Apple Exclaves

It’s not uncommon for mid-cycle releases of macOS to gain new features in preparation for the next major version. Perhaps the most fundamental and significant added to Sonoma 14.4, together with iOS 17.4, iPadOS 17.4 and watchOS 10.4, are exclaves.

https://eclecticlight.co/2024/08/20/sonomas-unfinished-busin...

saagarjha19• 1 year ago

In macOS 15 and later, creation of a VM running macOS 15 or later can configure an identity derived from the host Secure Enclave, enabling access to resources requiring Apple ID including iCloud. This is accomplished using an exclave of the Secure Enclave.

This is not correct

totetsu• 1 year ago

My crusty squinty morning eyes read that as “ it can lead to a complete system compromise, as all the operating system’s functions are bundled together in the kernel’s single “breakfast of eggs”.” .. now I wish this was the idiom.

markus_zhang2• 1 year ago

I'm not familiar with that level of knowledge, but from the look of it you can attack the enclave itself to escalate privilege higher than the kernel enjoys? Is this piece of hardware something like a co-processor?

saagarjha19• 1 year ago

An exclave isn’t hardware, it’s an isolated piece of software that deals with a certain sensitive operation that you don’t want the kernel to have access to. So if you exploit it, then yes you have access to something that the kernel doesn’t–but that’s the point, because the goal is if you exploit the kernel you shouldn’t get access to that.

markus_zhang2• 1 year ago

Oh thanks for the explanation!

alfiedotwtf• 1 year ago

If it’s all in software but the kernel has lower privileges, I’m curious how they’ll be able to update it? And if there is an API to update via the kernel, what’s stopping a push via a malicious source pretending to be Apple?

vintagedave3• 1 year ago

I'm a little confused reading the article on how exclaves are related to the Mach kernel. Is there a second, parallel seL4 kernel running on the same chip? If so, how do two kernels execute at the same time?

To allow for execution of exclave Services while isolated from XNU, Apple has introduced a new kernel called the Secure Kernel (SK).

Or do exclaves run on a separate chip, like Secure Enclaves-with-a-N do? (The article said not to confuse the two.)

transpute7• 1 year ago

SK runs on the same high speed application processors as XNU/iOS. To make this possible, additional processor privilege levels are required — likely supported by virtualization extensions

Recent Apple phone and laptop SoCs include hardware support for nested virtualization, including the M4 iPad Pro where an exclave is used for the camera LED. Hopefully the next revision of the Apple Platform Security guide will cover SK exclaves and baseband mitigations for Wi-Fi radar sensing, https://help.apple.com/pdf/security/en_US/apple-platform-sec...

Apple specific additions to SPTM

SPTM reverse engineering, https://www.df-f.com/blog/sptm3

  XNU is being refactored into a micro-kernel inspired architecture, aiming to reduce its code base, and move security sensitive operations out of it. The memory space isolation is performed with the help of a Secure Page Table Monitor - SPTM. The code signing, entitlement verification, Developer Mode, Restricted Execution Mode, and other security sensitive operations are handled by the Trusted eXecution Monitor - TXM.

> or most likely via ARM’s TrustZone technology. The XNU source code contains several references regarding transitions to and from TrustZone’s concept of a secure world

150+ TrustZone CVEs, https://www.cve.org/CVERecord/SearchResults?query=trustzone

it’s a defensive effort on a larger scale than any other end user device manufacturer is currently attempting

Google implemented pKVM on Pixels with hardware nested virtualization a few years ago, and upstreamed the code to Linux mainline, including cooperative de-privileging of TrustZone relative to pKVM L0. But they have not announced defensive features using pKVM/AVF, outside of Debian "Linux Terminal" VM.

transpute7• 1 year ago

The author published a follow-up post and revised diagram, https://randomaugustine.medium.com/more-speculation-on-excla...

While I speculated that TrustZone was being used, exclaves may well use the existing SPTM and GXF (Guarded Execution) privilege levels after all. One implication may be that there is no hard reason they couldn't be supported on iPhone 13 and higher, aside from RAM requirements and development effort. Make no mistake these are huge undertakings even for Apple.

als0• 1 year ago

150+ TrustZone CVEs, https://www.cve.org/CVERecord/SearchResults?query=trustzone

It’s important to note that most of those CVEs are to do with vulnerable software that manufacturers put in the TrustZone protected environment (many of which are garbage). There are very few vulnerabilities reported about the hardware itself.

michaelt• 1 year ago

Personally, I've always thought the fact these vulnerabilities keeps happening demonstrates that TrustZone's secure execution environment just isn't designed well.

If you're a phone designer, and you're going to put unlock PIN validation into a trusted execution environment? Sure, makes sense. If you're going to put your widevine DRM code into a trusted execution environment? I guess.

But why did they make a design that means a vulnerability in the DRM code allows an attack on the PIN validation code? That means the attack surface is huge.

You gotta keep these clowns separated if you don't want them spraying each other with water and throwing pies down each other's trousers.

sly010• 1 year ago

Isn't that just true for vulnerabilities in general? Trust Zone is not a security mechanism, it's an isolation mechanism.

saagarjha19• 1 year ago

Apple may use SPTM to manage transitions between the secure and insecure worlds

This, because they don’t have TrustZone

seventh12• 1 year ago

Why Apple doesn't use TrustZone?

saagarjha19• 1 year ago

You'd have to ask them. My general guess is they design their own stuff first and then try to get it standardized.

neom4• 1 year ago

I think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that.

I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve.

https://www.youtube.com/watch?v=Ij-jlF98SzA

musicale2• 1 year ago

It is weird. Jobs was divisive and (not infrequently) abrasive, and why would you miss a tech billionaire anyway? Yet I also feel indebted to him and to the folks at Apple who helped to produce some of my favorite products like the Mac, the iPod, and the iPad.

Jobs also said a lot of things that still resonate with me. Recently Apple introduced a "classic Mac" screensaver that shows how carefully designed the original Mac GUI was. I'm sure nobody misses the days when app bugs could crash the OS, but I wish Apple were as obsessive now about detail now as they were back then.

neom4• 1 year ago

Now that I'm becoming an old man, I've taken the time to go back and listen to him properly, to analize his thoughts and words a bit more contextually, and I've come to believe that Steve Jobs was quite misunderstood, both by us, and by himself. When I miss him I think: his thoughts were so very refined for his time, it is quite incredible and I wish he was around to hear more of them. I guess I'm a fan? Oh well...worse things to be.

(the article is good but giving you the hn for comments too: https://news.ycombinator.com/item?id=2131299)

baggy_trough• 1 year ago

why would you miss a tech billionaire anyway

Because we miss new instances of the great products they created to earn all that money.

perfmode• 1 year ago

Jobs was more than a tech billionaire. He was someone who had refined personal taste and stood on values and was willing to do what it took to see them through, despite the friction.

And the outcome was a computing company that was waaaay less mediocre than 99% of these other memetic, mediocre gradient-descent chasing privacy-abusing, ad-supported companies.

Apple has raised the bar so high. And the DNA of what is manifesting is Steve’s insistence and vision followed by Tim’s clarity of execution.

Look at the Apple Architecture moves. They got Intel’s hot, slow CPUs out of the device. And replaced them with excellent, quiet, fast, efficient CPUs, with UMA and great features.

It’s hard to nail every detail when you have the surface area of Apple 2025. A huge huge company with billions of users and dozens of device families and services. But the bar is high for most of what they do.

eleveriven4• 1 year ago

It's not just about the products themselves, but the philosophy behind them. He had this relentless obsession with making technology feel right (it is all from my perspective)

musicale2• 1 year ago

And I need to be more obsessive about proofreading before HN's editing timeout expires.

lern_too_spel2• 1 year ago

Steve believed at his core that locking down devices was the best way to extract business value from users. That's why you can't install any apps without telling Apple or get your location without sending it to Apple. He also believed very strongly in good marketing, and he jumped on privacy marketing very quickly after the Facebook - Google privacy spat that coincided with the failure of iTunes Ping.

IncreasePosts• 1 year ago

That seems very unlikely since nothing of that sort was ever attempted by Jobs on their desktops.

vlovich1232• 1 year ago

The company shift to privacy was more about getting pulled in front of Congress over the location data being accessible via USB as part of iTunes backup:

Source: people who were at Apple during that time period.

Example: https://www.nbcnews.com/news/world/government-officials-want...

I think people underestimate how traumatic it was culturally to Apple and how Apple generally experiences comparatively little turnover vs their other major tech peers, so the responses to those traumas linger. Same with the brouhaha over the CSAM tech that they attempted to bundle into the iPhone that ostensibly was trying to preserve your privacy and they instantly got smacked down over it.

astrange4• 1 year ago

He also believed very strongly in good marketing, and he jumped on privacy marketing very quickly after the Facebook - Google privacy spat that coincided with the failure of iTunes Ping.

I have two thoughts about this.

One, if you tell yourself a story strongly enough, it becomes real. Especially when you can structure the company to force it to become real.

Two, "marketing" is usually used disparagingly to mean something like "advertising that brainwashes customers into wanting something", but it's more like "knowing what people are going to want by the time it's ready to ship". It doesn't necessarily even include advertising. So in this case people do want privacy.

nedt• 1 year ago

The first iPhone didn't have an app store and the idea was to just use websites and later install webapps. On that there is no control whatsoever, so no I don't think the original idea was to lock down the devices for business value.

yalogin2• 1 year ago

Sorry I am sure the article about enclaves triggered this thought about Steve for you. I cannot how one led to the other, can you may be tell us?

neom4• 1 year ago

hehe, it's a good question. When you get to scale, you realize you got there because a lot of humans put you there. It's part of why scaling is hard, business is an art and science that juggles the value exchange between us in society. People still here on hackernews are angry at me personally for decisions at digitalocean, in retrospect, I wish I'd handled the wipe disk thing that happened better, for example. It's both very easy and very difficult at the same time to build a business while trying super hard to love (really actually love as humans love!!!) your customer because many many things want to prevent you from loving your customer (I have government stories too, many of us do). At the end of the day, they are doing the real work, like, the real real stuff, they don't have to, I mean, they don't right? But they will, because it's the right thing to do, because Steve said so. apple here, have taken extraordinary engineering effort to say even if you compel us, we physically can’t give you access to their diary. That is to be commended, and that, is Steve Jobs.

eleveriven4• 1 year ago

Tim definitely carries that torch in his own way, but there was something about Steve's presence that made everything feel more… human? Less corporate? Hard to put into words, but yeah, I miss him too. Thanks for sharing that video.

ChrisMarshallNY3• 1 year ago

One of the things about Tim Cook, that people don’t really talk about (which, IMO, is appropriate), is that he’s openly gay.

Most times, this doesn’t mean anything, but there’s very few demographics that understand the need for privacy and data protection, better than gay folks.

Of course, he’s still at the whim of the Board, and he’s no spring chicken, so there’s no guarantee that his successor would feel the same, but I do believe that he, himself, is legitimately serious about privacy.

amelius• 1 year ago

As someone who builds industrial/scientific machines, the consumer oriented devices that Apple makes are completely unusable for me. Locking down completely capable computing devices seems like such a waste. I'm also not a fan of how Apple controls devices and the market of software after the device has changed owner. I'm staying the hell away from this ecosystem. Not sure why many so-called "hackers" are so enthusiastic about these "hood-welded-shut" systems.

intrasight• 1 year ago

"The worse system except for all the others that have been tried."

Many hackers think that about Apple computers. Many others have no choice because they develop iOS apps.

rollcat7• 1 year ago

I'm a self-branded hacker so I'll share my motivation:

Shit. Works.

This is critical. I can focus on my actual task at hand, rather than fiddling with the system.

Some perspective: I've been on Debian for 15 years, and I still hold it in very high regard for servers. I'm also an occasional Alpine & OpenBSD user; and Windows for games. I've tried Ubuntu, couldn't stop it from getting in my way. Before you suggest Fedora, Arch, NixOS, whatever: I'm done distro-hopping. The experience is about equal everywhere. No amount of "choice" beats thoughtful design, accessibility, and vertical integration.

devmor• 1 year ago

Personally, I do not like MacOS, and I do not like using a Macbook for work, because I am a developer and a hacker. It is harder to do my job and harder to be efficient at my work.

That being said, I love iOS on my phone and tablet. I used to prefer android, because of how much I could customize it, but it slowly became less reliable and more centered around selling me products and services sponsored by Google or my carrier. I switched to an iPhone and iPad about 7 years ago and am much happier with a reliable set of mobile devices that I know are relatively secure and wont get in the way of what I want to do.

Point being, the OS you want on, and ecosystem you want around your devices absolutely depends entirely on what you want your devices to do (or not do against your will).

alabastervlog2• 1 year ago

What's excessively locked down on MacBooks?

There are some security features that (for good reason) get in the way of e.g. dtrace, but I'm not aware of any of those that you can't turn off.

I'm also not a fan of how Apple controls devices and the market of software after the device has changed owner.

What's this about?

m463• 1 year ago

I totally agree. I think the best time was when they switched to the intel architecture, and their machines were good at interoperating with the rest of the world.

But I think they're regressed. I think sj was good at getting apple to interface with the rest of the world, and make course corrections. But now they've forgotten how.

Everything apple does is more apple ecosystem, ignore everyone else.

Sort of like the 7-habits dependent, independent, interdependent. Now they're back to independent.

so... they ignore the rest of the world. their own hardware, their own languages, everything else comes from their store. admittedly macos still allows people to run their own software, but ios doesn't let you run software or even access your own filesystem.

adamtaylor_133• 1 year ago

I'm one of the most technically-inclined people I know in my personal social circle (not true in my professional circle.) I'd even probably go so far as to label myself a "hacker". But I do care about UX (which Apple nails). I do care about convenience (which Apple nails.) And I do care about privacy (which, and I know I'll get flak for this, Apple _also nails_ when compared to any other device on the market that isn't explicitly marketed to developers.)

However, despite being an actual software engineer, I'm no security researcher. I don't understand kernels or privilege elevation or anything deeper than the UNIX shell I work in. So it's nice to have a system that's 99% safe by default, but still allows me to run crons, or programmatically open/modify things, and generally script my machine to look and behave the way I want.

Apple is the perfect middle-ground for people like me. Just because you can't fiddle with a kernel hardly makes this a "hood-welded-shut" machine. There are processes on my Windows machine that I'm not allowed to kill even as an administrator. I can `kill -9` whatever the hell I want on my Mac.

There's a very large group of people who operate like me, and are even less technical than I am, but love things like Keyboard Maestro or Apple scripts which allow them to tweak little things. Windows has no comparison and as far as I've witnessed it's one of the most frustrating operating systems in existence. Most people do not have the time or desire to run Linux. So, you are left with Apple which nails several of selling points that no other ecosystem nails.

That's why people, including "hackers", are enthusiastic about this "hood-welded-shut" system.

johnklos• 1 year ago

Let's step back for a moment and think about this example:

Do I, a highly technical person, want a machine that has been made in to an appliance, where I have very little control over what's going on in the background, where I have to trust one of the largest companies on the planet to Do The Right Thing™?

Well, I know I don't want to run an OS like Windows where the end user is treated with contempt and distain, where the price of the license means nothing because I'm still treated as someone who doesn't know enough to even choose my own browser, where third party programs have more control over my own machine than I do, unless I happen to have a lot of specialized knowledge and plenty of time to circumvent these biases.

But let's compare the Apple appliance to an open source OS running on an Intel CPU. Now I have an OS that gives me more freedom to do what I want and need, that has only documentation and technical issues as roadblocks, not intentional design. Better, yes? But now I'm also required to trust a company that has a literal hardware back door built in to it, that comes from a company that acts like they have no real understanding of security but might just be playing dumb, that has lied to users many times over years, that has knowingly chosen speed and marketing numbers over security time and time again.

Now add the fact that we need to trust binary blobs for wifi chipsets, some ethernet chips, GPUs, et cetera. Not great, if we want to both control our machine and trust it.

So, really, would I want to run an open OS on top of a janky CPU with lowest common denominator hardware, where each part might have issues, possibly security issues, or would I want an appliance?

I wish there were more options... AMD is better than Intel, but not sufficiently. They have less of a history of lying, of manipulation of marketing information, et cetera, but they still have that hardware back door. People are working on open source firmware for wifi chips, et cetera. ARM is nice, but ARM laptops and desktops still come at a premium.

So do I see the appeal of an appliance that has incredible performance, battery life, the best exploitation of the hardware on the planet, excellent quality and security? I do, particularly when all aspects of that appliance are in the hands of a company that makes their insane profits from being "premium". So long as their profits depend on being premium, I will trust them, because my trust needs align with their profit desires. When that stops, my trust stops.

Would it be nice if I could run my own choice of OS on it? It would. But sometimes we need a device that gets things done, and in many instances, an appliance is better than the alternatives.

Can I still run pretty much what I want on this appliance, aside from my OS of choice? Yes, I can. So unless I'm interfacing directly with hardware, these appliances mean less work for me.

