first commit

Necronomicon/Mac OS/Hardened Runtime.md

@@ -0,0 +1,16 @@
+- Protects apps against code injection via library hijacking, env vars, and task port injection. 
+- List app entitlements:
+	- `codesign -d --entitlements :- <file>`
+	- Poseidon: `list_entitlements`
+	- Look for any of the following:
+		- `com.apple.security.cs.disable-library-validation`
+			- Allows any dynlib to be loaded into the process
+		- `com.apple.security.cs.allow-dyld-environment-variables`
+			- Allows dynlibs to be loaded from `DYLD_INSERT_LIBRARIES` env var.
+			- Code signing requirements still apply unless the previous setting is also applied.
+			- Injection:
+				- `DYLD_INSERT_LIBRARIES=malicious.dylib ./app`
+		- `com.apple.security.get-task-allow`
+			- Allows other apps to get task port; similar to a handle on Windows. Accessing a task port requires root.
+			- Enables classic create thread process injection
+	-