Understanding macOS Security Architecture: SIP, Gatekeeper, and Notarization

System Integrity Protection (SIP), sometimes referred to as "rootless," is a security technology introduced in macOS El Capitan (10.11) that helps prevent potentially malicious software from modifying protected files and folders on your Mac.

• System Files: Protected system directories including /System, /usr, /bin, /sbin, and apps that come pre-installed with macOS
• Runtime Protection: Prevents attachment to system processes by debuggers or other tools
• Kernel Extensions: Controls loading of kernel extensions (kexts)
• NVRAM Variables: Protects certain non-volatile random-access memory variables

SIP works by restricting the root user account and limiting the actions that the root user can perform on protected parts of the macOS system. Even processes running with root privileges (UID 0) are restricted from modifying protected system locations.

SIP can be managed from the Recovery environment using the csrutil command:

# Check SIP status
csrutil status

# Enable SIP (default)
csrutil enable

# Disable SIP (NOT RECOMMENDED for regular use)
csrutil disable

# Enable SIP with specific configurations
csrutil enable --without debug    # Restrict debugging tools
csrutil enable --without fs       # Allow writing to protected file system locations
csrutil enable --without dtrace   # Disable DTrace
csrutil enable --without kext     # Allow loading unsigned kernel extensions

Gatekeeper is a security feature of macOS that ensures only trusted software runs on your Mac. It works by checking applications for known malicious code and verifying their developer signatures before allowing them to run.

Gatekeeper offers three security levels that can be configured in System Settings > Privacy & Security:

• App Store: Only allow apps downloaded from the Mac App Store
• App Store and Identified Developers: Allow apps from the App Store and from identified developers (default setting)
• Anywhere: Allow apps from anywhere (not recommended for security)

When you try to open an application, Gatekeeper performs several checks:

1. Checks if the app is notarized by Apple
2. Verifies the developer's signature is valid and comes from an identified developer
3. Checks the app against Apple's list of known malicious software
4. Ensures the app hasn't been modified since it was signed

Administrators can manage Gatekeeper settings using the spctl command:

# Check Gatekeeper status
spctl --status

# Enable App Store only
spctl --master-enable

# Enable App Store and Identified Developers (default)
spctl --master-enable

# Allow apps from anywhere (NOT RECOMMENDED)
spctl --master-disable

# Check if a specific app is allowed
spctl -a -t exec -vv /Applications/Example.app

# Add an exception for a specific app
spctl --add /path/to/Application.app

# Remove an exception
spctl --remove /path/to/Application.app

Notarization is a process where Apple scans software for malicious content and checks for code-signing issues before distributing it. When users download notarized software, Gatekeeper can verify that Apple has checked it for known malicious content.

Notarization provides several important security benefits:

• Malware Detection: Apple scans submitted software for known malicious content
• Code Signing Validation: Ensures software is properly signed by a registered developer
• Tamper Protection: Verifies that the software hasn't been altered since it was notarized
• Seamless User Experience: Users can run notarized software without seeing Gatekeeper warnings

The notarization process involves these steps:

1. Developer signs their software with a Developer ID certificate
2. Developer uploads the signed software to Apple's notary service
3. Apple scans the software for malicious content and checks code-signing
4. If the software passes, Apple returns a notarization ticket
5. Developer staples the ticket to their software (or uploads a notarized version)
6. When users run the software, Gatekeeper checks with Apple to verify the notarization ticket

Developers can notarize their software using the xcrun notarytool command:

# Submit software for notarization
xcrun notarytool submit MyApp.dmg --keychain-profile "AC_PASSWORD" --wait

# Check notarization status
xcrun notarytool log  --keychain-profile "AC_PASSWORD"

# Staple notarization ticket to the distributor product
xcrun stapler staple MyApp.dmg

# Verify the notarization
xcrun stapler validate MyApp.dmg

• Keep SIP Enabled: Only disable SIP temporarily for specific troubleshooting
• Use Gatekeeper Wisely: The "App Store and Identified Developers" setting provides good security for most users
• Notarize Internal Tools: Ensure any custom software or scripts distributed to Macs are notarized
• Monitor Security Settings: Use configuration profiles to enforce security settings across your fleet
• Stay Informed: Follow Apple's security announcements and update devices promptly
• Combine with Other Security: Use these technologies alongside firewalls, antivirus, and intrusion detection systems