MacOS – How to Get Root Access in Mojave

I wrote the developer and received the following reply (I hope he doesn't mind me posting it here):

I would prefer not to have the limitation of disabling SIP to install Volta's kernel driver. But Apple has rejected my request to sign the driver (understandably) as it makes low level changes to the CPU Machine Specific Registers.

You can read about MSRs in Intels architecture documentation (Chapter 35): https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-software-developer-vol-3c-part-3-manual.pdf

Why is the kernel driver needed? In order to execute WRMSR and RDMSR instructions kernel level permissions are required.

It is possible to partially disable SIP by only allowing unsigned kernel drivers to be installed, but maintaining other SIP protections.

Unsigned drivers used to be allowed until recent macOS versions; as long as you are careful with what you install on your Mac you should be fine.

I replied asking if Apple also had veto power over kexts even if they were not distributed in the App Store. His reply:

Correct, regardless of distribution method.

https://developer.apple.com/library/archive/documentation/Security/Conceptual/System_Integrity_Protection_Guide/KernelExtensions/KernelExtensions.html

"You can request a Developer ID Certificate for signing kexts by visiting https://developer.apple.com/contact/kext and filling out the required details."

My request was rejected, I even referenced the 'Intel Power Gadget' in my request as it uses similar MSR instructions as Volta.

I don't think Apple likes the idea of users controlling their hardware. Especially when undervolting can cause stability issues.

Therefore, it looks like if you want to install a kext not blessed by Apple, you have no choice but to disable SIP. Looks like Apple, through some convoluted reasoning, thinks I'll be safer if, in order to run code they don't approve of, I also have to open a gaping hole in my computer's security in the process.

As documented in this post among some other places, MacOS Mojave implements additional security protocols that even affect root's access to user data.

The solution in the linked question provides the basic method I used to resolve my issue.

For custom-built scripts that will run through launchd, the administrator of the computer on which the script is to be run must add that script to Security & Privacy to give that "app" permission to access user data.

It was not necessary to add launchd or rsync (in my case) to Security & Privacy.

I have not researched if there is a way to do this via Terminal, which it seems would be necessary for those administering a large number of clients.

========

Update: I've also learned that if you add a script, and you later make changes to that script, you need to delete it from the Security & Privacy-->Full Disk Access, then add it again. Perhaps macOS creates a hash that is checked?

========

Update w/ Catalina: I do not recall if I had System Integrity Protection disabled on Mojave, but it appears to be required to be disabled in Catalina. I know SIP doesn't have to be disabled for OS versions prior to these.

Disabling macOS SIP allowed the script in question to start running again. This is not ideal, so I'll be researching other approaches.