How to check if your Apple Silicon Mac is booting securely

55 shorden 13 8/24/2025, 11:44:47 PM eclecticlight.co ↗

Comments (13)

bduhan · 1h ago
I had to do this today for a Universal Audio Apollo audio interface. Glad it’s on a dedicated machine.

https://help.uaudio.com/hc/en-us/articles/360057137692-Apple...

Barbing · 1h ago
Interesting. They need that for lowest-possible latency? And it should be fairly safe?
arcticbull · 1h ago
Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple drops the hammer.
Barbing · 1h ago
Useful, thank you! Looks like the author just enjoys helping fellow nerds. Nice
8ig8 · 1h ago
Dr Howard Oakley. I think of him as an OG Mac guy.
ostensible · 55m ago
`man csrutil`
userbinator · 2h ago
s/booting securely/running only the code Apple approves of/g
arcticbull · 1h ago
Not exactly, distribution conversation aside this is specific to kernel extensions. Apple's been moving drivers out of kernel space and into user space for several years [1]. There's a lot of good reasons for doing so, and not a lot of drawbacks. I'd consider this to be a strongly worded API deprecation notice.

[1] https://developer.apple.com/documentation/driverkit

bapak · 2h ago
You can run unverified code if you build it yourself. You can distribute unverified code by just paying $99/year to Apple. Not great, but still no need for specific code approval.
Gigachad · 27m ago
You can run whatever scripts you want without paying anything. Pretty sure the signing thing only applies to .app programs.
cyberax · 1h ago
Not if you want to use some features like bridged networking. For that you need to go and beg Apple for an entitlement. Or you have to disable SIP entirely.
Barbing · 1h ago
They respond to the begging as incredibly well as they respond to feedback/bug reports, right?
cyberax · 17m ago
To be fair, they _do_ respond well in this particular case. But you have to write an email to a developer somewhere in Apple, as there is no established process.