Skip to content
macOS

How macOS Actually Works Under the Hood

From the XNU kernel's Mach/BSD hybrid design through launchd, System Integrity Protection, code signing, sandboxing, and XPC — the platform security model end to end.

9 posts, in order

  1. 1HistoryThe History of macOS: How a Failed Startup's OS Became Apple's FoundationHow Apple's 1996 acquisition of NeXT, and Steve Jobs' return, turned NeXTSTEP into the Unix foundation underneath every Mac sold today.
  2. 2Deep DiveInside XNU: How macOS Merges a Mach Microkernel with a BSD UserlandWhy macOS's kernel is neither a pure microkernel nor a pure monolithic kernel, and what that hybrid design actually buys in practice.
  3. 3Deep DiveThe macOS Boot Process: From Firmware to the Login WindowHow Apple Silicon's secure boot chain differs from Intel Macs, and the stages both go through to reach the login window.
  4. 4Deep DiveUnderstanding launchd: macOS's Init System and Service ManagerHow launchd unified boot-time initialization, service supervision, and scheduled tasks into a single declarative system on macOS.
  5. 5Deep DiveSystem Integrity Protection: What SIP Actually Locks Down on macOSWhat SIP protects, how it's enforced below the level of the root user, and the legitimate reasons to disable it temporarily.
  6. 6Deep DiveCode Signing, Notarization, and Gatekeeper on macOSHow macOS verifies that an application hasn't been tampered with and hasn't been flagged as malware, before it's ever allowed to launch.
  7. 7Deep DivemacOS App Sandboxing and Entitlements ExplainedHow the App Sandbox confines what an application can access by default, and how entitlements grant it specific, narrow exceptions.
  8. 8Deep DiveXPC Services: How macOS Processes Talk to Each Other SecurelyThe IPC framework behind most of macOS's privilege separation, built on Mach IPC but designed to make secure, sandboxed communication the easy default.
  9. 9FixDiagnosing a macOS Kernel Panic from Its Crash ReportYour Mac restarted with a 'restarted because of a problem' message — here's how to actually read the panic report instead of just hoping.