Gatekeeper not working when booting from NVME

[Kr0n05K!ngR]

Hello all your lovely people!



First time poster here, with a problem that i am unsure if others have experienced, as i am not able to find anything regarding my specific problem online. Just dribs and drabs related to key words, but not what I am experiencing specifically.

I am unsure if i am doing something wrong? Or if i am missing something, but i have tried going though this with apple support opening a case, and they have been working on it for almost a month with no solution yet.



So i thought i would try my luck on a forum, and get a more of a public input on this, listing what i have tried, and the steps i have taken. 

Please read though what i have tried fully, before offering your input.
This issues relates to M2 mac mini pro.

Symptoms, gatekeeper does not work properly when running macOS Ventura 13.5.2 on an external NVME on over thunderbolt 4 / usb4 (both have been tried).
Start up security utility is set to reduced security and allow user management of kernel extensions for identified developers has been ticked.

The gatekeeper will not prompt and will not allow me to add applications I make, or others FOSS application such as veracrypt, keepassxc and other apps to have access to the kernel. A simple error is given for the app.
Note: I am running as administrator, and this has been confirmed int he startup and security utility, hence the reduced security settings and kernel extensions for identified developers being ticked.

What should happen:
On running on internal Mac ssd, with the same configuration (“reduced security” selected and “allow user management of kernel extensions for identified developers” ticked), everything works,
Gatekeeper prompts for me to allow the software to run which is expected, giving a window to asking that I open system preferences or cancel.

I select open system preferences and then select app store and identified developers > a button appears with “allow” which I select, and then the cache is rebuilt, stating “New system extensions require a restart before they can be used > I then click restart.

After reboot, all is working grate.

What I have tried on NVME to test and does not work:

1. Adding the app manually using the ‘spctl —add /applications/nameofapp.app’
2. Disabling spctl using ‘ sudo spctl —master-disable”
3. Disabling system integrity protection, using `csrutil disable.` This all fails.
4. Doing this all from a thunderbolt 3 intel certified external enclosure.

No matter what i try, i keep getting the same errors stating the app does not have kernel access, and I am at my wits end.

TLDR: gatekeeper does not work properly when running macOS on NVME on m2 Macs. This all works fine on 2018 Macs and lower..

If willing, you can try to reproduce, the simplest way is with two apps which produce the same results:
Thunderbolt 4 / usb4 NVME drive of any size, with macOS installed.
Brew installed
From brew installed veracrypt
From brew install keepassxc

Why am I using an external NVME drive?

Well as some of you may know, cache writes are a thing on most Operating systems, especially in macOS, depending on how much ram you have, these additional writes cause wear on the internal Mac SSD and when it fails, the whole Mac fails..

Now I am using my Mac mini m2 pro for AI related projects (I am learning AI) which I am programming, so the need to extend the life of my Mac is even more important, as there are allot of writes when working with AI, so it makes sense for everything to be working on an NVME,a s when the external SSD fails, I can easily replace this quickly and easily.

Why M2 mac?
The TOP performance is better then jetson nano, and its relativly cheaper then buying a bunch of GPUS and setting up. I am still learning, so i thought that a M2 mac pro would be usful in this endevour, and i can also do my reports and the like directly from the mac.


Any helpful input regarding this is welcome.

Thank you all in advance, and sorry for the wall of text!

 

[Fishrrman]

I wouldn't worry about it (really).

One of the very first things I do when setting up a new Mac is to TURN OFF gatekeeper with the following terminal command:
sudo spctl --master-disable

I DON'T want it running!

Hmmm...
I'm wondering if you can re-enable it by "reversing" the above command:
sudo spctl --master-enable
???

 

[Kr0n05K!ngR]

Hello Fishrrman,

Thank you for your response.

RE: sudo spctl --master-disable
Unfortunately, this was something that i already tried, as stated in my initial post under: "What I have tried on NVME to test and does not work"

The result i get when running the OS off of a thunderbolt 4 NVME ssd, is that nothing outside of the apple store apps will have kernel access. Meaning things like Veracrypt and other FOSS refuses to run.

What is interesting from your response, is that you mention that you disable it, may i know if your running an m2 mac and if this is on an external SSD?

If so, can you run 3rd party apps as known developers?

Please let me know, and thank you again for the response.

 

[HDFan]

these additional writes cause wear on the internal Mac SSD and when it fails, the whole Mac fails..

Pretty much an urban myth. Hundreds of posts of people worrying about the problem. Only 1 post I remember where it possibly may have happened. Just make sure you have enough memory.

 

[Kr0n05K!ngR]

Pretty much an urban myth. Hundreds of posts of people worrying about the problem. Only 1 post I remember where it possibly may have happened. Just make sure you have enough memory.

Hello HDFan,

Thank you very much for your response.

All replies are welcome, and even more so if they are providing input to the problem I am experiencing.

Regarding your response, please confirm how you found that an SSD wearing out is an "uber myth"?

SSDs wear out all the time, which is why companies offer warranties to a set number of years vs number or writes (TBW / total bytes written). Please see the below warranty information form a group of companies. Please also see white papers, peer reviewed journal article, etc, which also confirm the existence of TBW, and SSDs wearing out.

