1

Can one boot M1 MacBook from a unauthorized bootable external drive: i.e. the external drive that was prepared on some other Mac, and the user not having admin password of the MacBook he is trying to boot into?

Case in question: suppose my Mac (2021 Pro) is lost or stolen; its internal drive is FileVault-encrypted; MacBook is kept offline and is not aware that "Lost Mode" is activated for it; still someone tries to use it with his own external drive that I never authorized to boot from on my MacBook.

Improve this question

2 Answers 2

Reset to default
2

I reached out to Howard Oakley, author of EclecticLight blog which goes quite deep into Mac security.

TLDR of his answer: booting from external drive is only possible if that drive was previously authorized using login and password of Mac's internal-drive admin.

Full answer below:

This is straightforward.

You can't boot an M1 Mac from an external disk without it having a LocalPolicy on its internal storage. So the only way to try that would be to boot in Recovery, there select the external disk, and try to boot from it.

Recovery won't let you do that without giving it a LocalPolicy, which then prompts you to enter the username and password of someone who already has ownership of its internal SSD - in normal circumstances, the admin user. Without that, LocalPolicy can't be created, and the M1 won't boot from the external disk.

What the 'thief' can do is put the M1 into DFU mode and restore it to factory settings, which trashes the keys to the internal SSD safeguarding any data there. And when it starts up, it then goes through the 'new M1 Mac' routine of connecting to Apple before it can be set up. If that Mac has been reported as missing, then Apple could refuse to set it up at that stage.

The relevant article on my blog is at https://eclecticlight.co/2021/07/21/owners-and-users-primary-and-secondary-systems-on-m1-macs/

Improve this answer
1

This piece from Apple Platform Security Guide (HTML, PDF) seems to suggest that only users authenticated on this particular Mac can boot it from an external drive:

A Mac with Apple silicon doesn’t require or support a specific media boot policy, because technically all boots are performed locally. If a user chooses to boot from external media, that operating system version must first be personalized using an authenticated reboot from recoveryOS. This reboot creates a LocalPolicy file on the internal drive that’s used to perform a trusted boot from the operating system stored on the external media.

This means the configuration of booting from external media is always explicitly enabled on a per operating system basis, and already requires user authorization, so no additional secure configuration is necessary.

Another piece: as of M1, volumes have ownership. When creating a second boot drive, a consent is required from a user on the default boot drive to hand off Ownership to the users on the second boot drive.

Which suggests that users who "own" an external boot drive could be not allowed to boot someone else's Mac as they are not on the same hierarchy with users on that Mac.

But I would very welcome someone more knowledgeable to comment on that.

Improve this answer
3
  • 1
    I don't know much about this, but everything that I know I learned from reading eclecticlight.co so I would recommend reading Howard's writing on this topic.
    – TJ Luoma
    Feb 16, 2022 at 2:38
  • @TJLuoma Thanks! Per your suggestion I reached out to Howard Oakley. He gave an extremely helpful answer.
    – yurkennis
    Feb 17, 2022 at 18:05
  • I am so glad! I'm no dummy, but compared to Howard, I feel like I can barely tie my shoes when it comes to Mac knowledge!!
    – TJ Luoma
    Feb 20, 2022 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .