0

Background info: I need my McBook to satisfy a newly-rolled-out policy of having "full disk encryption". The relevant software checks this by seeing if all user-mountable volumes/partitions on internal drives are encrypted, or in the process of becoming such. Checking its debug logs, this includes the VM volume, which is created by the macOS installer.

EDIT: Upon closer inspection, the APFS container actually has (had) two VM volumes - one visible, mounted under /Volumes/VM and another one, not visible to the user, mounted under /System/Volumes/VM - this one seems to be ignored by the policy software, as I initially expected.

I have a few questions regarding this:

  1. Is it even normal/expected that the VM volume is mountable by the human user? macOS does this thing where "system-essential" partitions/volumes are, among other things, hidden in the GUI disk utility, and not mounted by default - the Recovery, Preboot volumes, the EFI partition, etc. My macOS installation did not start *with a blank disk, and in fact the APFS container used by the Big Sur system is inherited from a Mojave installation. If this volume visibility is not normal, I'd like to know how to revert it back - the software in question does skip over Recovery and Preboot, so it's not completely stupid.
  2. Is it safe to encrypt this volume? Finder doesn't seem to mind and offers this option just as it does on any other, user-created APFS volume.
2
  • What about the read-only sealed system volume? That is not encrypted on my MacBook.
    – Gilby
    Sep 21, 2021 at 10:33
  • Checking the logs, the software considers it "encrypted" and while diskutil apfs list says Encypted: No, it also says FileValut: Yes on the sealed volume so that probably counts.
    – myxal
    Sep 21, 2021 at 10:41

1 Answer 1

3

The contents of the VM volume is always encrypted - its contents is called "secure virtual memory":

https://support.apple.com/en-gb/guide/mac-help/mh11852/mac

FileVault does not need to be enabled on the volume, as the data contents itself is encrypted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .