2

Is anyone familiar with adding functionality to the macOS pre-boot process? I'm trying to supplement FileVault's functionality so that it can integrate with a user directory service, which isn't really an Apple-supported or well-documented type of task.

My goal is to allow remote users to unlock and login to the device without having a local account setup yet. FileVault currently only allows users with existing local accounts to unlock a device. I'm working on a Mac Pro running macOS High Sierra 10.13.6 with APFS.

Based on Apple's documentation of the boot process and Eclectic Light Co's articles on the topic, my understanding is that pre-boot procedures such as kernel loading and FileVault decryption are handled by the boot.efi file in the Preboot APFS disk partition.

So as far as I can tell, I need to modify how boot.efi works to achieve my goals. Is there a way I can build my own boot.efi with additional functionality and then safely replace the existing one, or can I add a supplemental EFI file with additional functionality that is run in conjunction with boot.efi?

Along those lines, the only resource I have found so far is Piker Alpha's boot loader source tree, but I'm hesitant to use this project since it appears to be outdated/only for HFS+ based Macs (and also only builds using Visual Studio).

Does anyone have other resources or suggestions on how I can modify macOS pre-boot procedures?

Improve this question
5
  • I know you can use your own bootloader as long as you're not using one of the newer secure boot machines, take a look at something like rEFIt if you haven't already. I haven't seen a customized version of Apple's own bootloader, but don't immediately see why it wouldn't be possible if you have the source.
    – kumowoon1025
    Mar 11, 2019 at 12:47
  • Related What does boot.efi actually do? And conceptually it looks like re-inventing a wheel when your cart needs a driver? So, what is the real goal for having it "integrate with a user directory service"? Remote or auto-decryption?
    – LаngLаngС
    Mar 11, 2019 at 13:05
  • @LangLangC my goal is to allow remote users to unlock and login to the device without having a local account setup yet. FileVault currently only allows users with existing local accounts to unlock a device.
    – eckenrod
    Mar 11, 2019 at 13:20
  • Please edit that explicitness into the question. Also check out github.com/grahamgilbert/crypt & github.com/grahamgilbert/crypt-server and see if that and on that level is approaching your goals?
    – LаngLаngС
    Mar 11, 2019 at 13:52
  • 1
    @LangLangC edit made. Unfortunately Crypt isn't quite powerful enough for my needs. I really need to change the way FileVault handles user accounts itself. I do not need remote key management.
    – eckenrod
    Mar 11, 2019 at 14:26

1 Answer 1

Reset to default
1

Apple doesn’t prevent you from running other EFI unless you have trusted OS / T2 chips. You can disable these security steps on Mojave and current T2, but that’s pretty manual and not automated.

You’ll want to look at tools like BootRunner or the two canoes MDS with automaton to automate the pre-boot environment for all modern Mac hardware and modern macOS.

Much easier to handle things with the tools Apple gives than trying to re-engineer EFI / customize things that don’t have sanctioned support. Extending PAM / authentication is long supported, but changing EFI is not something most enterprises take on in my experience.

Improve this answer
1
  • Thanks for the advice! I had come to the conclusion that modifying the EFI was definitely a while goose chase, and I appreciate the suggestions!
    – eckenrod
    Jun 13, 2019 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .