1

Currently, I am able to mount and edit the EFI partition without any special privileges. Is that correct?

I understand that the bootflags for SIP protected regions are stored in nvram which is inaccessible through bless, but it seems strange that I can manipulate the binary, and the changes will persist through a restart.

Is something wrong here? If not, why is it the case?

  • What set of specific commands do you use to mount the volume? What does "edit the partition" mean. Everything might be fine and this is about setting expectations. – bmike Apr 8 '17 at 18:41
  • Just ~$ diskutil mount disk0s1. And by edit I mean I can delete /EXTENSIONS/Firmware.scap, open MBP112_0138_B18_LOCKED.scap in a hexeditor, change values, and save it, create a meaningless file, etc.. – blanket_cat Apr 8 '17 at 19:24
  • It just doesn't seem like anything there should have 777 permissions. Is it the case that it comes like that? That that's how it's supposed to work? Or has it been changed somehow? – blanket_cat Apr 9 '17 at 3:43
  • That mount command works the same on all my Macs - why probably isn't on topic here. See meta apple.meta.stackexchange.com/questions/2608/… - I didn't vote to close since I suspect you have a very practical question and can edit that in. Like - how to secure EFI? or how to test if it's tampered? or something else? – bmike Apr 9 '17 at 3:53
2

EFI partitions are formatted with a FAT32 file system. FAT32 doesn't provide POSIX file permissions. Whoever accesses an EFI partition in OS X/macOS has full ownership of all files and folders (777).

This even applies if you change your user with Fast User Switching.


Mounting of the EFI partition requires admin privileges though.

  • Regarding admin permissions: In 10.14 (Mojave) it seems you even need to be root to mount the partition, i.e. the command would now be: sudo diskutil mount disk0s1 – Thomas Tempelmann Jul 16 '18 at 11:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .