macOS APFS snapshot mount authorization bypass

CVE-2020-9771 is a macOS local security flaw in APFS snapshot mounting that allowed a low-privileged local user to mount local APFS snapshots read-only and access files belonging to other users, including TCC-protected data. The issue stemmed from missing authorization enforcement in the snapshot mount path: prior to the fix, APFS snapshot mounting flowed through the kernel mount path without a dedicated MACF/Sandbox check for snapshot mounts. Research cited in the content identifies the root cause as the absence of a Sandbox authorization check, later implemented as mac_mount_check_snapshot_mount / hook_mount_check_snapshot_mount. In practice, an attacker could use tmutil to create or enumerate local snapshots and mount them with mount_apfs using the noowners option, causing files in the mounted snapshot to appear owned by the current effective user and thereby bypass normal ownership- and privacy-based access restrictions. Apple described the fix as being addressed with a new entitlement and shipped fixes in macOS Catalina 10.15.4/10.15.5 and Mojave security updates; the practical effect described in the content is that snapshot mounting became restricted to applications granted Full Disk Access.