Investigate removing MacOS entitlements on the dotnet host

[mikem8361]

Investigate if these dotnet host current entitlements are necessary:

com.apple.security.cs.allow-unsigned-executable-memory
com.apple.security.cs.allow-dyld-environment-variables

https://github.com/dotnet/runtime/blob/main/eng/pipelines/common/entitlements.plist

There will be testing and investigation to make sure removing them doesn't break anything.

Oded Hanson:

We only needed com.apple.security.cs.allow-jit but, indeed the process doesn't inherit the default DYLIB search paths and we need to manually add :/usr/local/lib:/usr/lib to the NATIVE_DLL_SEARCH_DIRECTORIES. I guess com.apple.security.cs.allow-dyld-environment-variables would have solved that, instead of adding the paths explicitly.

[ghost]

Tagging subscribers to this area: @vitek-karas, @agocke, @VSadov
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Investigate if these dotnet host current entitlements are necessary:

com.apple.security.cs.allow-unsigned-executable-memory
com.apple.security.cs.allow-dyld-environment-variables

https://github.com/dotnet/runtime/blob/main/eng/pipelines/common/entitlements.plist

There will be testing and investigation to make sure removing them doesn't break anything.

Oded Hanson:

We only needed com.apple.security.cs.allow-jit but, indeed the process doesn't inherit the default DYLIB search paths and we need to manually add :/usr/local/lib:/usr/lib to the NATIVE_DLL_SEARCH_DIRECTORIES. I guess com.apple.security.cs.allow-dyld-environment-variables would have solved that, instead of adding the paths explicitly.

Author:	mikem8361
Assignees:	-
Labels:	area-Host
Milestone:	6.0.0

[vitek-karas]

/cc @VSadov

[akoeplinger]

com.apple.security.cs.allow-unsigned-executable-memory was done by #51294 I think

[agocke]

I think this is done. #51294 closed out the only change we'd likely make here.