Agent Wranglers

DSK-33Recommended

Keep hardened runtime exceptions to the few the app uses

Sign Mac apps with a written list of hardened runtime exceptions and resource entitlements, each with a reason. Ship no exception the app does not use, and put exceptions only on executables, never on libraries.

By Agent Wranglers. Updated .

How to do it

The hardened runtime blocks code injection, library swaps and writable executable memory. Each exception turns one of those protections off. Apple's documentation says to use only the entitlements the app's features cannot work without. An app whose JavaScript engine compiles code at run time, such as an Electron app, may need com.apple.security.cs.allow-jit. Most apps need none of allow-unsigned-executable-memory, allow-dyld-environment-variables or disable-library-validation. Those last two together let any program load its own library into yours, which load libraries only from folders attackers cannot write guards against. Resource entitlements such as camera or microphone follow ask for system permissions only when a feature needs them. Sign helpers and frameworks with their own, shorter lists, as sign and notarise every Mac build does for the app.

Examples

XML example

<!-- entitlements.mac.plist: one exception, because Electron's JavaScript engine compiles code at run time -->
<plist version="1.0">
<dict>
  <key>com.apple.security.cs.allow-jit</key>
  <true/>
</dict>
</plist>

Shell example

codesign -d --entitlements - --xml "Ledgerly.app/Contents/MacOS/Ledgerly" | plutil -convert json -o - - \
  | jq -r 'keys[]' | sort > found.txt
diff found.txt approved-entitlements.txt

How to check

A CI step runs codesign -d --entitlements - --xml on each executable in the release and compares the keys with the approved list in the repository. It fails on any key the list does not hold, and on get-task-allow in a release build.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/mac-entitlements">Agent Wranglers desktop apps and extensions playbook</a>. In code you write, add a comment next to it with the same link.