1

Assume I have a MacBook Pro 2019 with Big Sur installed.

My goal is to have two different partitions on the same physical SSD. I want to have two separate installations of Big Sur. My question is: How can I make sure, that nothing I do on either of the partitions has an effect on the other partition? Assume I install some software with admin rights on partition B. Can it be made sure, that the program installed on B has no possibility to read or manipulate any data from partition A, for example system files?

3
  • Before Catalina you could do this easily using fstab - see apple.stackexchange.com/a/205866/85275 - but I don't know how you'd achieve it now the OS itself is split over 2 partitions, one immutable.
    – Tetsujin
    Feb 28, 2021 at 15:39
  • 1
    Can you give us more details that take us out of the realm of hypotheticals and into "this specific process reading this specific filepath"? If there is a solution, it will depend on the exact nature of what you're trying to prevent. But generally, a mounted drive is fair game for an admin process.
    – benwiggy
    Feb 28, 2021 at 15:46
  • The answer might to run VMs for each setup
    – mmmmmm
    Feb 28, 2021 at 16:21

1 Answer 1

3

The answer is no. Assume I install some software with admin rights on partition B. It can not be made sure, that the program installed on B has no possibility to ask the diskutil to remove entirely partition A.

Update

Maybe this explanation will make more sense to you. Originally with OS X, many problems could be fixed by booting to the OS X installation DVD. Security existed by storing the DVD somewhere safe. After Snow Leopard, Apple stopped issuing DVDs and instead opted for software downloads. A recovery volume was added to take the place of using the DVD to fix problems. The recovery volume contained limited functionality compared to a full OS X operating system. However, when booted to the recovery volume, changes could be made that are not normally possible when booted to OS X. This concept of recovery has been refined with each new release up to and including the release of macOS Big Sur. Along the way, Apple has taken many steps to prevent booting to recovery without first requiring user validation.

Installing a second Big Sur in a different partition creates in effect an extremely powerful version of recovery. So when booted to the second Big Sur, you are going to be able to mess with the first Big Sur, just as if you had booted to recovery. For example, SIP only applies to the partition of the currently booted Big Sur. The files in the other Big Sur are no longer protected by SIP. The same is true, if you were to install, then boot to Windows or Linux on your Mac.

The best way to protect your Mac is to only have on operation system installed. Once you install a second operating system, you open up security vulnerabilities that Apple has not begun to address.

3
  • So this also involves reading and manipulating data on the other partition? Mar 1, 2021 at 8:04
  • You are back to doing it again. You have issues with an answer, so you want to change the question. Comments are not the place to enter new questions. Mar 1, 2021 at 10:20
  • Hi David, thanks for your answer. The update made it a lot clearer and fully answered the question. But one thing I must say: my comment did not involve a new question, I wanted to make sure that what you said about removing data (quote: "remove partition A entirely"), also applied to reading and changing data, which is actually a huge difference. But that's clear now! Mar 1, 2021 at 19:32

Not the answer you're looking for? Browse other questions tagged .