[0day] Bypassing Apple's System Integrity Protection
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
A security researcher's post describes a zero-day technique for bypassing Apple's System Integrity Protection on fully patched macOS by abusing the local OS upgrade and installer process, which holds SIP-exempt entitlements.