macOS utilizes several security controls derived from BSD. In particular, it utilizes traditional discretionary-access restrictions to system resources and files that are based on user and group IDs. In this case, permissions are granted mainly at the level of folders, files, and apps, and are controlled at many levels, including kernel components. In addition, macOS implements mandatory access controls to power multiple important features, such as sandboxing or System Integrity Protection.
System Integrity Protection was introduced in OS X 10.11 and enforces read-only access to specific critical filesystem locations, even for the root user, being applied to all running processes. The following locations are protected:
- /usr
- /bin
- /sbin
- /System
- Apps pre-installed with OS X
These paths can be accessed only by processes signed by Apple that have a reason to work with them, such as Apple software updates. Thus, system files and resources, including kernels, are separated...
