- Protects apps against code injection via library hijacking, env vars, and task port injection. 
- List app entitlements:
	- `codesign -d --entitlements :- <file>`
	- Poseidon: `list_entitlements`
	- Look for any of the following:
		- `com.apple.security.cs.disable-library-validation`
			- Allows any dynlib to be loaded into the process
		- `com.apple.security.cs.allow-dyld-environment-variables`
			- Allows dynlibs to be loaded from `DYLD_INSERT_LIBRARIES` env var.
			- Code signing requirements still apply unless the previous setting is also applied.
			- Injection:
				- `DYLD_INSERT_LIBRARIES=malicious.dylib ./app`
		- `com.apple.security.get-task-allow`
			- Allows other apps to get task port; similar to a handle on Windows. Accessing a task port requires root.
			- Enables classic create thread process injection
	-