This question already has an answer here:

Is there any way to boot a Mac with WiFi turned off completely, until manually turned on again? (And to be precise - it should be turned off completely and not just disconnected from a network.)

The use case would be to patch a Mac that hasn't been used in a while (and has been powered off) and therefore booting it in an unpatched state is a small but non-zero security risk.

I've searched the web and haven't found any hint (could be me using wrong search phrases) so at this point I'm looking for any undocumented, "obscure" solution that's out there.

EDIT: This question has been marked as a duplicate of Can I disable wifi on boot? System not booting but while it's pretty similar, I believe it's also different, so let me clarify.

The other question is about fixing a system that doesn't boot, whereas my question is about security.

We know that EFI in Macs is able to connect to WiFi to download the Recovery image, or in case of Macs with the T2 chip--to verify the OS if secure boot is enabled.

This means that if the system hasn't been updated in a longer while, the WiFi (or more general: networking) code in the EFI can have known vulnerabilities.

So basically when I turn on such a vulnerable Mac, up to a few minutes can pass until I can disable the WiFi in macOS preferences (let's say is has a spinning disk, so the boot time is significant), and even then the EFI will still be able to turn it on after a reboot.

Now, I'm fully aware that it's unlikely that something bad will happen, but I'm hoping to learn a way to somehow enable "radio silence" mode on boot, e.g. using some magic, undocumented keyboard shortcut.

marked as duplicate by Nimesh Neema, bmike May 24 at 11:26

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • At first I thought that the linked question is slightly different than mine, but then I realized it might be my misunderstanding of how WiFi initialization works. If the WiFi chip is disabled by default and only enabled by the relevant drivers, then booting into the Single User mode and running networksetup -setnetworkserviceenabled Wi-Fi off to deactivate it in the "regular" mode indeed solves my problem (assuming that the Single User mode doesn't load any WiFi drivers)! Let me research that a bit before we close my question. – Tomasz Zieliński May 24 at 11:56
  • OK, I updated my question--even if the WiFi chip needs to be initialized before it's fully active, EFI does (or at least can do) that before macOS is loaded, so the question still holds. – Tomasz Zieliński May 29 at 16:40

Browse other questions tagged .