Hacker News Reader

Comment by xrisk | Hacker News Reader

IIUC, safari and other essential OS components are mounted on a read-only volume. The installer has to perform special shenanigans to update it.

View on HN

Good defense in depth. Frustrating this requires an OS update & reboot, but I prefer that to weakening the defense model.

Yup, see page 51: https://help.apple.com/pdf/security/en_US/apple-platform-sec...

A read-only mount doesn't require the backing store to be immutable, nor does it need open fds on the mount to be closed for the backing store to be updated. I've shipped embedded devices that had read-only rootfs mounts and the updater didn't need to reboot before (or after) applying updates. Of course, this was on the Linux kernel, which does support replacing open files.

EDIT: I feel obligated to say this: pitchforks down, please. I'm not trying to disparage the macOS kernel. As a designer of software systems interested in how OSes are built, I found the choices taken interesting.

> IIUC, safari and other essential OS components are mounted on a read-only volume

I... what?

If I Understand Correctly

As a basic security measure the macOS system partition is readonly and cryptographically signed.

https://support.apple.com/guide/security/signed-system-volum...

Many other systems, including ostree and Android, have solved this problem years ago. For example, the update can be installed on a read-only cryptographically signed overlay.

That's right. Safari is an application and so lives under /Applications, which is one a few special directories where the user can make changes, which actually live under /System/Volumes/Data in a scheme similar to unionfs under Linux.

Which is to say, / under Catalina and above (so, since 2019), the root partition is really the mount of an APFS snapshot. There's security as a reason, but also from a system perspective, it makes it more robust to upgrade/downgrade OS versions under such a scheme because you always have a known-good system image to revert back to.

Safari though is a special case, and so /Applications/Safari.app is a symlink to ../System/Cryptexes/App/System/Applications/Safari.app

https://superuser.com/questions/1495124/read-only-file-syste...

More importantly, it's updating the system WebKit framework, which is a core framework so even if Safari.app was separate, the system framework update forces the reboot. The Safari Technical Previews include their own complete copy of the WebKit framework and link to that (and Safari.app can be made to load WebKit.framework from elsewhere which is how webkit nightlies and from-source builds of webkit can be used)

Reply on news.ycombinator.com