Macos Amfi Security

macOS AMFI Security Reference

A comprehensive reference for AppleMobileFileIntegrity (AMFI) security mechanisms on macOS.

Quick Reference

What is AMFI?

AppleMobileFileIntegrity is a kernel extension that enforces code signature verification on macOS. It provides:

• Code signature verification logic for XNU kernel
• Entitlement checking for sensitive operations
• Debugging and task port access control
• Library validation enforcement

Key Components

AMFI Boot Arguments

These boot arguments can debilitate or disable AMFI enforcement:

Usage

# Add to boot arguments (requires SIP disabled)
# In recovery mode or via NVRAM
nvram boot-args="amfi_get_out_of_my_way"

MACF Policies

AMFI registers these MACF (Mandatory Access Control Framework) policies:

Credential Label Policies

File System Policies

Process Policies

Exception/Debugging Policies

System Policies

amfid Daemon

Communication

• Port: HOST_AMFID_PORT (special port 18)
• Protocol: Mach messages via MIG (Mach Interface Generator)
• Protection: SIP prevents root from hijacking special ports; only launchd can access

Debugging amfid

# Set breakpoint in mach_msg to intercept AMFI checks
lldb -p $(pgrep amfid)
(lldb) breakpoint set --name mach_msg
(lldb) process continue

Key Functions

The main functions are reversed and documented in OS Internals Volume III.

Provisioning Profiles

Overview

Provisioning profiles sign code and grant entitlements:

File Extensions

• .mobileprovision
• .provisionprofile

Location

/var/MobileDeviceProvisioningProfiles/

Parsing Profiles

# Using openssl
openssl asn1parse -inform der -in /path/to/profile

# Using security tool (preferred)
security cms -D -i /path/to/profile

Profile Contents

Important Notes

• Entitlements are restricted to prevent Apple private entitlements
• Profiles expire and must be renewed
• Enterprise profiles can provision all devices

AMFI Trust Caches

What is the Trust Cache?

A list of known hashes signed ad-hoc, stored in the kext's __TEXT.__const section.

Usage

• Used for fast signature verification
• Can be extended with external files for sensitive operations
• Maintained by iOS AMFI (similar on macOS)

AMFI Dependencies

Check AMFI's kernel extension dependencies:

# Method 1: kextstat
kextstat | grep " 19 " | cut -c2-5,50- | cut -d '(' -f1

# Method 2: kmutil (modern)
/usr/bin/kmutil showloaded

Common Dependencies

Security Considerations

Jailbreak Exploits

Historically abused trust relationships:

1. amfid communication: Trust between kext and user-space daemon
2. libmis.dylib: Backdoored versions allowed everything
3. Special port hijacking: No longer possible on macOS (SIP protected)

Prevention

• Keep SIP enabled (csrutil status)
• Monitor boot arguments
• Verify provisioning profiles
• Check code signatures regularly

References

• OS Internals Volume III - https://newosxbook.com/home.html
• Apple Security Guide - Official documentation
• XNU Source Code - amfi implementation details

Common Tasks

Check AMFI Status

# Check if AMFI is loaded
kextstat | grep AppleMobileFileIntegrity

# Check SIP status
csrutil status

# Check boot arguments
nvram boot-args

Inspect Code Signatures

# Check binary signature
codesign -dv /path/to/binary

# Verify signature
codesign -v /path/to/binary

List Entitlements

# From binary
plutil -p /path/to/binary/Contents/Info.plist | grep -A 100 NSAppleEventsUsageDescription

# From provisioning profile
security cms -D -i profile.mobileprovision | plutil -p - | grep -A 100 Entitlements

Debug AMFI Behavior

# Monitor amfid
sudo lldb -p $(pgrep amfid)

# Check library validation
log show --predicate 'process == "amfid"' --last 1h

When to Use This Skill

Use this skill when you need to:

• Understand macOS code signing enforcement
• Research AMFI boot arguments for security testing
• Analyze MACF policies and their effects
• Debug amfid daemon behavior
• Parse or create provisioning profiles
• Investigate macOS privilege escalation vectors
• Study kernel extension dependencies
• Understand trust cache mechanisms

This skill provides authoritative reference information for macOS security research and analysis.