When I install a second instance of MacOS (say I am experimenting with a beta or something), I just create a new APFS partition and install MacOS in that partition.
The MacBook bootloader seems to know there is another OS on that partition and displays the options to boot from it.
When installing Asahi Linux, I run a script that partitions my drive, but I also have to place the MacBook into "permissive" security mode via recovery to complete the installation.
What is permissive mode?
Why must the MBP be placed into permissive mode?
Does this put your MBP at significant risk and how would you sell this to a company's security team?
Best Answer
This is a misconception. You are not placing the MacBook into "permissive" security mode. You are placing the Asahi Linux install into permissive mode.
Apple Silicon Macs implement a unique secure boot mechanism that is unlike other personal computing devices. Typically devices are either wide open, locked down to manufacturer-approved software only, or can be toggled between those states through some (sometimes more, sometimes less secure) mechanism. Apple Silicon machines instead implement the security mode separately for each installed OS as part of a framework called Boot Policy, and this is what the available security modes mean:
Due to the way the mechanism is designed, new OSes must first be installed in Full security (from macOS) or Reduced security (from an existing recoveryOS) mode before being downgraded to Permissive security later. This must be done from a strictly controlled recoveryOS instance, and there are many requirements:
At that point, security of that specific OS can be downgraded, and the actual custom OS bootloader can be installed. This process locally signs the new OS bootloader with a cryptographic signature, so replacing it can only be done by following this process again. This gives you the ability to have a fully user-controlled, securely booted, third-party OS. Of course, such third party OSes need to implement a full secure boot chain for this to be as secure as macOS (Asahi Linux does not yet, but it's been planned from day one and will at some point).
The Asahi Linux install process is, essentially, this:
At that point you reboot and you're in the new OS.
So how does this affect the security of other OSes on the machine? It doesn't. Your existing macOS install remains at Full Security, with all the privileges that entails (like being able to run iOS apps and watch DRM-protected content). The OS image itself is still signed by Apple and verified at runtime, and cannot be compromised from Linux. User data can be if you have not enabled FileVault (though in practice we don't have support for APFS with transparent encryption anyway, so an attacker would have to develop that first!). If you have, then the most the third-party OS can do is just destroy/corrupt your data, not extract or compromise it.
Enabling FileVault also has one additional benefit in that it forces recoveryOS to prompt you for credentials upfront, which means you cannot use that environment to break into your machine or bypass password login requirements.
So, these machines are designed so you can do this without compromising the security of your main OS. Whether you can successfully sell that to your company's security team, that's a different question :-)
You can find a more detailed description of the Apple Silicon security architecture on the Introduction to Apple Silicon page on the Asahi Linux wiki.