Saagar JhaFeb 25
This is your reminder that having SIP turned off allows trivial escalation to root and disabling part of SIP is broadly equivalent, security wise, to disabling the whole thing
Show threadtbodtFeb 25
@saagar allowing untrusted kexts though? given that changing a kext requires reboot and auth just like disabling sip?
Show threadSaagar Jha
@tbodt I don’t think there is an easy way to install a kext but given that I basically never do this I doubt anyone really cares at this point
Feb 25 at 10:10pmWeb
Show threadtbodtFeb 25
@saagar i mean like, if you partially disable sip to load a kext, and that kext is safe, and you never change it, that's better security-wise than sip fully disabled. right?
Show threadSaagar JhaFeb 25
@tbodt No, I don’t think so, because a lot of stuff checks for SIP being disabled which means any flag counts
Show threadtbodtFeb 25
@saagar dammit
ok, just have the kext enable sip again problem solved