1

Is anyone familiar with adding functionality to the macOS pre-boot process? I'm trying to supplement FileVault's functionality so that it can integrate with a user directory service, which isn't really an Apple-supported or well-documented type of task.

My goal is to allow remote users to unlock and login to the device without having a local account setup yet. FileVault currently only allows users with existing local accounts to unlock a device. I'm working on a Mac Pro running macOS High Sierra 10.13.6 with APFS.

Based on Apple's documentation of the boot process and Eclectic Light Co's articles on the topic, my understanding is that pre-boot procedures such as kernel loading and FileVault decryption are handled by the boot.efi file in the Preboot APFS disk partition.

So as far as I can tell, I need to modify how boot.efi works to achieve my goals. Is there a way I can build my own boot.efi with additional functionality and then safely replace the existing one, or can I add a supplemental EFI file with additional functionality that is run in conjunction with boot.efi?

Along those lines, the only resource I have found so far is Piker Alpha's boot loader source tree, but I'm hesitant to use this project since it appears to be outdated/only for HFS+ based Macs (and also only builds using Visual Studio).

Does anyone have other resources or suggestions on how I can modify macOS pre-boot procedures?

  • I know you can use your own bootloader as long as you're not using one of the newer secure boot machines, take a look at something like rEFIt if you haven't already. I haven't seen a customized version of Apple's own bootloader, but don't immediately see why it wouldn't be possible if you have the source. – user3052786 Mar 11 at 12:47
  • Related What does boot.efi actually do? And conceptually it looks like re-inventing a wheel when your cart needs a driver? So, what is the real goal for having it "integrate with a user directory service"? Remote or auto-decryption? – LangLangC Mar 11 at 13:05
  • @LangLangC my goal is to allow remote users to unlock and login to the device without having a local account setup yet. FileVault currently only allows users with existing local accounts to unlock a device. – eckenrod Mar 11 at 13:20
  • Please edit that explicitness into the question. Also check out github.com/grahamgilbert/crypt & github.com/grahamgilbert/crypt-server and see if that and on that level is approaching your goals? – LangLangC Mar 11 at 13:52
  • 1
    @LangLangC edit made. Unfortunately Crypt isn't quite powerful enough for my needs. I really need to change the way FileVault handles user accounts itself. I do not need remote key management. – eckenrod Mar 11 at 14:26

You must log in to answer this question.

Browse other questions tagged .