Hello, I am browsing with Safari. A website asks me to access my microphone (it is a Safari prompt dialog, not a system dialog). I am answering "yes, you can access to my microphone". Everything works fine, my microphone is allowed. Now, i am going to macOS system settings, in "Privacy & Security" section. I open "Microphone" sub section: And i don't see any entry for Safari. My question is ... Why ? Safari is accessing to my microphone at this moment and i don't see any grant information about this in system settings... Maybe apple allows his own softwares but this is not good for security... I hope it is not the same behaviour for full disk access grant... Thanks

Hello, I know this is not a good practice but i want to make a test. I would like to write a file into /System folder on macOS Sonoma. I have tried to reboot in recovery mode. I have disabled SIP. But i can't write into /System. This folder is mounted as read only. How can i write into this folder ? I know there is a kind of checksum mechanism to check if something has been modified in /System folder and i want to see what happens if this checksum does not match. Thanks

Hello, I am working on a macOS Virtualization framework project on Xcode. Is there a way to redirect an USB device connected to the host mac, to a virtual machine. I know this is possible with lower layers but i would like to do it with a VZVirtualMachine object. Is it possible ? Thanks

Hello, It is possible to encrypt a mac's hard-drive with Filevault. All home user folders are encrypted with the same encryption key. (This is the same encryption key for the whole hard-drive). This encryption key is encrypted with user password. But i don't understand how it works when there are multiple user accounts. Maybe there is a table: The same encryption key is stored several times (one per user account) ? Is there a way for a user to read the filevault encryption key ? Thanks

Hello, I am trying to enumerate all ways on macOS for launching an application when a user opens a session. Please note i am not looking for a way which requires root or sudo privileges. I have found this: ~/Library/LaunchAgents/ Login Items (in macOS System Settings) But are there others ? Thanks

Hello, It is possible to restrict Documents folder access with TCC. But when an applications shows a standard "file open" dialog, it is possible to access this directory to open a file. macOS allows file access in this case because it is an intentional action from user. So i suppose there is a kind of whitelist for all files path opened through "file open" dialog. I would like to know how i can access this whitelist and how i can remove entries. Thanks

Hello, I have tried to create a VZVirtualMachine macOS virtual machine on an Apple Silicon Mac. I have installed Docker Desktop inside this virtual machine. Docker is not working: I get this error message: "Hyopervisor check failed". Is there a way to run Docker inside a VZVirtualMachine ? Thanks a lot

Hello, I am writing a Desktop application for macOS with XCode. This application will be available on app store. So, i have to put sandbox entitlement. So, this application won't be able to access Desktop folder. It will be jailed into a specific directory to store datas. I have installed a macOS application from appstore. When I launched this application, I got a TCC prompt, asking me to allow this application to access Desktop (or Downloads I don't remember). How can this be possible ? I have tried to write a sandboxed application which tries to access to Desktop folder. I didn't get any TCC prompt: My access was rejected. How can I ask to access Desktop folder from I sandboxed application ? Thanks a lot

Hello, I am trying to simulate a keystroke inside a macOS application. Here is what i've done: let src = CGEventSource(stateID: CGEventSourceStateID.hidSystemState) let cmd_down = CGEvent(keyboardEventSource: src, virtualKey: 0x38, keyDown: true) let cmd_up = CGEvent(keyboardEventSource: src, virtualKey: 0x38, keyDown: false) cmd_down?.post(tap: .cghidEventTap) cmd_up?.post(tap: .cghidEventTap) macOS is asking me to allow my application on TCC accessibility. This is a global privilege and needs admin rights. And i want to avoid that. Is there an alternative to simulate a key stroke inside my application ? Thanks

Hello, I've come across information regarding macOS endpoint protection software: It seems Apple no longer allows them to create kernel extensions. It seems that endpoint software should now function with MACF by implementing hooks from userland. Does this mean the Endpoint Security Framework will soon become deprecated? I'm currently searching for a sample source code for MACF hooks, but I haven't found anything in the Apple developer documentation. Thanks

Hello, I don't understand what is /System/Applications/ folder (macOS Sonoma). It is not an (hard)link to /Applications/. /Applications/ is not a (hard)link to /System/Applications/ Can anyone explain me what is /System/Applications/ ? Isn't it redundant to /Applications/ ? Thanks

I would like to develop a macOS application in Swift. This application will consist of 2 programs: a main program to be run by the user (standard account) and another one that will run with root privileges. The second program will only be invoked to perform privileged tasks. Running the main program under root permanently would be too risky. XPC will be used to trigger calls from the main program to the privileged program. How can I secure the privileged program to ensure that the calling program is indeed my main program and not another unauthorized program?

Hello, I am working with Virtualization framework in an Xcode swift project. I have also installed Parallels Desktop on my mac (Apple Silicon). I would like to convert a Parallels Desktop hard drive (hds file) to an image compatible with my Virtualization framework project. My goal is to run my Parallels Desktop virtual machine in my Xcode project. Is there a way to do that ? Thanks

Hello I have looked at Virtualization framework samples source code provided by Apple. There is something strange: For a linux guest OS, i can see a variable store: let variableStore = try VZEFIVariableStore(creatingVariableStoreAt: xxxx) ... let bootloader = VZEFIBootLoader() ... bootloader.variableStore = variableStore It seems this variable store is linked with NVRAM. For a macOS guest OS, there is no variable store. (The bootloader is created with VZMacOSBootLoader) My question is why macOS guest doesn't need variable store ? Thanks

Hello, I am downloading macOS restore image with VZMacOSRestoreImage, in order to deploy virtual machines. I have just upgraded my host mac to last Sonoma version. So, macOS restore image has just been downloaded on my computer during upgrade procedure. Is there a way to avoid a second download and ask VZMacOSRestoreImage to fetch my last local macOS image ? I think this image is still stored somewhere on my computer... Thanks