That's not to say your case isn't valid, but it's easy to see a case for most people having appliances.

kennysoona8• 1 year ago

Not sure why many so-called "hackers" are so enthusiastic about these "hood-welded-shut" systems.

I think the term 'hackers' has become diluted to the point it just means 'enthusiastic coder' - it hasn't seemed tied to creative thinking or pushing boundaries in some time. That probably stopped around the time the LifeHacks site became popular.

They prefer Apple because most are young and grew up with iPhones and Apple being cool due, all while MS starting continually shooting themselves in the photo with Win 10 and 11. They probably approve of Apple standing up to the FBI also.

-__---____-ZXyw• 1 year ago

It's so weird, but I really miss Steve.

When I see the sincere sentiment sometimes expressed towards Jobs, I wonder if something similar is being tapped into when people - often tech people - use and experience LLMs.

To put it a bit bluntly, it almost feels like there's a mystical or religious element to it. As if we desperately want there to be miracles, and oracles, and god-like, caring men who can provide us with beautiful products, and rituals, and a future where everything is sleek and bountiful and timeless. As if some spiritual "hole" were being filled.

I don't mean to disparage anyone who feels fondly towards Jobs or LLMs, I'm merely sharing an observation of mine.

9dev2• 1 year ago

If you haven’t, I recommend reading Harari, specifically Homo Deus and Nexus. He writes at length about what he calls dataism, a new kind of religion filling the void liberalism and enlightenment left in us. Good reads.

api5• 1 year ago

They seem like the last big PC company where PC actually stands for personal computing. It’s a left over from old Silicon Valley, the one steeped in human potential ideas with a sprinkling of actual as-in-individual-liberty libertarianism.

RIP

kazinator• 1 year ago

If most of the stuff the user cares about is inside the "Insecure World" bubble of the diagram, then this whole business is, like, for shit.

It serves only the platform provider, who can decide which programs may or may not be installed based on whether they are aligned with or against their competitive interests.

vermilingua• 1 year ago

This is just plainly false. Passkeys, biometrics, app permissions, and a suite of other user-centric privacy features have clear benefit from strong isolation from an "insecure world" kernel.

hedora4• 1 year ago

How so? Isn’t this just the xkcd authorization model?

https://xkcd.com/1200/

I tried to read the article, and know what all the words mean (sel4, enclaves, virtualization primitives, etc.).

It all seems very complicated and error prone, but I couldn’t figure out what the attack model is, or what the security objectives are.

Eg, what sorts of things run in exclaves, and under what circumstances will a persistent kernel level compromise on my laptop protect those things?

sollewitt• 1 year ago

This is about process privilege. Apps and services are a layer above.

akyuu• 1 year ago

I wonder how this will affect macOS security, since SPTM is not used according to Apple documentation: https://support.apple.com/guide/security/operating-system-in...

For now, I think existing exclaves such as the one that displays the camera indicator do not really apply to macOS (since MacBooks have dedicated hardware for that), but in the future there might be exclaves that do.

wtallis• 1 year ago

since SPTM is not used according to Apple documentation:

Try reading that footnote again:

Note 2: Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM) enforce the execution of signed and trusted code on all platforms with the exception of macOS (because macOS is designed to run any code). All of the other security properties, including the protection of page tables, are present across all supported platforms.

It doesn't say macOS doesn't use SPTM. It says macOS doesn't use SPTM to prevent running unsigned code, since macOS is supposed to allow unsigned code (after the user jumps through some hoops).

saagarjha19• 1 year ago

That document is wrong and has been wrong for years (FB13803014)

brcmthrowaway• 1 year ago

What impact does this have in the user

saagarjha19• 1 year ago

It makes your device more secure.

yalogin2• 1 year ago

Who is this author? It’s a very elaborately, well written post. Great job. Having followed exclaves myself this is well done

eleveriven4• 1 year ago

This was an incredibly well-researched and well-written deep dive. It's rare to see such a thorough breakdown of something as technical as exclaves while still making it engaging to read.

ZebraDude• 1 year ago

Very interesting

teknologist• 1 year ago

I wonder if it's possible for app devs to use Exclaves. The thing that irks me about Apple is that they invent this new amazing internal stuff but then completely wall it off from devs, leaving everyone else (banking apps, wallets, secure messaging, etc.) to continue running in unsecured user space.

saagarjha19• 1 year ago

Currently no.

dwaite• 1 year ago

My understanding is no with the current design - exclaves are built into the overall OS and started as part of the boot process, so they are relatively static. I suspect these components have static relationships for security reasons.

