你应该知道的macOS术语和趋势
https://www.huntress.com/blog/macos-terms-and-trends-you-should-know-about
`
为了帮助你理解这一切，我们希望下面的列表能为你提供你应该知道的macOS常用术语和缩略词的一站式服务。
To help you make sense of it all, we hope the following list provides you with a one-stop shop of common macOS terms and acronyms you should know about.
* App Sandbox: provides protection to system resources and user data by limiting your app’s access to resources requested through entitlements. If you desire to have your application distributed through the Mac App Store, you’ll need to enable this feature.
* Application bundle: a common way you package applications for installation/distribution. The extension of this file type is usually .app.
* Bundle ID: a resource that represents the app’s unique identifier that you can register, modify, and delete. Naming convention generally follows com.companyName.applicationName.
* Codesigning: applying a developer’s developer/team ID (see below) to an application, so people know who the owner is and not a spoofed/faked copy. Also leveraged by Gatekeeper/File Quarantine/Notarization to look for and detect malicious content.
* Daemon: a process that runs in the background, typically with “root” (i.e., administrator) privileges. The Huntress Agent would be an example of a daemon.
* Developer ID (aka Team ID): a ten-character alphanumeric string that is associated with an application (and is assigned by Apple). It’s how you claim an application as your own.
* Entitlement: a privilege that grants a program a specific capability on a Mac, such as accessing a user’s Documents directory or (in some cases) installing system extensions. The latter is an example of a restricted entitlement, which requires users to distribute a provisioning profile with our app specifying the entitlements it has been granted.
* ES (often called ESF): Endpoint Security (Framework): a low-level C API provided by Apple designed for monitoring system events for potentially malicious activity.
* File Quarantine: file quarantine is part of built-in macOS security. It assigns an extended attribute to newly downloaded files. It then moves them to a temporary folder, where it then prompts the end user if they trust the file or not.
* FileVault: Provides full-disk encryption for a user’s data. Ensures that the user’s data is securely protected from unauthorized access in case their Mac is lost or stolen, adding an extra layer of security to their files and information.
* Finder: similar to Windows Explorer start menu. It is an easy way to search through files, launch applications, and other basics. Similar to how the macOS Launchpad/Dock is equal to the Windows Start Menu.
* Full Disk Access (FDA): to access features such as directories with user (or sensitive) data, library directories, etc, without having to explicitly approve each directory. This is part of Transparency, Consent, and Control (TCC).
* Gatekeeper: a security feature in macOS that controls and verifies the authenticity of applications before they are allowed to run, preventing the execution of unauthorized software.
* Hardened Runtime: a macOS security feature that restricts and monitors an application’s behavior. It enforces runtime protections, including code signing and runtime code integrity checks, and prevents code injection, DLL hijacking, and memory tampering.
* Keychain: a macOS app that stores your passwords and account information, and reduces the number of passwords you have to remember and manage. Stored in the secure enclave.
* LaunchAgent: a persistence item that will execute a binary once a user session has started
* LaunchDaemon: a persistence item that will execute a binary once the system starts (does not require an interactive user session)
* M1/M2: series of ARM-based systems-on-a-chip designed by Apple Inc. as a central processing unit and graphics processing unit for its Mac desktops and notebooks, and the iPad Pro and iPad Air tablets
* Mobile Device Management (MDM): enables administrators to remotely configure settings, enforce security policies, distribute apps, and secure device usage within the organization. Apple is moving heavily toward this model of security by declarative configuration. Examples of MDMs are Addigy, Intune, Jamf, or Kandji.
* Notarization: similar to codesigning, it is a security mechanism provided by Apple that involves submitting your application to Apple to be reviewed (they’re looking for malware)
* pkg: the file type of an installer. Generally contains a pre-install and/or post-install script
* Plist: a structured file format that typically contains settings, preferences, or metadata for applications. This is the file structure for LaunchItems (LaunchAgents, LaunchDaemons).
* PPPC Payload: PPPC stands for ‘Privacy Preferences Policy Control’. When using an MDM, administrators can deploy a PPPC payload (or policy). This can specify TCC permissions for applications without requiring explicit approval from the end user. An example would be giving the HuntressAgent full disk access. This is only available when using an MDM to deploy.
* Provisioning Profile: a sort of manifest distributed with third-party apps, describing, among other things, which entitlements the app requires and where it is allowed to run (for example, only on select development/testing machines, or anywhere). macOS apps do not typically require provisioning profiles, but there can be a need to include one if you are making use of restricted entitlements (see entitlement).
* Secure Enclave: a secure separate co-processor found in some Macs and iOS devices that handles sensitive operations like biometric data (Touch/Face ID) and encryption keys.
* System Integrity Protection (SIP): a system of security features that prevent modification of system files.
* System Extension: similar to the OSR driver on Windows. It’s the way you can communicate with the low levels of the operating system.
* TCC: Transparency, Consent, & Control (database on disk). This is a common location to begin troubleshooting after installation or application functionality issues.
* Unified Logging: provides a comprehensive and performant API to capture telemetry across all levels of the system
* XPC: an Apple-specific protocol for communicating between low levels of the operating system. It allows for bidirectional communication between processes.
`