Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make our macOS entitlements stricter #638

Open
apyrgio opened this issue Dec 6, 2023 · 0 comments · May be fixed by #639
Open

Make our macOS entitlements stricter #638

apyrgio opened this issue Dec 6, 2023 · 0 comments · May be fixed by #639
Assignees
@apyrgio
Labels
P:mac security stretch goal
Milestone
Bookmarks

Comments

@apyrgio
Copy link
Contributor

apyrgio commented Dec 6, 2023

Our macOS entitlements are the following:

dangerzone/install/macos/entitlements.plist

Lines 3 to 20 in 612ac06

<plist version="1.0">
<dict>
<!-- <key>com.apple.security.app-sandbox</key>
<true/> -->
<key>com.apple.security.inherit</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.network.server</key>
<true/>
<key>com.apple.security.hypervisor</key>
<true/>
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
<true/>
</dict>
</plist>

These entitlements were last updated when Dangerzone was considering using HyperKit to spawn VMs (9158d02, on 2021-06-30)

Now that it uses Docker Desktop, we can do the following changes:

  1. Re-enable com.apple.security.app-sandbox, which offers some important protections and is a requirement for publishing Dangerzone in the MacOS App store, if we ever want to.
  2. Remove com.apple.security.hypervisor and com.apple.security.cs.allow-unsigned-executable-memory, since they are Hyperkit related and lower our protections.
@apyrgio apyrgio added this to the 0.5.1 milestone Dec 6, 2023
apyrgio added a commit that referenced this issue Dec 6, 2023
@apyrgio
macos: Update our macOS entitlements
3fdd155 
Our entitlements were last updated when Dangerzone was considering
using HyperKit to spawn VMs (9158d02, on 2021-06-30). Now that we use
Docker Desktop, we can make them stricter.

Fixes #638
@apyrgio apyrgio linked a pull request Dec 6, 2023 that will close this issue
Open
apyrgio added a commit that referenced this issue Dec 6, 2023
@apyrgio
macos: Update our macOS entitlements
890f1ae 
Our entitlements were last updated when Dangerzone was considering
using HyperKit to spawn VMs (9158d02, on 2021-06-30). Now that we use
Docker Desktop, we can make them stricter.

Fixes #638
apyrgio added a commit that referenced this issue Dec 6, 2023
@apyrgio
macos: Update our macOS entitlements
2f1fbd3 
Our entitlements were last updated when Dangerzone was considering
using HyperKit to spawn VMs (9158d02, on 2021-06-30). Now that we use
Docker Desktop, we can make them stricter.

Fixes #638
@apyrgio apyrgio removed this from the 0.5.1 milestone Dec 12, 2023
@deeplow deeplow mentioned this issue Jan 29, 2024
Open
@harrislapiroff harrislapiroff added this to the 0.7.0 milestone Mar 7, 2024
@apyrgio apyrgio self-assigned this Jun 13, 2024
@apyrgio apyrgio modified the milestones: 0.7.0, Bookmarks Jun 27, 2024
almet pushed a commit that referenced this issue Oct 17, 2024
@apyrgio @almet
macos: Update our macOS entitlements
5d779a2 
Our entitlements were last updated when Dangerzone was considering
using HyperKit to spawn VMs (9158d02, on 2021-06-30). Now that we use
Docker Desktop, we can make them stricter.

Fixes #638
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@apyrgio apyrgio

Labels
P:mac security stretch goal
Projects
None yet
Milestone
Bookmarks
Development

Successfully merging a pull request may close this issue.

macos: Update our macOS entitlements freedomofpress/dangerzone
2 participants
@harrislapiroff @apyrgio