Permissions and granting access by privacy controls are completely different. This explains how Full Disk Access and other privacy settings can’t override Unix permissions, and why they must be distinguished.
SIP
Changes to keychains, volume structure, Time Machine, Migration Assistant, and the security command tool that have only recently come to light, six months later.
Details including XProtect, XProtect Remediator, Bastion, Kext Exclude List, Incompatible Apps, MRT, GK Opaque and the mystery GKE that is installed then vanishes.
All it required was the command bless, until that was undone by SIP. Since the T2’s secure boot, it has become steadily more complex, and now is only really possible from the internal SSD.
Introduced in Catalina to enable ‘privacy by user intent’, these contain header-UUID pairs, with the UUID identifying the app granted access. But UUIDs change with every restart, so can’t be used to track access prior to the current session.
Deconfusing the term permissions from security controls and privacy protection. While permissions are set in a file’s attributes, privacy is controlled through elaborate rules.
How to check secure boot, SIP, Gatekeeper/XProtect, its SSV, FileVault, macOS and its firmware, and XProtect Remediator scans.
XProtect, XProtect Remediator, XProtect Behaviour Service, kernel extension excludes, incompatible apps, and some historical remnants, including a database that’s downloaded then vanishes.
It provided 3 protections when introduced in El Capitan in 2015, and has now grown extensively to cover NVRAM, kernel boot arguments, authentication of root, and even malware scans.
Permissions, ACLs, TCC’s privacy controls, SIP and app sandboxes. What they are, and how you can control them to access and maintain your files.
