search

dortania / bugtracker

Dortania Bugtracker
108 stars 7 forks source link

I's not recommended to enable CSR_ALLOW_APPLE_INTERNAL by setting csr-active-config #157

Closed fjh1997 closed 3 years ago

fjh1997 commented 3 years ago

In this guide about disabling-sip：https://dortania.github.io/OpenCore-Install-Guide/troubleshooting/extended/post-issues.html#disabling-sip

Common values are as follows (bytes are pre-hex swapped for you,......

  • FF030000 - Disable all flags in macOS High Sierra (0x3ff).
  • FF070000 - Disable all flags in macOS Mojave (opens new window)and in macOS Catalina (0x7ff) as Apple introduced a value for executable policy.
  • FF0F0000 - Disable all flags in macOS Big Sur (0xfff) which has another new flag for authenticated root .

Actually ,disabling SIP works by enabling flags,instead of disabling flags.These "common" values actually enable all of the flags.And CSR_ALLOW_APPLE_INTERNAL flag (0x10)would cause a problem about cheking updates（Some updates couldn't be pushed）as mentioned [here].(https://www.reddit.com/r/hackintosh/comments/kf8e1g/weird_software_update_extra_menu/) The "common values" before might misleading some novices and cause their auto-update didn't work. So,I think the really common vaues would be as these:

  • EF030000 - Enable all flags except CSR_ALLOW_APPLE_INTERNAL(0x10) in macOS High Sierra(0x3ef).
  • EF070000 - Enable all flags except CSR_ALLOW_APPLE_INTERNAL(0x10) and in macOS Catalina (0x7ff) as Apple introduced a value for executable policy.
  • EF0F0000 - Enable all flags except CSR_ALLOW_APPLE_INTERNAL(0x10) in macOS Big Sur (0xfef) which has another new flag for authenticated root

and a note is also needed:

note that CSR_ALLOW_APPLE_INTERNAL flag (0x10)would cause a problem about cheking updates

khronokernel commented 3 years ago

I think what would be best:

Additionally, we can also comment on how SecureBootModel with a patched installation can result in an infinite RecoveryOS loop until the signature is fixed.

Will add these shortly

fjh1997 commented 3 years ago

I think what would be best:

  • Do not recommend disabling SIP for proper OS functionality in macOS 11+

    • As disabling BaseSystem verification has been known to break updates as well

Additionally, we can also comment on how SecureBootModel with a patched installation can result in an infinite RecoveryOS loop until the signature is fixed.

Will add these shortly

Thanks a lot.

And,AFAIK, disabling BaseSystem verification also breaks updates in macOS 10+.

Yeah, It's truly not recommended to disable SIP.But for advanced usage or troubleshooting,the reader should best know how each flag works and what might casue the problem if they have the updating issue.

Clarifing what problems each flag may causes would really help a lot.