They are also kernel-to-kernel currently, so third party support would likely be limited to implementing things like secure device drivers. However, Apple has been trying to push third party drivers to user space, not to the hypervisor. Based on that migration happening in parallel with this development, I do not suspect they plan to pivot and have third party driver developers use exclaves.

It is pretty common for Apple to do significantly more stabilization of kernel-imposed platform features like this internally before exposing to third parties (see also pointer authentication a la arm64e).

mike_hearn• 1 year ago

They don't do that. Apple userspace has continually got more secure too.

One simple example: recent versions of macOS run all apps inside a sandbox, even those that don't opt in. One thing the sandbox blocks is apps modifying each others files, which up until then had been a major weakness of the security system (signatures of a bundle were checked at first-run, but not on every execution).

hello_computer2• 1 year ago

Apple works wonders protecting their plantation, but what protects you from them? Have any of you pondered the prospect of “the last geohot”?

vintagedave3• 1 year ago

I had to google. There's a hacker called geohot, is that what this comment is referring to?

Could you explain what you mean more please?

hello_computer2• 1 year ago

he was the first to jailbreak the iphone. where do you see things going when they release an un-jailbreakable iphone?

kennysoona8• 1 year ago

I wonder how this compares to Linux Virtualization based Security?

From the page[1] with the video: a security feature that can a) harden the kernel and b) ensure that critical kernel resources remain untampered, even if the kernel gets compromised. VBS uses hardware virtualization and the hypervisor (Hyper-V) to create an isolated virtual environment that runs as a higher trust level, called Virtual Trust Level 1 (VTL1). VTL1 has its own kernel, separate from the Guest kernel, referred to as the Secure Kernel.

[1] https://lssna24.sched.com/event/1aIeD/linux-virtualization-b...

saagarjha19• 1 year ago

Exclaves run at a parallel trust level.

lambdaone2• 1 year ago

I'm quite surprised that they use a secure exclave to control the physical camera LED - this is absolutely massive overengineering to do something very simple.

A tiny bit of hardwired dedicated logic integrated into the camera module would be more than adequate to do this - just gating of either the digital I/O or the power to the camera, and a pulse-stretcher so the LED goes on for at least a few seconds each time to prevent an attack by rapidly flicking the camera logic on and off.

A similar circuit for the microphone with a different-coloured physical LED - not just a software-controlled dot on the screen - would be a good idea too.

brookst8• 1 year ago

It gets complicated. “The camera” is a bunch of parts. You’d probably want to key off of the CMOS sensor power, but that has several power levels for standby, sleep, idle. So your hardware circuit would likely to know current, not just voltage. Or maybe go upstream and parse the I2C (or whatever) messages signaling power mode changes?

And then your LED driver would need to know screen brightness (or connect to the ambient light sensor) because you want to be bright enough to see in direct sunlight, but that level of brightness would be unpleasant (and maybe screw up legit camera use) in low light.

So if you believe your SK is secure, you can do a better job more simply by using it. And if you don’t think SK is secure, all bets are off anyway.

jjtheblunt2• 1 year ago

You can’t just add circuits and discrete components like an extra led without screwing up RF sensitivity. Cf. “Rf desense”, for example.

andrewcl• 1 year ago

You have to wonder if it is over engineering, or a resolution for something they've discovered from shipping so many phones. I wouldn't think of the camera as a security vector, but maybe Apple thinks it is?

TheNewsIsHere• 1 year ago

The camera and mic are generally regarded as security sensitive because of the possibility that they can be used to surveil. That’s why it’s a selling point to have physical hardware or hardware-bound controls or indicators that can’t be bypassed by the OS.

api5• 1 year ago

What if they want to add Face ID to the Mac but have the camera light not illuminate for that internal function, since that can also be developed securely so that nothing in user space can access the camera during that query.

MBCook3• 1 year ago

FaceID doesn’t use the standard visual camera.

