Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WIP] Remove unsigned executable entitlement #51294

Merged
merged 1 commit into from
Jun 16, 2021
Merged

Conversation

mangod9
Copy link
Member

@mangod9 mangod9 commented Apr 15, 2021

we should be able to now remove this particular entitlement: allow-unsigned-executable-memory. Fixes #45677

@mangod9
Copy link
Member Author

mangod9 commented Apr 15, 2021

@janvorli @mikem8361 what is the best way to validate this locally? Doesnt look like local builds are signed?

@janvorli
Copy link
Member

What I usually do is to publish a self contained testing .NET app, store it in a special directory structure and sign the native binaries and include the entitlements.

Here are the steps:

  • Create a directory mytest.app (any name would do, but the extension is important, I believe)
  • Inside of that, create a dir Contents
  • Inside of it, create dirs MacOS and Resources and also a file named Info.plist with the following contents:
CFBundleExecutable your_app_host_name

* Copy all the test app binaries into the MacOS dir

Somewhere out of that dir structure, create a file named entitlements.plist with the content from the file in this PR.

  • Sign the native binaries of the test app like the host, libcoreclr.dylib etc. using the following pattern

codesign --deep --force --sign "Apple Development: janvorli@microsoft.com (XXXXXXXXX)" -o runtime --entitlements /your/path/to/entitlements.plist libcoreclr.dylib

The string after the --sign is your developer certificate name. If you don't have a developer certificate yet, you'll need to create one. I am not sure about the steps I've used to create ones, but I think the following document describes them: https://ioscodesigning.com/generating-code-signing-files/

After that, just execute the host executable from the MacOS dir

@mangod9
Copy link
Member Author

mangod9 commented May 21, 2021

Closing for now, will reopen when ready to merge.

@mangod9 mangod9 closed this May 21, 2021
@mangod9
Copy link
Member Author

mangod9 commented Jun 15, 2021

I have tested that the changed entitlements do seem to work:

% codesign -d --entitlements :- MacOS/Test
2021-06-14 23:51:05.581 codesign[27750:76939611] There was an error parsing the Info.plist for the bundle at URL <0x157e0e960>: NSCocoaErrorDomain - 3840
Executable=/Users/manishg/temp/mytest.app/Contents/MacOS/Test
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.cs.allow-jit</key>
      <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
      <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
      <true/>
    <key>com.apple.security.cs.debugger</key>
      <true/>
    <key>com.apple.security.get-task-allow</key>
      <true/>
  </dict>
</plist>

I do see an error but the app does seem to function without the allow-unsigned-executable-memory entitlement.

@mangod9 mangod9 reopened this Jun 15, 2021
@mangod9 mangod9 requested a review from janvorli June 15, 2021 06:54
Copy link
Member

@janvorli janvorli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you for testing it!

@mangod9 mangod9 merged commit 094931c into dotnet:main Jun 16, 2021
@mangod9 mangod9 deleted the entitle branch June 16, 2021 04:08
@akoeplinger
Copy link
Member

@mangod9
Copy link
Member Author

mangod9 commented Jun 16, 2021

ah good catch @akoeplinger . cc @jcagme @mikem8361 since they added the two files. I can update the other one too.

@mikem8361
Copy link
Member

Yes, this entitlements.plist is used to entitle the hosts with the com.apple.security.get-task-allow which is needed for createdump to work and for debugging. It was created by in 5.0 and I assumed it was in the same directory as all the other .plist files.

So who wants to remove the com.apple.security.cs.allow-unsigned-executable-memory entitlement?

@mangod9
Copy link
Member Author

mangod9 commented Jun 16, 2021

customer had asked about com.apple.security.cs.allow-unsigned-executable-memory and shouldnt be required for runtime. Is it still required for createdump and/or diagnostics? If so we would need to separate out the files.

@mikem8361
Copy link
Member

I don't think that createdump/debugging and the hosts need this entitlement. They still need to be separate files because they add the debugging specific entitlements.

@akoeplinger
Copy link
Member

I'm not sure if we can just change the file in the dotnet-release repo, it might be used for 5.0 releases as well?

It'd be great if the entitlements.plist in dotnet/runtime was actually used as the source of truth.

@janvorli
Copy link
Member

janvorli commented Jun 16, 2021

@akoeplinger even .NET 5 and .NET Core 3.1 stuff didn't need that enlistment entitlement. It was added kind of by accident.

@janvorli
Copy link
Member

(We use MAP_JIT to all executable memory mappings since 3.1)

@mangod9
Copy link
Member Author

mangod9 commented Jun 16, 2021

I will check with @jcagme to ensure we dont revert it in 5/3.1, since that would need to go through approvals.

@ghost ghost locked as resolved and limited conversation to collaborators Jul 16, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Check if we really need com.apple.security.cs.allow-unsigned-executable-memory on macOS
4 participants