Scripts (python3 and Swift) for macOS to recursively check /Applications and also check /usr/local/bin, /usr/bin, and /usr/sbin for binaries with problematic/interesting entitlements. Also checks for hardened runtime enablement
Hi,
You might want to check com.apple.private.security.clear-library-validation as well.
https://theevilbit.github.io/posts/com.apple.private.security.clear-library-validation/
Csaba
System binaries don't have the hardened flag set, but still receive the same protections from task_for_pid at least.
$ codesign -dvvv --entitlements - /usr/bin/w
Executable=/usr/bin/w
Identifier=com.apple.w
Format=Mach-O universal (x86_64 arm64e)
CodeDirectory v=20400 size=580 flags=0x0(none) hashes=13+2 location=embedded # Notice that no flags are set
Platform identifier=13
Hash type=sha256 size=32
CandidateCDHash sha256=f07e2b264c5db1f915652db1e62de3c59a489134
CandidateCDHashFull sha256=f07e2b264c5db1f915652db1e62de3c59a4891348c78deae6948aad86cb16365
Hash choices=sha256
CMSDigest=f07e2b264c5db1f915652db1e62de3c59a4891348c78deae6948aad86cb16365
CMSDigestType=2
CDHash=f07e2b264c5db1f915652db1e62de3c59a489134
Signature size=4442
Authority=Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA
Signed Time=Jun 17, 2022 at 18:47:28
Info.plist=not bound
TeamIdentifier=not set
Sealed Resources=none
Internal requirements count=1 size=60Even without the flag, I can't attach with task_for_pid:
$ lldb /usr/bin/w
(lldb) target create "/usr/bin/w"
Current executable set to '/usr/bin/w' (x86_64).
(lldb) r
error: process exited with status -1 (attach failed (Not allowed to attach to process. Look in the console messages (Console.app), near the debugserver entries, when the attach failed. The subsystem that denied the attach permission will likely have logged an informative message about why it was denied.))In Console.app:
macOSTaskPolicy: (com.apple.debugserver) may not get the task control port of (w) (pid: 7651): (w) is hardened, (w) doesn't have get-task-allow, (com.apple.debugserver) is a declared debugger(com.apple.debugserver) is not a declared read-only debugger
These should probably be excluded from the output.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.