It’s (for example) similar to the Kinect. It projects a pattern of structured light in IR then looks at that with an IR camera to be able to determine depth.

mrud• 1 year ago

https://news.ycombinator.com/item?id=42260379 has more details on some of the history.

linux2647• 1 year ago

I think it’s not just the camera LED, but the indicators that appear on screen, like the amber, green, or blue dots that appear in the menu bar when the microphone, camera, or screen recording are accessed by apps.

supriyo-biswas2• 1 year ago

just gating of either the digital I/O or the power to the camera, and a pulse-stretcher so the LED goes on for at least a few seconds each time to prevent an attack by rapidly flicking the camera logic on and off.

They'd be unable to roll out the feature to older iPhones if they did this.

I guess for newer iPhones this is not as big of a deal since they have a big-ass notch anyway, however Apple also has a large customer base that only buys their older products (like me), and saying that their older products have worse security than their newer ones is probably not the kind of message they want to send, even if it might potentially get them some new sales.

0cf8612b2e1e• 1 year ago

What product line anywhere says, “Buy our old models, just as good as the latest!”

runjake2• 1 year ago

It’s not over engineering. It’s because of research like this, along with other researchers like Charlie Miller.

Apple generally isn’t out to make things willfully overcomplicated without good reason.

https://news.ycombinator.com/item?id=42260379

lambdaone2• 1 year ago

All of which is fantastic, until you can't trust Apple because they are under a secret obligation to disable that feature. Non-programmable hardware gating the I/O lines or power isn't hackable in the same way.

talkingtab• 1 year ago

Reference to Mach for historical reasons. Using IPC instead of traps.

https://en.wikipedia.org/wiki/Mach_(kernel)

api5• 1 year ago

We could have avoided so much hardware and OS complexity if we'd instead (mostly) discarded the idea of shipping and running compiled code directly on the hardware.

TL;DR: we are doing things in hardware that ought to be done in software, and we're giving software too close to metal access.

User mode should be something like the JVM, but more language-neutral, something based around WASM for example. The runtime for this should ideally be written in a memory safe language and very extensively tested. User mode code should not have access to raw pointers, raw CPU, etc.

If we'd done this we also could have elevated things like the common API beyond the lowest common denominator of C. We used to have a ton of research and some fielded systems like this: Smalltalk, LISP machines, the JVM, the CLR, etc. The JVM and the CLR are still quite alive and well but the HN world seems to hate them for some reason. Smalltalk and efforts like the LISP machines died out.

jandrewrogers• 1 year ago

So your solution is to nerf the computer in terms of both performance and functionality? There is a lot of software that cannot be properly written without being very close to the metal e.g. database kernels.

api5• 1 year ago

There would almost certainly be an escape hatch, but it would require user approval to run native code. It would probably be in the form of libraries that could be 'blessed' to run native. The vast majority of software does not need this.

sroussey2• 1 year ago

MS had a research project that built an OS from CLR.

One of the great things about it (in my opinion) was the lack of context switching. It broke a fundamental assumption about how an OS should work. It could also do global optimizations.

api5• 1 year ago

Oh yeah, forgot about that: you can do profile guided optimization on the entire running image of code in the machine.

I wonder how much of a boost you'd get for that? I'm sure it would depend on the work load.

cantrecallmypwd• 1 year ago

seL4 is awesome for its formal engineering. One of the main gotchas though with purer (less hybrid) microkernel architectures is the coordination of transactions that touch multiple services, i.e., a system call or event that touches multiple hardware areas and must execute rollback code should any one of them fail.

fedxc• 1 year ago

I see exclaves as a significant but intermediate step. Apple is making XNU less of a liability, but they're still playing defense instead of fully embracing a microkernel architecture.

If I had to bet, exclaves will be a bridge to something bigger, either a more modular OS (like Fuchsia) or a CHERI-inspired security model where memory safety is enforced at the hardware level.

Apple is leading the pack in consumer OS security, but exclaves are a patchwork improvement rather than a total rethinking of system design. That said, this is probably the biggest security shift in mainstream OS design in the last decade, and it will take years before we see its full impact.

JoachimS2• 1 year ago

I see it as a way to move back to the micro kernel it once was - with modern solutions and new requirements. Security was much less of a concern when Mach was created. With the insane performance we now get in the machines, the overhead caused by the micro kernel process communication may well be negligible.

prolefeed• 1 year ago

I enjoyed the obvious references to The Expanse in the naming of secure/insecure world transitions (Ring Gate) and the RPC framework (Tightbeam)

Apple Exclaves

Related Stories