Appendix: Apple Silicon System Configuration

A node’s configuration parameters.

Overview

The darwin-init process implements a policy to limit which configuration it will apply in customer security mode. The policy summaries on this page are for reference and illustration; the authoritative policy is the one darwin-init implements.

Policy implementation

darwin-init implements configuration policy using Rego, a policy language from the Open Policy Agent (OPA) project. Rego enables darwin-init to express validation rules as declarative statements rather than procedural code.

When applying a configuration, darwin-init loads the policy bundle from /usr/share/misc/darwin-init_validator_bundle and evaluates the configuration against the rule set for the configured security mode. The node’s attestation covers these rules, because the bundle’s path is part of the immutable Signed System Volume.

Validation flow

When darwin-init receives a configuration, it follows this validation process:

Parses the JSON configuration into a Swift struct representation to be applied if validation succeeds.
Serializes the Swift struct back to JSON and passes it to the embedded OPA engine to evaluate the JSON against the policy loaded for the current security mode.
Parses the validation result from the OPA engine and logs any policy violations.

If validation fails, darwin-init rejects the entire configuration array and takes its failure action, rebooting the node or exiting. darwin-init initiates entry into Restricted Execution Mode (REM) only as its last step, after it applies every configuration, so a node whose configuration fails validation stays outside REM. Its attestation reports that state, and Node validation rejects the node. A rejected configuration still leaves a record in that attestation: darwin-init registers the merged secure-config parameters with secureconfigd before it validates, so their values are sealed into the Configuration Seal Register.

Validation fails if a configuration violates any of the following policies.

Top-level keys

For the top-level keys, darwin-init prohibits any configuration that is not in accordance with the policy described:

Top-Level Key	Policy
`ca-roots`	Allow Apple’s internal Certificate Authority to be trusted.
`cryptex`	Allow cryptexes to be installed.
`firewall`	Allow firewall rules to be installed at boot.
`preferences`	Setting CFPrefs is allowed only for the application IDs listed below.
`result`	`failureAction` must be set to reboot or exit.
`log`: `system-log-privacy-level`	Private logs must be redacted by setting `system-log-privacy-level` to `"Public"`.
`log`: `system-logging-enabled`	Logging to disk and snapshots must be disabled by setting `system-logging-enabled` to `false`.
`narrative-identities`	Allow any setting.
`logtext`	Allow any setting.
`computer-name`, `host-name`, `local-host-name`	Allow configuring hostname.
`perfdata`	Allow emitting boot performance data.
`issue-dcrt`	Allow any setting.
`ssh`	Enabling ssh daemon not permitted. Must be unset or `false`.
`ssh_pwauth`	Enabling ssh password authentication not permitted. Must be unset or `false`.
`reboot`	System reboot after setup not permitted. Must be unset or `false`.
`userspace-reboot`	Opting out of userspace-reboot into rem not permitted. Must be `"rem"` or unset.
`diagnostics-submission-enabled`	Enabling diagnostic log submission not permitted. Must be unset or `false`.
`lock-cryptexes`	Disabling cryptex lockdown not permitted. Must be `true` or unset.
`cryptex-download-bandwidth-limit`	Allow configuring bandwidth used for cryptex downloads.
`secure-config`	See table below for policy.
`usage-label`	Allow any setting.
`retain-previously-cached-cryptexes-unsafely`	Retaining cryptexes from previous boot session configs not permitted. Must be unset or `false`.
`apply-timeout`	Allow any setting.
`user`	Creating and configuring users not permitted.
`network`	Applying custom network configuration not permitted.
`pre-init-cmds`	Executing pre-init scripts not permitted. Must be unset.
`install: root`	Installing roots with `darwinup` not permitted. Must be unset.
`diavlo`	Diavlo server configuration not permitted. Must be unset.
`package`	Installing packages not permitted. Must be unset.
`tailspin`	Applying custom tailspin configuration not permitted. Must be unset.
`volumes`	Declaring Softwarefoundations for persistent per-workload storage is permitted.
`cryptex-cache-max-total-size`	Setting maximum storage space for cryptex cache not permitted. Must be unset.

