Apple Updates Platform Security Guidelines: Apple Silicon Mac Will Not Support Kernel Extensions-Apple Mac

MacRumor reports thatApple just reviewed a new version of the “Platform Security Guide”, which provides a complete overview of the latest security features for platforms such as iOS 14, iPadOS 14, macOS Big Sur, tvOS 14, watchOS 7.For example, the document mentions the optional password monitoring feature of the Safari browser in iOS 14 and macOS Big Sur.

(Image via MacRumors）

As the name suggests, this security feature can automatically monitor exposed data breaches and provide timely warnings by analyzing potential leaks of user saved passwords.

Additionally, Apple describes iPhone / Apple Watch is very interested in the digital car key function,And in the preface, the company’s “security pledge” was updated, stating the security benefits of its chip designs on various platforms:

Apple continues to push the boundaries of security and privacy. For example, this year, devices using Apple SoC cover everything from Apple Watch smartwatches to iPhone / smart machines. iPad The full line of tablet and Mac products.

Custom chips not only provide support for efficient computing, but also provide more comprehensive security support. Apple’s self-developed chips lay the foundation for secure boot, Touch ID / Face ID, data protection, and system integrity features unparalleled on Mac (including kernel integrity protection / pointer authentication code / quick permission restrictions etc).

These integrity features help prevent common attacks against memory, operating instructions, and the use of javascript on the network. Combining them can also ensure that even if the attacker’s code can be executed in a certain way, the damage it can cause can be greatly reduced.

Screenshot (from:Apple Support）

For Apple Silicon Mac, the document describes the platform startup process, startup mode, disk startup, the Rosetta 2 conversion process for applications built for Intel Mac, the FileVault safe, and activation lock. , and other security features.

As expected, the new guidelines confirm that future Apple Silicon Macs will not support kernel extensions:

In addition to allowing users to run the older version of macOS, this also requires reducing security and performing other operations that can threaten the security of the user’s system, such as introducing third-party kernel extensions (kexts).

Kexts have the same privileges as the kernel, so any loophole in third-party kexts can cause total damage to the operating system.

This is also an important reason why we strongly recommend that developers adopt system extensions and then remove kext support from macOS to provide better compatibility with future Apple Silicon Mac.

Screenshot of the document (PDF Portal）

MacOS Catalina is reported to be the latest version that fully supports kernel extensions. As Apple no longer recommends the use of kernel extensions, subsequent users are expected to make further improvements to the integrity and reliability of the operating system.

Also, starting with macOS Catalina, developers have been able to run system extensions in user space (rather than kernel level).

Apple noted that this move may grant system extensions some necessary privileges to perform specific tasks, thus improving the stability and security of macOS.

Finally, we saw all the new content and change information in the “Document History Review” section of the “Platform Security Guide,” and learned that Apple also has a new security certification and compliance center. .