2

(A related question was previously posted in the Asahi Linux forum, I didn't get an answer there; see https://discussion.fedoraproject.org/t/question-and-worries-about-wipe-linux-in-recovery-mode/117284)

I've been experimenting with Asahi Linux on my MacBook and performed multiple reinstallations. To remove leftover volumes (normally read-only), I ran a 'wipe-linux' command in Recovery Mode. While the script seemed to work by deleting the volumes, I'm now concerned about a possible typo during execution.

My question:

If the script I ran was malicious, could it have bypassed the read-only protections and injected malware into my main data partition or the recovery/boot partitions (apple_apfs_isc and apple_apfs_recovery)? These partitions appear writable in Recovery Mode (recovery/boot partitions are usually read only), which worries me.

I am aware that MacOS has a pretty robust virus/malware detection, and virus/malware are uncommon on MacOS anyways. However, it seems that in Recovery Mode there is too much power given and I am afraid something could go south.

Improve this question
11
  • 1
    macOS doesn't use Recovery Mode to remotely do anything. Recovery.Mode is how macOS is reinstalled you must be in possession of the device to utilize it. So, I am not understanding where a "script" would be introduced to send things "south."
    – Allan
    Commented May 18 at 6:03
  • @Allan you are given elevated privilege in Recovery Mode; the exact wipe-linux script is here: github.com/AsahiLinux/asahi-installer/raw/main/tools/… if you look at the last few lines, it removes /System/Volumes/iSCPreboot/$1 where $1 iterate through unused volumes. Such operation is not possible in normal MacOS environment even with root.
    – user522753
    Commented May 18 at 6:20
  • @Allan one example, you can't write to "/System/Volumes/iSCPreboot/" in normal MacOS even with sudo privilege, but that is easily doable in Recovery Mode.
    – user522753
    Commented May 18 at 6:21
  • You don't run 3rd party scripts in Recovery Mode in macOS. You have to have hands on with the device to enter Recovery. That's my point. Are you saying that you, yourself is the nefarious actor here? I think there is a misunderstanding of Linux Recovery and macOS Recovery and you're applying what Linux does onto macOS.
    – Allan
    Commented May 18 at 6:24
  • 2
    Let's put this another way: What is the practical problem you're trying to solve here?. Theoretical questions about situations that don't yet exist are considered off topic.
    – Allan
    Commented May 18 at 7:00

2 Answers 2

Reset to default
3

Short answer: yes, it's extremely dangerous. Almost all of macOS' normal protections are disabled (or disable-able) in recovery mode.

Recovery mode is intended to allow you to perform basic setup and repairs to your system, like reinstalling macOS, repairing or formatting the disk, and changing security settings. It is NOT intended to be a mode where you'd run any non-Apple software, and it's a really bad idea to run anything you don't completely trust in recovery mode.

In fact, the script you linked prints this message when you run it:

THIS SCRIPT IS DANGEROUS!
DO NOT BLINDLY RUN IT IF SOMEONE JUST SENT YOU HERE.
IT WILL INDISCRIMINATELY WIPE A BUNCH OF PARTITIONS
THAT MAY OR MAY NOT BE THE ONES YOU WANT TO WIPE.

You are much better off reading and understanding this guide:
https://github.com/AsahiLinux/docs/wiki/Partitioning-cheatsheet

That said, while the script is certainly dangerous in that it may delete things you really didn't mean to delete, I don't see any sign that it does anything malicious. It only deletes things, it doesn't install anything or modify anything (except for creating a temporary file of UUIDs that'll vanish when you reboot).

So I don't think you need to worry that it's compromised your system, but it would be a really good idea to have a backup (or better yet, two) of anything you don't want to lose.

Improve this answer
1

Recovery mode isn’t the problem. Relaxing boot security is the issue. Without that, any script that alters the system renders it unbootable as it will fail the trust checks.

However, you can use another Mac to entirely erase all drive storage and re-establish a known good signed and sealed recovery OS and main OS.

See the Apple Platform Security guide and how to refresh and restore firmware for extensive details on the security design and practical steps to restore the trust chain for an OS on Apple hardware.

The danger of running scripts is real, it can delete data you didn’t expect or have backed up or try and modify an OS (or worse, fail to modify and cause stability issues and malfunctions), but Apple handles that by sealing and signing the boot OS and making a trusted boot the default. You are correct in guessing you are at danger when you relax those protections and run code you can’t evaluate or trust.

Improve this answer

You must log in to answer this question.