#YABAI SIP SOFTWARE#
#YABAI SIP CODE#

I know this scenario has happened in the past, where a bug in the browser allows for a sandbox escape, followed by exploiting other services running on the system to achieve privilege escalation. I think cases like this is exactly what they are trying to protect against with SIP. Is it possible/common to get malware by simply navigating to a web page, for example? Like there's some common attack vector that can't be prevented by your good judgement. Would you say that the same good judgement on Linux keeps you just as safe on MacOS?ĭoes Linux offer similar capabilities today?

#YABAI SIP SOFTWARE#

In my case, I can also add that I'd be doing this on a work computer, so there's the added concern of the MDM software detecting it, or not allowing it, somehow (I've never had to worry about MDM before on Linux).

I guess it's the fact that Apple felt the need to implement that feature that makes it seem more dangerous to turn it off. Plus, it's a much less desirable target for hackers. And I know that, as long as I am careful with what I run, I should be safe. The reason why I'm hesitant to turn off SIP is because I'm simply not familiar with the malware landscape on MacOS. Is it suddenly way more important to restrict the root user from modifying system files and processes in macOS than it was in Linux? Out of curiosity a lot of macOS users that ask these questions seem to also be (former) users of Linux. Thank you for the detailed answer! I knew I must've been missing something 😅 Is it suddenly way more important to restrict the root user from modifying system files and processes in macOS than it was in Linux? Does Linux offer similar capabilities today? This comment I made some time ago may be of interest to you: #798 (comment) This is the reason frankly no other software except for yabai and TotalSpaces2 (which uses the same techniques) offers these features.

#YABAI SIP CODE#

There is also no way to implement this functionality without code injection. There just is no way of doing this and also have SIP be enabled.

We inject code into a system process (the Dock) through its task port, to extend its capabilities and modify some of its internal state. In addition, the techniques yabai uses to implement some of its functionality is essentially the same that a malware would be using. In yabai I use quite a lot of private APIs that are not publicly documented by Apple, and so it will never pass their App Store and notarisation review. Having your software become notarised only lets Gatekeeper mark your software as 'Approved by Apple' to prevent a warning on first run, which can be bypassed by holding the alt-modifier (or whatever it is) during first launch. Apps that are on the App Store are sandboxed by default and cannot access parts of the system without specific entitlements being given, if I remember correctly.

Yabai sip