If signatures are checked, they are checked by the kernel (and its userland buddy AMFI) every time the process is launched. I'm not sure what the defaults are f

If signatures are checked, they are checked by the kernel (and its userland buddy AMFI) every time the process is launched. I'm not sure what the defaults are for macOS lately but a developer can opt-in to even more restrictions like requiring linked shared libraries to be signed with the same key pair as the executable. This library validation behavior changed in 10.12 and can now also prohibit mprotect(RWX). I'm fuzzy on the exact details of the {OS version, compiler version [yes, 10.12 changes codesign validation behavior based off of the version of the compiler, not the OS, used to build the binary], codesign requirements} mix but it is increasingly becoming more like iOS. Apple has spent the last decade developing a pretty impressive* chain of trust for code execution, starting with iOS and merging into macOS. Basically, code signing on iOS is dynamically secure, modulo vulnerabilities, and macOS is steadily on its way to become more like iOS in this regard. * But not fun for security research and having ultimate control of your device. Always the tradeoffs... http://www.newosxbook.com/articles/CodeSigning.pdf http://www.newosxbook.com/articles/CodeSigning.pdf https://developer.apple.com/library/content/technotes/tn2206/_index.html https://developer.apple.com/library/content/technotes/tn2206...