Hector Martin

You won't brick the thing, because there is DFU mode, but you will have to download a recovery bundle from Apple and install it first; just like there's no Linux on a PC without the manufacturer UEFI firmware (unless it's one of the rare coreboot supported ones).

In addition, Apple has a mechanism they use to only allow recent versions of their software to be installed on devices, by requiring a "phone home" process when you install it. This requirement can be disabled *after* you have a working install.

This makes sense; what Apple is doing is giving us advanced users a way to opt out of all of this, while making sure regular users cannot be compromised. The opt outs are stored on the SSD. So if you wipe your disk, Apple will treat your Mac like a secured device again.

One neat thing though, is that in fact these security settings are *per OS install*. This means that it should be entirely possible to dual-boot a *fully secure macOS* and Linux. That means you should be able to run iOS apps in macOS (which is disallowed without security).

oh huuuuuuh, where's that stored? does that mean you can just create a partition (on the internal storage), stick a Mach-O and permissive security settings on it, sign it all with a per-machine key (where does that live anyway?), and boot from it?

the boot policies for each volume are located in a special subvolume in the (global) iBoot system container partition, the per-machine key likely lives inside the SEP or the encrypted SEP storage (another iBoot system container subvolume), afaics

The partition right now at least needs copies of iBoot/etc, and I got it to "boot" from such a crafted partition (that was the screenshot earlier), but the blocker right now is that bputil wants login creds to downgrade security, and this ain't no macOS with login creds.

It's not yet clear is there is a way to provision all this without going through macOS, given the current security model implementation. We will see.