usnistgov/macos_security
1
0
Fork 0
mirror of https://github.com/usnistgov/macos_security.git synced 2026-02-03 14:03:24 +00:00
Code Issues 21 Actions Packages Projects Releases Wiki Activity

Check for Apple Mobile File Integrity #307

New Issue
Closed
opened 2026-01-19 18:30:00 +00:00 by michael · 4 comments
michael commented 2026-01-19 18:30:00 +00:00
Owner
Copy Link

Originally created by @robertgendler on GitHub.

Apple Mobile File Integrity. AMFI is the macOS kernel module that enforces the code-signing validation.

https://eclecticlight.co/2018/12/29/amfi-checking-file-integrity-on-your-mac/

Check would be to check for the existence of "amfi_get_out_of_my_way=1" in the nvram boot-args

Originally created by @robertgendler on GitHub. Apple Mobile File Integrity. AMFI is the macOS kernel module that enforces the code-signing validation. https://eclecticlight.co/2018/12/29/amfi-checking-file-integrity-on-your-mac/ Check would be to check for the existence of "amfi_get_out_of_my_way=1" in the nvram boot-args
michael commented 2026-01-19 18:30:01 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

800-53 R5 SI-7(1), SI-3

@robertgendler commented on GitHub: 800-53 R5 SI-7(1), SI-3
michael commented 2026-01-19 18:30:01 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

Not really a useful check.

@robertgendler commented on GitHub: Not really a useful check.
michael commented 2026-01-19 18:30:01 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

This seems to require disabling SIP

@robertgendler commented on GitHub: This seems to require disabling SIP
michael commented 2026-01-19 18:30:01 +00:00
Author
Owner
Copy Link

@robertgendler commented on GitHub:

check: nvram -p | grep -c "amfi_get_out_of_my_way=1"
fix: nvram boot-args=""

@robertgendler commented on GitHub: check: `nvram -p | grep -c "amfi_get_out_of_my_way=1"` fix: `nvram boot-args=""`
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michael
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: usnistgov/macos_security#307
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?