Repository navigation
Codesigning the apphost on macOS should preserve entitlements #113707
Description
I noticed this today after an internal discussion on Teams related to dotnet/cli-lab#346.
When you publish a self-contained app on macOS today the apphost in the output directory doesn't contain any entitlements:
$ dotnet new console -o signtest
$ dotnet publish --self-contained
$ codesign -d --entitlements - --xml bin/Release/net9.0/osx-x64/publish/signtest
Executable=/Users/alexander/dev/test/signtest/bin/Release/net9.0/osx-x64/publish/signtestcontrast this to the apphost in the apphost pack:
$ codesign -d --entitlements - --xml /Users/alexander/.nuget/packages/microsoft.netcore.app.host.osx-x64/9.0.2/runtimes/osx-x64/native/apphost
Executable=/Users/alexander/.nuget/packages/microsoft.netcore.app.host.osx-x64/9.0.2/runtimes/osx-x64/native/apphost
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "https://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>com.apple.security.cs.allow-dyld-environment-variables</key><true/><key>com.apple.security.cs.allow-jit</key><true/><key>com.apple.security.cs.debugger</key><true/><key>com.apple.security.cs.disable-library-validation</key><true/><key>com.apple.security.get-task-allow</key><true/></dict></plist>
This has the entitlements we embed during the runtime build from https://github.com/dotnet/runtime/blob/main/eng/native/entitlements.plist
It looks like the code in HostWriter.cs which gets invoked by the CreateAppHost msbuild task in the dotnet sdk to ad-hoc sign the binary doesn't preserve the entitlements.
This means that developers who want to sign the apphost using a real certificate and enable the hardened runtime option need to re-add the entitlements again which is not obvious, see dotnet/sdk#24337 which now also uses outdated entitlements compared to what we use nowadays. The list on the public docs page is outdated too: https://learn.microsoft.com/en-us/dotnet/core/install/macos-notarization-issues#default-entitlements
Activity
dotnet-policy-service commentedon Mar 19, 2025
Tagging subscribers to this area: @vitek-karas, @agocke
See info in area-owners.md if you want to be subscribed.
agocke commentedon Mar 20, 2025
I believe this is supposed to be identical to what comes out of macOS ad-hoc codesign. Is that true? Or are they different?
akoeplinger commentedon Mar 20, 2025
it depends on the option,
codesignhas--preserve-metadata=entitlementswhich does thatam11 commentedon Mar 26, 2025
Is it a regression from .NET 9? The code you are referring to was added in .NET 10: #108992, and the second part is in progress #110417.
cc @jtschuster @filipnavara
akoeplinger commentedon Mar 26, 2025
no it's not a regression. in net9 we used the
codesigntool directly but didn't pass the--preserve-metadata=entitlementseitherjtschuster commentedon May 15, 2025
Investigated an issue today that wound up being due to this. I'll look into how much this would take to implement in the manager signer.
agocke commentedon Nov 20, 2025
We've decided not to implement this. For local development we want to enable debugging entitlements, but those entitlements are not desirable for release. Instead, we've created documentation on which entitlements are needed for minimal .NET functionality at https://learn.microsoft.com/en-us/dotnet/core/deploying/macos