3 ms·

Serious question - how are you able to modify an application binary and not have the OS refuse to run it? Is spotify shipping an unsigned binary?

toyg 10y ago
Does OSX actually check signatures anytime after installation ? If yes, how do auto-updates work, do they update the signature every time?
- jevinskie 10y ago
  If signatures are checked, they are checked by the kernel (and its userland buddy AMFI) every time the process is launched. I'm not sure what the defaults are for macOS lately but a developer can opt-in to even more restrictions like requiring linked shared libraries to be signed with the same key pair as the executable. This library validation behavior changed in 10.12 and can now also prohibit mprotect(RWX). I'm fuzzy on the exact details of the {OS version, compiler version [yes, 10.12 changes codesign validation behavior based off of the version of the compiler, not the OS, used to build the binary], codesign requirements} mix but it is increasingly becoming more like iOS. Apple has spent the last decade developing a pretty impressive* chain of trust for code execution, starting with iOS and merging into macOS. Basically, code signing on iOS is dynamically secure, modulo vulnerabilities, and macOS is steadily on its way to become more like iOS in this regard. * But not fun for security research and having ultimate control of your device. Always the tradeoffs... http://www.newosxbook.com/articles/CodeSigning.pdf http://www.newosxbook.com/articles/CodeSigning.pdf https://developer.apple.com/library/content/technotes/tn2206/_index.html https://developer.apple.com/library/content/technotes/tn2206...
kevinchen 10y ago
App signature checks aren't required to succeed on macOS -- the user has the ability to override it globally in System Preferences, or add an exception using the right-click menu.

toyg 10y ago

Does OSX actually check signatures anytime after installation ? If yes, how do auto-updates work, do they update the signature every time?

jevinskie 10y ago
If signatures are checked, they are checked by the kernel (and its userland buddy AMFI) every time the process is launched. I'm not sure what the defaults are for macOS lately but a developer can opt-in to even more restrictions like requiring linked shared libraries to be signed with the same key pair as the executable. This library validation behavior changed in 10.12 and can now also prohibit mprotect(RWX). I'm fuzzy on the exact details of the {OS version, compiler version [yes, 10.12 changes codesign validation behavior based off of the version of the compiler, not the OS, used to build the binary], codesign requirements} mix but it is increasingly becoming more like iOS. Apple has spent the last decade developing a pretty impressive* chain of trust for code execution, starting with iOS and merging into macOS. Basically, code signing on iOS is dynamically secure, modulo vulnerabilities, and macOS is steadily on its way to become more like iOS in this regard. * But not fun for security research and having ultimate control of your device. Always the tradeoffs... http://www.newosxbook.com/articles/CodeSigning.pdf http://www.newosxbook.com/articles/CodeSigning.pdf https://developer.apple.com/library/content/technotes/tn2206/_index.html https://developer.apple.com/library/content/technotes/tn2206...

kevinchen 10y ago

App signature checks aren't required to succeed on macOS -- the user has the ability to override it globally in System Preferences, or add an exception using the right-click menu.