Security

Boot process of Mac computers without an Apple T2 Security Chip

Mac computers without an Apple T2 Security Chip don’t support secure boot. Therefore the UEFI firmware loads the macOS booter (boot.efi) from the filesystem without verification, and the booter loads the kernel (prelinkedkernel) from the filesystem without verification. To protect the integrity of the boot chain, users should enable all of the following security mechanisms:

System Integrity Protection: Enabled by default, this protects the booter and kernel against malicious writes from within a running macOS.
FileVault: This can be enabled in two ways: by the user or by a mobile device management (MDM) administrator. This protects against a physically present attacker using Target Disk Mode to overwrite the booter.
Firmware Password: This can be enabled in two ways: by the user or by a mobile device management (MDM) administrator. This protects a physically present attacker from launching alternate boot modes such as recoveryOS, Single User Mode, or Target Disk Mode from which the booter can be overwritten. This also prevents booting from alternate media, by which an attacker could run code to overwrite the booter.

Unlocking process of Mac computers without an Apple T2 Security Chip.

Helpful?

Apple Platform Security

Boot process of Mac computers without an Apple T2 Security Chip