16 lines
834 B
Markdown
16 lines
834 B
Markdown
- Protects apps against code injection via library hijacking, env vars, and task port injection.
|
|
- List app entitlements:
|
|
- `codesign -d --entitlements :- <file>`
|
|
- Poseidon: `list_entitlements`
|
|
- Look for any of the following:
|
|
- `com.apple.security.cs.disable-library-validation`
|
|
- Allows any dynlib to be loaded into the process
|
|
- `com.apple.security.cs.allow-dyld-environment-variables`
|
|
- Allows dynlibs to be loaded from `DYLD_INSERT_LIBRARIES` env var.
|
|
- Code signing requirements still apply unless the previous setting is also applied.
|
|
- Injection:
|
|
- `DYLD_INSERT_LIBRARIES=malicious.dylib ./app`
|
|
- `com.apple.security.get-task-allow`
|
|
- Allows other apps to get task port; similar to a handle on Windows. Accessing a task port requires root.
|
|
- Enables classic create thread process injection
|
|
- |