> The safest kernel is the one that cannot be touched at runtime. Can you expand...

Agingcoder · 2024-07-22T17:53:09 1721670789

Being allowed to talk to the kernel to get info and running with the same privileges ( basically being able to read / write any memory ) is different.

odo1242 · 2024-07-22T16:23:37 1721665417

Yeah, Apple doesn’t allow any user code to run in kernel mode without significant hoops (the kernel is code signed) and tries to provide a user space API (e.g. DriverKit) as an alternative for the missing functionality.

Some things (FUSE) are still annoying though.

duskwuff · 2024-07-23T06:16:11 1721715371

> Some things (FUSE) are still annoying though.

That should get much easier in macOS Sequoia with FSKit.

https://developer.apple.com/documentation/fskit/