Gwynne Raskind

System Integrity Protection (a.k.a. Rootless): http://mjtsai.com/blog/2015/07/12/system-integrity-protection-a-k-a-rootless/ …

@mjtsai Also notice that the EA mentioned by Dave Nanian is, at least conceptually, just a reimplementation of chflags(SF_IMMUTABLE);

@ameaijou So the difference is just who is allowed to set the flag/xattr?

@mjtsai Yeah. chflags() can only unset SF_* in single-user mode, whereas the EA appears to be gated by entitlements. The result is the same.

@ameaijou @mjtsai Real difference is unrelated to security: EA is tied to Apple's code signing approval rather than local admin control.

@landonfuller @mjtsai That’s what inspired a new impl in the first place: Local admin control is assumed to be too stupid to be safe.

@landonfuller @mjtsai Unfortunately, in a lot of cases it’s a legit assumption. Many users don’t know what an admin password even is.