VM when they need SIP off.

What a defender takes away

  1. 1The seal makes the system volume read-only and tamper-evident.
  2. 2SIP protects system locations on the writable data volume too.
  3. 3The answer to a developer who wants SIP off is a VM, not your laptop.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    Look at the first line of mount.

  2. Show hint

    Run the first sudo touch.

  3. Show hint

    Run the second sudo touch.