macOS Security Internals: TCC, SIP, Gatekeeper, Notarization and XProtect — DedSec Project

Develop a platform-level view of macOS trust: code signing, system integrity, privacy permissions, execution policy, malware defenses, key storage and enterprise observability.

Learning objectives

By the end of this module you should be able to:

• Explain code signing and designated requirements and identify its most important trust boundary, state transition, and evidence source.
• Explain Gatekeeper and notarization and identify its most important trust boundary, state transition, and evidence source.
• Explain System Integrity Protection (SIP) and identify its most important trust boundary, state transition, and evidence source.
• Explain Transparency, Consent and Control (TCC) and identify its most important trust boundary, state transition, and evidence source.
• Explain sandboxing and entitlements and identify its most important trust boundary, state transition, and evidence source.
• Explain Keychain and Secure Enclave concepts and identify its most important trust boundary, state transition, and evidence source.

Deep concepts

1. code signing and designated requirements

macOS code signing binds executable content to a signing identity and requirements evaluated by the platform. Review the designated requirement and entitlement set rather than assuming that “signed” means trusted for every purpose.

2. Gatekeeper and notarization

Gatekeeper evaluates downloaded software using provenance, signing, quarantine context, and notarization-related policy. Notarization is an ecosystem trust signal, not proof that an application is vulnerability-free, so application authorization and runtime controls still matter.

3. System Integrity Protection

System Integrity Protection restricts modification of protected operating-system locations and some powerful runtime behaviors even for root. Security analysis should distinguish SIP-protected assets from ordinary root-controlled state and avoid treating administrator access as unlimited platform authority.

4. TCC privacy controls

Transparency, Consent, and Control governs access to privacy-sensitive resources such as camera, microphone, contacts, and protected data. TCC decisions depend on application identity, entitlement/context, user/admin policy, and can change across OS versions.

5. App Sandbox and entitlements

The App Sandbox combines a restricted process environment with entitlements that request additional capabilities. Review entitlements as authority declarations: broad file, network, automation, or device access increases the impact of an application compromise.

6. Keychain and Secure Enclave

Keychain items can be scoped by access-control policy, while Secure Enclave-backed keys can limit where private operations occur. Review accessibility class, authentication requirements, sharing groups, backup/sync behavior, and what happens when a device or account is recovered.

7. XProtect and platform remediation

Apple platform protections include malware detection and remediation components that evolve independently from application updates. Treat them as defense-in-depth and preserve OS/security-update evidence during triage rather than assuming their presence guarantees a clean host.

8. EndpointSecurity and unified logs

EndpointSecurity exposes structured security-relevant events to approved software, while unified logging provides broader diagnostic context. Good investigations correlate process identity, signing information, parentage, file/network activity, and time without relying on one sensor alone.

Authorized lab sequence

• Lab 1 — On a Mac you own, map permissions requested by a benign application and compare them with its functional needs.

• Lab 2 — Review Apple Platform Security documentation and build a trust-chain diagram from boot to application launch.

• Lab 3 — Create a defensive checklist for evaluating a signed/notarized application without bypassing platform protections.

Knowledge checks

Answer these without looking at the notes:

Next modules

Recommended related modules: 021, 044, 049, 054, 103, 119. From the main menu, choose Search lessons to find related sections across the full guide.