Secure config keys

The customer policy enforces the following restrictions on secure-config keys:

Key	Required Value	Purpose
`com.apple.logging.crashRedactionEnabled`	`true`	Redacts unique information from crash reports generated on the node.
`com.apple.logging.logFilteringEnforced`	`true`	Enforces aggressive filtering of the unified logging store (see `os_log(3)`).
`com.apple.logging.metricsFilteringEnforced`	`true`	Enables only a limited subset of metrics from the node.
`com.apple.logging.policyPath`	`/private/var/PrivateCloudSupport/opt/audit-lists/customer/`	File-system path to the log policy directory.
`com.apple.pcc.research.disableAppleInfrastrucutureEnforcement`	Unset or `false` on hardware, any value in VRE	Relaxes validation of PCC infrastructure external to the node, for example certificates of the PCC Gateway.
`com.apple.tie.allowNonProdExceptionOptions`	Unset or `false`	Relaxes validation of external inputs in TIE, for example prompt template enforcement.
`com.apple.tie.internalRequestOptionsAllowed`	Unset or `false`	Relaxes validation of internal request options in TIE.
`com.apple.libcryptex.appIdentifiers`	Valid format if set	Specifies allowed cryptex app identifiers. Values must be non-empty strings consisting of alphanumeric characters, periods, and hyphens.
`com.apple.CloudAttestation.routingHint`	Any value	Indicates the workload class this node serves. Clients pass the matching hint as routing metadata to reach a node of that class rather than a specific node. Included in attestation.
`com.apple.CloudAttestation.ensembleMembers`	Any value	Indicates other members of the ensemble. Included in attestation.
`com.apple.cloudboard.isProxy`	`false`	Enforces that non-proxy PCC nodes cannot make requests to other PCC nodes.

The customerProxy policy enforces the same policies as the customer policy, with the following exception:

Key	Required Value	Purpose
`com.apple.cloudboard.isProxy`	`true`	Allows a PCC proxy node to transitively attest and trust other PCC nodes. Enforces the use of dedicated proxy node attestations to establish Transitivetrust.

CFPrefs domains

The customer and customerProxy policies allow setting preferences in the following CFPrefs domains:

Domain	Purpose
com.apple.acdc.cloudmetricsd	Configures the `cloudmetricsd` daemon for metrics submission over the Otlp.
com.apple.acsi.cloudusagetrackingd	Specifies a project identifier associated with the node for inclusion in `cloudmetrics` reporting.
com.apple.cloudos	Provides general cloud extensions configuration.
com.apple.cloudos.AppleComputeEnsembler	Defines ensemble properties, such as hostname and identifier for each node.
com.apple.cloudos.cb_attestationd	Configures the `cb_attestationd` daemon, for example, retry and backoff behavior for attestation generation.
com.apple.cloudos.cloudconfigurationd	Configures the `cloudconfigurationd` daemon, for example, the configuration endpoint for the Runtimeconfigassets.
com.apple.cloudos.cb_jobauthd	Configures the `cb_jobauthd` daemon, for example, the endpoint used to retrieve the TGT signing key.
com.apple.cloudos.cb_jobhelper	Configures the `cb_jobhelper` instances, for example, TGT validation enforcement.
com.apple.cloudos.cloudOSInfo	Configures the CloudOSInfo framework used to obtain node OS version and release specifications.
com.apple.cloudos.cloudboardd	Configures the `cloudboardd` daemon, the central request coordinator, for example, health service and RemoteServiceDiscovery endpoints.
com.apple.cloudos.CloudBoardNullApp	Configures the `NullCloudApp` flow for validating that the Private Cloud Compute service is running.
com.apple.cloudos.NullCloudController	Configures the `NullCloudApp` controller to inform `cloudboardd` about the current Private Cloud Compute workload.
com.apple.cloudos.hotproperties.cb_attestationd	Configures `cb_attestationd` hot properties, for example, releases to exclude from the trusted release set in proxy node attestations.
com.apple.cloudos.hotproperties.cb_jobhelper	Configures `cb_jobhelper` hot properties, for example, request message size limit to prevent jetsam during an attack.
com.apple.cloudos.hotproperties.cloudboardd	Configures `cloudboardd` daemon hot properties, for example, timeout for idle connections to users’ devices.
com.apple.cloudos.hotproperties.splunkloggingd	Configures `splunkloggingd` hot properties, for example, predicate overrides for filtering logs to exfiltrate to Splunk.
com.apple.cloudos.hotproperties.test	Configures tests for the hot properties service.
com.apple.cloudos.hotproperties.tie	Configures `TIE Inference Engine` hot properties, for example, deny lists to apply to incoming request prompts.
com.apple.prcos.splunkloggingd	Configures the `splunkloggingd` daemon, for example, predicates for filtering logs to exfiltrate to Splunk.
com.apple.privateCloudCompute	Specifications for the `CloudAttestation` framework, for example, environment in which the node is running.
com.apple.thimble.inference.tie-controllerd	Configures `tie-controllerd`. Only `RoutingLayerFormat` and `RoutingGroupAliases` keys are permitted.