Apple controls who receives these entitlements, allowing them to control which kernel extensions are able to load on macOS machines. Since macOS Yosemite (v10.10, released 2014), Apple has required that kernel extensions possess a particular entitlement (essentially a permission granted with a signature) to load.

Kernel extension code signing is one of the first tools Apple deployed to address this issue. SIP protection is enforced by the kernel, but we’ve already seen that kernel extensions can modify kernel behavior, so how do we prevent a kernel extension from simply disabling SIP?

SIP, among other things, prevents modification of certain files and folders, such as Apple-built system components, even by root. This is not a surprise: Apple has invested considerable effort into building out a trusted boot process rooted in hardware, but the security gains of trusted boot are limited if arbitrary code at high privilege levels can be loaded after the boot process is completed. In fact, limiting the scope of root access is exactly what Apple has tried to accomplish with System Integrity Protection (SIP) (also known as 'rootless'). Preventing third-party code from running in kernel-space could reduce attack surface significantly.Įven root access doesn’t necessarily imply kernel access. In 2011, MIT researchers found that 2/3 of surveyed Linux kernel bugs were found in loadable kernel modules, 1/3 in the core kernel. Barring functionality like dedicated security hardware, control of the kernel is the keys to the kingdom. Moreover, a vulnerability in the kernel can cause vastly more damage than a vulnerability in a usermode application. There is no higher level scheduling or preemption functionality, so all kernel code must be cooperative and relatively bug-free.

An unrecoverable crash in a usermode application will still allow the system to keep functioning, whereas an unrecoverable crash in the kernel takes the rest of the system down with it. The kernel is responsible for everything that makes the system run normally: task scheduling, access management, memory mapping and management, etc. Running code in the kernel is inherently a high-risk activity.

Little snitch endpoint security