Ref:

Warranty statements from SSD manufacturers:

SSD Product Warranty | Support | Samsung Semiconductor Global

Samsung ensures the best quality in all products and services beyond customer expectations. Warranty policy, conditions for Internal and Portable SSD.

semiconductor.samsung.com

Crucial Warranty Information

Find out all relevant information about Crucial's range of warranties and how they protect you and your purchase, as well as information on returns.

uk.crucial.com

Western Digital Support | Western Digital

Find detailed answers to your support questions for your Western Digital, SanDisk, WD_BLACK, or WD storage product.

support-in.wd.com

Peer reviewed jurnal article:

Measurement and Analysis of SSD Reliability Data Based on Accelerated Endurance Test

In recent years, NAND Flash-based solid-state drives (SSDs) have become more widely used in data centers and consumer markets. Data centers generally choose to provide high-quality storage services by deploying a large number of SSDs, but there are no effective preventive measures to reduce the...

www.mdpi.com

White paper:

https://www.micron.com/-/media/client/global/documents/products/white-paper/5210_ssd_vs_hdd_endurance_white_paper.pdf

Apple forum discussions:

If Mac M1’s built-in SSD died - Apple Community

discussions.apple.com

M1 SSD Life span scaring issue - Apple Community

discussions.apple.com

Other media areticles:

How Long Will The SSD In Your Mac Last? - Created Tech

Have you ever wondered how long the SSD inside your Mac will last? It could be longer than you think - but it depends on the SSD and how you use it.

createdtech.com

I have experienced this many times with SSD drives I have owned over the last 10 or so years, its an industry standard / norm, and companies are working to extend this as much as possible, and as much as physics will allow.

Now unless apples SSDs have been manufactured in a special way, or are made from a special material that makes them 100% resistant to SSD write failure, than can you please clarify your statement?
How are apples SSDs special in this case? Please help me understand.

Please note: Ultimately I wish to limit the number of writes to the internal SSD so that I can protect my investment, which is the point of this posted here, to see if others who may have an m2 can test my set up, and offer their advice / provide feed back to their experiences using macOS on the M2, while booting to an external SSD.



Have you tried out the setup i mention?

Can you help me understand why gatekeeper is acting the way it is?

Any input is welcome, and i thank you again for your response.

Please note: I love all things apple, there is nothing out their which offers the level of protection for my data, and computing in such a stylish and functional way. This is why I wish to protect my investment, and why I am asking the above question.

 

[Fishrrman]

OP wrote:
"Please note: Ultimately I wish to limit the number of writes to the internal SSD"

Gatekeeper has NOTHING to do with this.

If you REALLY want to limit wear on the SSD, you need to DISABLE virtual memory disk swapping.

I have done this myself.

Here's what I used:
sudo launchctl unload -wF /System/Library/LaunchDaemons/com.apple.dynamic_pager.plist
(reboot necessary afterwards)

Next, remove the existing swap file with this command:
sudo rm /private/var/vm/swapfile*
(this worked for older versions of the OS, not sure if it's working with the newest)

To check if VM is actually turned off, use this command:
sysctl vm.swapusage

If VM is off, report should be:
vm.swapusage: total = 0.00M used = 0.00M free = 0.00M

 

[Kr0n05K!ngR]

Hi Fishrrman,

Thank you for your input!

I think i may not be communicating my issue effectively, so i will try again here.

I do not have kernel access in macOS when running off of an external drive, i wish to limit writes on the internal SSD, so to prolong the life of the device. So, running macOS fully off of an external thunderbolt 4 / usb4 NVME is the ultimate goal.

The problem is the lack of kernel access!

Gatekeeper has NOTHING to do with this.

In terms of me having kernel access on external drive, it seems to. As even when disabled, kernel access is refused.

If you REALLY want to limit wear on the SSD, you need to DISABLE virtual memory disk swapping.

I have done this myself.

Here's what I used:
sudo launchctl unload -wF /System/Library/LaunchDaemons/com.apple.dynamic_pager.plist
(reboot necessary afterwards)

Next, remove the existing swap file with this command:
sudo rm /private/var/vm/swapfile*
(this worked for older versions of the OS, not sure if it's working with the newest)

To check if VM is actually turned off, use this command:
sysctl vm.swapusage

If VM is off, report should be:
vm.swapusage: total = 0.00M used = 0.00M free = 0.00M

This is good stuff, and i will try this on the external drive once i get kernal access working. Limititing any wear on any SSD is helpful.

However, this does not help me get kernel access on the external drive, even after i have configured the mac to provide it.

What have i done?

1) Startup Security Utility > Reduced Security > Allow user management of kernel extensions from identified developers.

Result: kernel access is still refused and gatekeeper does not prompt with a window asking you to cancel or change settings in Privacy and Security.

2)Disable Gatekeeper fully, using command: sudo spctl --master-disable

Result: kernal access is still refused

3) Disable sip from Startup utility within terminal using command: csrutil disable

 

[Fishrrman]

It doesn't make sense to try to "protect" the internal SSD by booting and running from an external drive. Not with the fast SSDs that Apple is using now.

I was never a fan of "virtual memory" since Apple first introduced it, and have always disabled it whenever possible. That saves -some- drive wear.

I also was never a fan of spotlight "indexing", and so I disable spotlight as well.

That's enough for me. A few reasonable steps taken.
But I'm not going to obsess over it.

 

[HDFan]

Regarding your response, please confirm how you found that an SSD wearing out is an "uber myth"?

Of course SSDs wear out and fail. There are cheap ones with low TBW values and reliability and others with high TBW and reliability. My comment is limited to reports of failures on Apple products which use high quality SSDs. As I said I may have seen maybe 1 failure reported in MacRumors. In my case I have written ~500 TB of data on my boot drive and still have 98% SSD life left. I'm not saying that it can't happen. When flying I'm not going to worry about the minuscule chance that the plane would crash. There are a lot more important things that have higher odds of happening to worry about.