It is a separate OS with a separate security policy. On the plus side, this dual-booting mechanism is very cleverly designed to separately secure different OSes, so you do not need to downgrade security on your machine to install an unsigned OS like Linux. This elides the current need to have a completely wasted, 60+GB macOS install as a dummy to actually launch Linux (we could clean it up and resize it to get the space back, but it still makes for a very annoying install process that I'm hoping to avoid). I'm actually eagerly waiting for Apple to fix this in future system firmware releases, because my plan for installing Asahi Linux for end users with a minimal amount of fuss is to abuse the mechanism to adopt foreign macOS installations. The M1 launch was, when you look at details such as this, very obviously rushed. This process isn't implemented properly yet.Īs you might expect, this entire mechanism introduces a ton of corner cases around updates, boot selection, etc., and it is still very buggy and broken.

It involves importing user credentials into the local machine. You are booting from the internal SSD, with the root filesystem on the external disk.Īdditionally, the integration of the macOS user credentials with the SEP means that you can't 'just' take an install made on another machine and use it on a separate one. You aren't booting from an external disk. It then creates a local, signed boot policy that allows system firmware to boot this macOS install. The 'blessing' process done by the Startup Options screen involves copying the entire macOS Preboot partition - iBoot2 OS loader, Darwin kernel, auxiliary CPU/device firmwares, device tree, and some additional stuff - to the internal SSD. That boot picker that looks like the UEFI boot picker on Intel Macs? Yeah, that's a full-screen app on macOS made to look similar. M1 Macs use macOS as the moral equivalent of the UEFI setup menu.

When you boot into the 'Startup Options' menu, you are booting into a special macOS partition in the internal SSD.

All of this is by design, for security - UEFI is an enormous hairball of code, especially on Intel macs, and almost impossible to secure properly for that reason. It doesn't even have a keyboard driver, or any kind of GUI other than showing the Apple logo and 'Entering startup options' text, and some error screens. This is because the built-in firmware is extremely minimal, and does not contain drivers for anything but the internal SSD. In fact, they do not support external boot disks at all, by design. The M1 boot process is very different from Intel macs.

External ssd mac mini m1