Αρχιτεκτονική και μηχανισμοί ασφάλειας του macOS

Σγουρός, Σταμάτιος

Architecture and Security Mechanisms of macOs

Bachelor Dissertation

Author

Σγουρός, Σταμάτιος

Date

2026

Abstract

This thesis presents a rigorous and theoretically grounded analysis of the security architecture of macOS, treating it as a coherent, multi-layered protection system. The study is founded on core principles of information system security, including the confidentiality– integrity–availability (CIA) triad, the Authentication–Authorization–Accountability (AAA) model, modern access control paradigms, and the Defense-in-Depth strategy. From an architectural perspective, the analysis focuses on the Darwin foundation and the hybrid XNU kernel, emphasizing virtual memory management, process isolation, and privilege separation as fundamental enforcement mechanisms. Data confidentiality is examined through the interaction of APFS, FileVault encryption, Data Protection classes, and the Secure Enclave, highlighting the critical role of hierarchical key management and hardware-assisted security. In parallel, the application security model is evaluated through the trust chain established by code signing, Gatekeeper, notarization, sandboxing, and the Hardened Runtime. Furthermore, system integrity mechanisms are analyzed, including System Integrity Protection (SIP), the signed system volume, and the secure boot chain, along with the Transparency, Consent and Control (TCC) framework governing access to sensitive user resources. A comparative assessment with other contemporary operating systems demonstrates that the vertically integrated design of macOS enables a high degree of security cohesion and enforcement consistency. In conclusion, macOS emerges as a representative case of modern operating system security architecture, where tight hardware–software integration and layered policy enforcement significantly enhance system resilience, while still being subject to inherent limitations associated with evolving threat models and system complexity. Keywords: macOS, operating system security, confidentiality, integrity, Defense-in-Depth, sandboxing, FileVault, Secure Enclave

Department

Σχολή Τεχνολογιών Πληροφορικής και Επικοινωνιών. Τμήμα Πληροφορικής

Number of pages

Language

Greek

URI

https://dione.lib.unipi.gr/xmlui/handle/unipi/19632

Collections

Τμήμα Πληροφορικής

Show full item record

Except where otherwise noted, this item's license is described as
Αναφορά Δημιουργού-Μη Εμπορική Χρήση-Όχι Παράγωγα Έργα 3.0 Ελλάδα