Startup Security Policy settings are not reflected in booted OS Privacy & Security panel options.

2023 M2 Pro Mac Mini with Sonoma 14.0 (23A344)


Booting off external TB4 connected PCI NVMe SSD


I booted into Recovery Mode and in the Startup Security Utility, I selected "Reduced Security" and under that, "Allow user management of kernel extensions from identified developers."


I also went into the terminal in Recovery Mode and issued the csrutil disable command to disable SIP.


I have two boot drives, but I have booted of each of these and made sure both had the same settings, and when disabling SIP, I made sure it was showing disabled on both boot drives.


Booting into the OS, and I try to install my kernel extensions, and I get the "System Extension Blocked" message telling me that I can't proceed, but not the "System Extension Update" message giving me an option to go into the System Settings and click the "Allow" button next to the "System software from developer "xxxx" has been updated." message below the "Allow applications downloaded from" control box and above the "Allow accessories to connect" control box.


In fact, my Mac Mini doesn't show the "Allow accessories to connect" control menu at all.


I have an M2 MacBook Air here, and it all works exactly as I expect it to, and I am able to manage kernel extensions fine.


I have tried creating a new profile - same result.

I have tried reinstalling Sonoma - same result.


I have a sneaking suspicion that it may have something to do with the T3 security chip and the fact that I'm booting off an external HDD, but I don't know for sure. I'm fairly certain that if I boot off the internal HDD it will be ok, but I haven't tried that just yet. I'll come back with an edit once I have done that.


If anyone has any ideas, I'd really appreciate your help.


Many thanks,


em


Mac mini, macOS 14.0

Posted on Oct 13, 2023 7:17 PM

Reply
27 replies

Oct 31, 2023 11:36 PM in response to Barney-15E

Hi Barney-15E.

The thing is, they actually ask you to specify which boot drive you want to set the Startup Security Settings on before you can make changes, and then if you've not booted from the drive you've selected, it tells you to boot from that drive so that you can make changes to those settings. Why would they take all that effort to force you to choose your boot drive so that you can make changes to those settings, only to then not have those settings actually take effect on the boot drive you've just selected? Seems like a bug to me, or like there are two teams at work here, and one isn't talking to the other.


If there was some reason that giving a user management of kernel extensions when booting off a non-internal non-Apple disk was not to be permitted, then they'd simply exclude the option for making the changes to allow it in Recovery Mode, but they don't. In fact, they implicitly state that by making these changes to these settings, you are giving the user permissions to manage these kernel extensions when booting off that external drive, it just doesn't work.

Nov 1, 2023 5:49 AM in response to Barney-15E

I think you may be right.


"Oh, you have more than 2 years' worth of photos? You need to buy a new Mac with a larger hard drive! Easy!"


Non-vanilla systems are a thorn in the side of any computer company trying to optimise profits, though. It's not hard to imagine this to be the case with Apple as well.


Gouging on disk storage pricing, not allowing you to upgrade your internal storage, but then also make life difficult for anyone who's storage requirements outgrow the capacity, it's a triple whammy of insensitivity and tone-deafness of a company who was basically propped up by the creative industries during their hardest times. It's hard not to be a little bitter about it, but I'm trying! :-)


Nov 1, 2023 10:15 AM in response to ileradeltercomondo

ileradeltercomondo wrote:

I think you may be right.

"Oh, you have more than 2 years' worth of photos? You need to buy a new Mac with a larger hard drive! Easy!"

I store my Photos Library on an external drive. it’s in the settings. Easy!

I store my movies and music there, too.

Non-vanilla systems are a thorn in the side of any computer company trying to optimise profits, though.

That’s what all companies exist to do.

It's not hard to imagine this to be the case with Apple as well.

I sure hope so. Otherwise they’d go out of business.


Nov 1, 2023 3:40 PM in response to Barney-15E

Barney-15E wrote:


ileradeltercomondo wrote:

I think you may be right.

"Oh, you have more than 2 years' worth of photos? You need to buy a new Mac with a larger hard drive! Easy!"

I store my Photos Library on an external drive. it’s in the settings. Easy!
I store my movies and music there, too.

I was being facetious. I've been using Apple's computers almost exclusively since 1985. I am well aware of this, but thank-you for telling me this anyway, I think.


Are you actually able to help me with this problem? Do you maybe know someone else who can? If not, then thank-you for your insights, and I wish you all the best.

Nov 1, 2023 4:35 PM in response to ileradeltercomondo

I don't now anyone who uses a Mac. I don't know of any of the longtime users here that have mentioned using an external drive to startup their Macs. Most of the posts here discussing trying to boot from an external on Apple Silicon seem to all be complaints about how horrible the experience is. I can't remember seeing anyone coming back and stating it works well.

I have seen a post where the thunderbolt NVMe drive showed up as an internal drive and may provide the solution you seek. If yours isn't doing that, then it might have just been a weird configuration or didn't really show up that way.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Startup Security Policy settings are not reflected in booted OS Privacy & Security panel options.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.