Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

I mean I already knew something was weird when I couldnt su into root and do... root things without a bios hack on a Mac. Thats just not how Unix works at all... The whole concept of root is you are root no exceptions.

You don't need to hack anything, you just need to use the officially-supported mechanisms Apple provides to grant yourself more permissions (namely, disabling SIP and remounting the root filesystem).

> The whole concept of root is you are root no exceptions.

Wait until you learn about mandatory access control [0] ...

--

[0]: https://en.wikipedia.org/wiki/Mandatory_access_control

That's absolutely not true. For instance, the BSDs have the notion of securelevels (https://man.openbsd.org/securelevel.7) which severely limits what even the root user can do. SELinux can do a lot of the same things.

SELinux doesn’t let root just do whatever it wants.

I don't know about bsd, but there's lots of documentation on how selinux works (including source code) and information on how to alter its behavior in a fine-grained fashion. and selinux doesn't leave itself a backdoor (as far as the nsa has told us)

That's a different issue, though. Today, booting into macOS is similar to booting into a BSD with securelevel=1 enabled, or into Linux with SELinux set up not to allow modifying files in /bin or such.

It's typically not enabled by default though, but I suppose that's a fair point.

Ah I'm more familiar with Linux so that's my bad, it was still a shocking and annoying observation I had. It doesn't fully bother me cause I never even need full on root on a Mac but this one time I did and having to tell my wife (girlfriend at the time) how to do all of that over the phone was just suspect, just so she could root a tablet that had a kill switch (Nvidia Shield Tablet).

That very much depends on what distribution you use. The Fedora/CentOS/RHEL world has had SELinux enabled by default for years. The Debian world has not but AppArmor is pretty popular there and while that's a fairly different system it hits many of the same sandboxing points. Beyond the default configuration, anyone who is following a hardening standard like CIS is going to have SELinux enabled, too.

You can't even remove their new bloated system-installed wallpapers (>2GB, with about 3 of them taking almost 300MB each) without rebooting into safe mode and following tons of steps. But they will sell you an SSD upgrade to help hold them for 3X the market price.

https://apple.stackexchange.com/questions/375519/how-to-dele...