Hacker News Reader

Comment by saagarjha | Hacker News Reader

Turning off SIP allows for any user process to immediately gain root privileges. This is surprising to most people, so I generally would not recommend it without fully understanding the risks behind it.

View on HN

Citation needed. Turning off SIP does not give everything root. It just restores a normal root user, like you would have in Linux.

Are you perhaps thinking of single user mode instead?

~You can have a root user with SIP enabled. SIP protects core OS files from being modified while it’s enabled. This prevents processes, even root processes, from swapping out core libs with modified ones, installing root kits, back doors, etc.~

I misspoke

> System Integrity Protection (SIP) in macOS protects the entire system by preventing the execution of unauthorized code. The system automatically authorizes apps that the user downloads from the App Store. The system also authorizes apps that a developer notarizes and distributes directly to users. The system prevents the launching of all other apps by default.

https://developer.apple.com/documentation/security/disabling...

I was thinking of this https://eclecticlight.co/2020/06/25/big-surs-signed-system-v...

Uh, this being a repeated problem in the past? Apple puts some sort of god mode behind an entitlement, only checks the entitlement rather than the actual permissions, disabling SIP allows for anyone to steal the entitlement and assume root. Apple does not consider this to be a legitimate security issue because they do not think systems with SIP disabled deserve security.

Reply on news.ycombinator.com