Full security / reduced security?

Hi Stu-art,

Apple silicon Macs prohibit third-party kernel extensions by default, to provide better security. After reviewing the resource provided by MartinR, ACE isn't actually a kernel extension, but it needs similar privileges - thus resulting in similar restrictions.

On Macs with Apple silicon, Apple uses three levels for boot security (per installed OS):

• Full Security: This is the default (and safest) boot policy, with no security downgrades permitted. Your Mac ensures that only actively signed versions of macOS can be installed. (On iOS, this is used to prevent downgrades to previous versions.)

• Reduced Security: Any compatible macOS version can be installed, as long as it was previously signed by Apple. You can also permit the following:
  • Allow third-party kernel extensions to run (ACE needs this permission)
  • Allow MDM (for businesses) to manage kernel extensions and software updates

• Permissive Security: This is the most dangerous level and is hidden for safety reasons. Any compatible operating system can be installed, such as custom macOS builds or Asahi Linux. You can also permit the following:
  • Allow third-party kernel extensions to run
  • Allow MDM (for businesses) to manage kernel extensions and software updates
  • Customize or disable System Integrity Protection
  • Allow modified system snapshots
  • Disable Kernel Integrity Protection
  • Allow special boot modes (including Single User Mode)

If you choose to downgrade to Reduced Security and enable third-party kernel extensions, then the following will apply:

• You can use ACE and third-party kernel extensions, but you will need to first approve each one in Security and Privacy preferences, and then restart your Mac to apply the changes. Unapproved extensions can't load or run unless/until you approve them.
• Your Mac will still ensure that it's running a valid copy of macOS, but it doesn't have to be actively signed (endorsed) by Apple.
• All other security measures will be fully enforced as before.

If you later choose to return back to Full Security (or disable third-party kernel extensions), ACE and other third-party kernel extensions will be prohibited, and software relying on them could possibly break (as mentioned by HWTech). They will automatically reload if/when you downgrade to Reduced Security and allow third-party kernel extensions again.

At present, and as far as I know, all apps that are capable of recording Mac internal audio depend on a kernel extension or component that is subject to security options. Even Soundflower (which can enable almost any recording app to record internal audio) is a kext. App authors are having to work through this issue as macOS evolves.

That said, OS X/macOS has always been a relatively secure operating system and Apple has further tightened macOS security with each new release. In recent releases (Catalina/BigSur/Monterey) there have been significant changes in the security architecture that are evidenced in things like the Security Policy options you got when you tried to install ACE. I would not be bothered by the "Reduced Security ... with User Management of kernel extensions from identified developers." The Reduced Security is "similar to Medium Security behavior on an Intel-based Mac with a T2 chip" to quote from Apple's own documentation. And in the case of Rogue Amoeba, they have been a solid developer with a great track record with Mac apps.

For detailed info about Mac security, see Apple Platform Security. The page I linked speaks directly about Full Security vs. Reduced Security and the TOC takes you to much more detail.

Apple continues to evolve the design of macOS. One of the things that is happening is a change in the way system and kernel extensions are being managed. ACE is subject to this architectural/security change in macOS. I would trust Rogue Amoeba (I also use their products). To double-check, however, how about contacting Rogue Amoeba support and ask them about this.

BTW, I found this page about ACE that addresses your question -> Installing ACE on MacOS 11 (Big Sur) and MacOS 12 (Monterey).

That setting appears to allow any third party apps (that have a valid Apple developer's license) to have the same access as it is not restricted just to the one app you want. This setting basically reverts some of the latest macOS security options to what existed in older versions of macOS (while keeping some of the other new security settings?).

If the developer ever provides an updated version of their driver to work with the latest macOS security modes, then you can later toggle this setting off so you return macOS to the default security settings. However, with using this reduced security mode, you may find that you have inadvertently installed other third party drivers which will break once the more strict default security settings are re-enabled.

System and kernel extensions in macOS