Apple Platform Security Guide (May 2022)
Unless otherwise noted, this documentation covers the following operating system versions: iOS 15.4, iPadOS 15.4, macOS 12.3, tvOS 15.4, and watchOS 8.5.
Topics added:
In macOS 12.0.1 or later, every new macOS installation also installs a paired version of recoveryOS into the corresponding APFS volume group. This design is familiar to users of Intel-based Mac computers, but on a Mac with Apple silicon, it provides additional security and compatibility guarantees. Because every macOS installation now has a dedicated paired recoveryOS, this helps ensure that only that dedicated paired recoveryOS can perform security-downgrading operations. This helps protect installations of newer versions of macOS from tampering initiated from older versions of macOS, and vice versa.
[…]
To boot into a paired recoveryOS for any macOS installation, that installation needs to be selected as the default, which is done using Startup Disk in System Preferences or by starting any recoveryOS and holding Option while selecting a volume.
Don’t be put off by its title: Apple Platform Security Guide is mandatory reading for all advanced Mac Users, and the only way we get to learn about important details of macOS, iCloud, and much else.
[…]
Indeed, several of us have experienced problems trying to get a downgraded copy of macOS on an external disk to load third-party kexts. Could this be the result of our not setting that boot volume group as “the default”?
[…]
What the Guide says currently is incorrect at the least. If M1 Recovery Mode really does have two different ways of selecting the boot volume group to be used next, their differences need to be explained properly and not left to inference and guesswork. Users, who are hardly likely to pore over the Guide or study bputil’s man page, need clear explanation of how they should start their M1 Macs from an external boot disk, how its local Recovery system is paired to it, and how to use Startup Security Utility effectively.
Previously:
Update (2022-05-19): Nick Heer:
Max Zinkus tweeted a thread of notable new sections and updates, like this one[…] This is part of a broader question about whether Apple could switch any iMessage discussion to Messages for Business Chat, which has looser security and privacy standards than peer-to-peer iMessage.
iMessage itself retains a misleading description of its security architecture[…]
Update (2022-06-03): Howard Oakley:
This year, eagle-eyed readers noticed a significant absence: all mention of the Malware Removal Tool, MRT, has gone.
