Signed System Volume (SSV)

The Signed System Volume (SSV) is a protection introduced in macOS Big Sur. The operating system lives on a dedicated, read-only APFS system volume, and every file on it is covered by a tree of cryptographic hashes. The root of that tree, called the seal, is signed by Apple. At startup, the Mac boots from a snapshot of that sealed volume, and data is checked against the hashes as it is read.

If any part of the system content has been modified, verification fails and the Mac will not use the altered data. This makes persistent tampering with operating system files far harder than on earlier macOS versions, even for an attacker with root access. It also makes it easy to know that the OS in use exactly matches what Apple shipped.

SSV works together with System Integrity Protection and the secure boot chain. Admins can check it with csrutil authenticated-root status. Disabling it is only possible from recoveryOS with reduced boot security and is not appropriate for production Macs.

See the System Integrity Protection guide for verification steps.