How to Use the bputil Command on Apple Silicon Macs in Recovery Mode to Manage Boot Policies and Security Modes

With the transition from Intel processors to Apple Silicon (M1, M2, M3, and M4 chips), Apple fundamentally re-architected the macOS boot security model. On older Intel Macs, firmware security was managed primarily through NVRAM variables and the T2 Security Chip utility. On Apple Silicon, security architecture is enforced directly by the hardware Secure Enclave processor through cryptographic manifests known as Local Boot Policies (LocalPolicy).

While the graphical Startup Security Utility allows users to toggle between Full Security and Reduced Security, system administrators, security engineers, and developers requiring fine-grained control over boot manifests, third-party kernel extensions (KEXTs), and alternate operating systems must use the native terminal utility: bputil.

Located in /usr/sbin/bputil, this tool is available strictly within recoveryOS. This guide explains how to boot into recovery, execute bputil, interpret LocalPolicy manifests, and safely configure custom boot states.

Understanding Apple Silicon Boot Security States

Apple Silicon separates the operating system into distinct security states stored within the internal NVMe storage drive’s System Container:

• Full Security: The default and most secure mode. The Mac behaves like an iOS device: it enforces the Secure Boot chain, verifies cryptographic signatures against Apple’s signing servers, rejects third-party kernel extensions, and blocks unsigned kernel debugging.
• Reduced Security: Relaxes specific cryptographic constraints to allow system extensions or legacy kernel extensions (KEXTs) from identified developers. The operating system still requires cryptographically signed software from authorised developers, but allows user-consented extensions.
• Permissive Security: Disables signature enforcement entirely, allowing custom kernels (such as Asahi Linux or research kernels) and arbitrary Mach-O execution.

Accessing recoveryOS on Apple Silicon Macs

Because Local Boot Policies guard system integrity, bputil cannot modify active boot manifests while booted into normal macOS. You must boot into recoveryOS:

1. Shut down your Mac completely.
2. Press and hold the physical Power button (or Touch ID sensor) on your Mac.
3. Continue holding the button until the screen displays “Loading startup options…”.
4. Click Options and select Continue.
5. Log in with an administrator account to authenticate into recoveryOS.
6. In the top menu bar, click Utilities and select Terminal.

Core bputil Commands and Syntax

1. Inspecting the Current Boot Policy

To view the active LocalPolicy manifest of the installed macOS volume, run:

bputil -d

The -d (dump) flag prints a structured report showing the active security mode, boot policy version, volume UUID, and whether KEXTs, MDM management, or SIP overrides are enabled.

2. Switching to Reduced Security

To enable Reduced Security mode on the default boot volume:

bputil -s -r

Here, -s specifies changing security settings, and -r selects Reduced Security. When prompted, enter your administrator password to authorize the Secure Enclave cryptographic signing operation.

3. Enabling Third-Party Kernel Extensions

If you need to install legacy audio interfaces, virtualization drivers, or storage drivers that rely on kernel extensions:

bputil -s -k

The -k flag authorises user management of approved kernel extensions. Note that enabling -k automatically transitions the system into Reduced Security mode.

4. Restoring Full Security Mode

To return your Mac to factory-grade Full Security and wipe all custom boot policy exemptions:

bputil -s -f

The -f flag restores Full Security, revoking all third-party kernel extensions and enforcing strict Apple-signed kernel integrity.

Detailed bputil Parameters and Policy Flags

Command Flag	Function	Security Impact
bputil -d	Dumps the current LocalPolicy manifest to standard output	Read-only; inspects active cryptographic status
bputil -s -f	Sets the target volume to Full Security	Maximum security; blocks non-Apple kernel extensions
bputil -s -r	Sets the target volume to Reduced Security	Allows signed third-party extensions and custom policies
bputil -s -k	Enables user-approved Kernel Extension loading	Requires Reduced Security; allows developer KEXTs
bputil -s -m	Enables MDM remote management of kernel extensions	Permits enterprise MDM profiles to approve KEXTs remotely

Interpreting LocalPolicy Dump Output

When running bputil -d, look for key cryptographic indicators in the output:

Policy Version:            1
Security Mode:             Reduced
Auxiliary KC:              Enabled
Kernel Cache Type:         Production
SIP Status:                Enabled
User Approved KEXTs:       Enabled
Remote KEXT Management:    Disabled

In this example, the system operates in Reduced Security mode with User Approved KEXTs: Enabled, allowing developer kernel drivers to execute while leaving SIP Status: Enabled to protect critical system files and directories from modification.

Best Practices and Enterprise Considerations

• Keep Full Security Whenever Possible: Modern macOS versions support System Extensions (DriverKit, Endpoint Security, Network Extensions) that run safely in user space without requiring kernel access or Reduced Security.
• Enterprise MDM Deployments: For corporate fleets requiring specialised security software, use bputil -s -m alongside Apple Mobile Device Management (MDM) configuration profiles to automate KEXT approvals without compromising root integrity.
• Volume Targeting: On Macs with multi-boot configurations, pass -v <volume-path> (e.g., bputil -d -v /Volumes/Macintosh HD) to audit specific OS installations independently.