codesign<\/code> utility (it may be usable w\/o the developer tools, but I never run without them so drop a note in the comments if you can confirm this) to see them:<\/p>\n$ codesign -d --entitlements :- \/Applications\/RStudio.app\nExecutable=\/Applications\/RStudio.app\/Contents\/MacOS\/RStudio\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-\/\/Apple Computer\/\/DTD PLIST 1.0\/\/EN\" \"http:\/\/www.apple.com\/DTDs\/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n\n <!-- Required by R packages which want to access the camera. -->\n <key>com.apple.security.device.camera<\/key>\n <true\/>\n\n <!-- Required by R packages which want to access the microphone. -->\n <key>com.apple.security.device.audio-input<\/key>\n <true\/>\n\n <!-- Required by Qt \/ Chromium. -->\n <key>com.apple.security.cs.disable-library-validation<\/key>\n <true\/>\n <key>com.apple.security.cs.disable-executable-page-protection<\/key>\n <true\/>\n\n <!-- We use DYLD_INSERT_LIBRARIES to load the libR.dylib dynamically. -->\n <key>com.apple.security.cs.allow-dyld-environment-variables<\/key>\n <true\/>\n\n <!-- Required to knit to Word -->\n <key>com.apple.security.automation.apple-events<\/key>\n <true\/>\n\n<\/dict>\n<\/plist>\n<\/code><\/pre>\nThe output is (ugh) XML, and don’t think that all app developers are as awesome as RStudio ones since those comments are pseudo-optional (i.e. you can put junk in them). I’ll continue to use RStudio throughout this example just for consistency.<\/p>\n
Since you likely have better things to do than execute a command line tool multiple times and do significant damage to your eyes with all those pointy tags we can use R to turn the apps on our filesystem into data and examine the entitlements in a much more dignified manner.<\/p>\n
First, we’ll write a function to wrap the codesign<\/code> tool execution (and, I’ve leaked how were going to eventually look at them by putting all the library calls up front):<\/p>\nlibrary(XML)\nlibrary(tidyverse)\nlibrary(igraph)\nlibrary(tidygraph)\nlibrary(ggraph)\n\n# rewriting this to also grab the text from the comments is an exercise left to the reader\n\nread_entitlements <- function(app) { \n\n system2(\n command = \"codesign\",\n args = c(\n \"-d\",\n \"--entitlements\",\n \":-\",\n gsub(\" \", \"\\\\\\\\ \", app)\n ),\n stdout = TRUE\n ) -> x\n\n x <- paste0(x, collapse = \"\\n\")\n\n if (nchar(x) == 0) return(tibble())\n\n x <- XML::xmlParse(x, asText=TRUE)\n x <- try(XML::readKeyValueDB(x), silent = TRUE)\n\n if (inherits(x, \"try-error\")) return(tibble())\n\n x <- sapply(x, function(.x) paste0(.x, collapse=\";\"))\n\n if (length(x) == 0) return(tibble())\n\n data.frame(\n app = basename(app),\n entitlement = make.unique(names(x)),\n value = I(x)\n ) -> x\n\n x <- tibble::as_tibble(x)\n\n x\n\n} \n<\/code><\/pre>\nNow, we can slurp up all the entitlements with just a few lines of code:<\/p>\n
my_apps <- list.files(\"\/Applications\", pattern = \"\\\\.app$\", full.names = TRUE)\n\nmy_apps_entitlements <- map_df(my_apps, read_entitlements)\n\nmy_apps_entitlements %>% \n filter(grepl(\"RStudio\", app))\n## # A tibble: 6 x 3\n## app entitlement value \n## <chr> <chr> <I<chr>>\n## 1 RStudio.app com.apple.security.device.camera TRUE \n## 2 RStudio.app com.apple.security.device.audio-input TRUE \n## 3 RStudio.app com.apple.security.cs.disable-library-validation TRUE \n## 4 RStudio.app com.apple.security.cs.disable-executable-page-protection TRUE \n## 5 RStudio.app com.apple.security.cs.allow-dyld-environment-variables TRUE \n## 6 RStudio.app com.apple.security.automation.apple-events TRUE \n<\/code><\/pre>\nHaving these entitlement strings is great, but what do they mean? Unfortunately, Apple, frankly, sucks<\/em> at developer documentation, and this suckage shines especially bright when it comes to documenting all<\/em> the possible entitlements. We can<\/em> retrieve some of them from the online documentation, so let’s do that and re-look at RStudio:<\/p>\n# a handful of fairly ok json URLs that back the online dev docs; they have ok, but scant entitlement definitions\nc(\n \"https:\/\/developer.apple.com\/tutorials\/data\/documentation\/bundleresources\/entitlements.json\",\n \"https:\/\/developer.apple.com\/tutorials\/data\/documentation\/security\/app_sandbox.json\",\n \"https:\/\/developer.apple.com\/tutorials\/data\/documentation\/security\/hardened_runtime.json\",\n \"https:\/\/developer.apple.com\/tutorials\/data\/documentation\/bundleresources\/entitlements\/system_extensions.json\"\n) -> entitlements_info_urls\n\nextract_entitlements_info <- function(x) {\n\n apple_ents_pg <- jsonlite::fromJSON(x)\n\n apple_ents_pg$references %>% \n map_df(~{\n\n if (!hasName(.x, \"role\")) return(tibble())\n if (.x$role != \"symbol\") return(tibble())\n\n tibble(\n title = .x$title,\n entitlement = .x$name,\n description = .x$abstract$text %||% NA_character_\n )\n\n })\n\n}\n\nentitlements_info_urls %>% \n map(extract_ents_info) %>% \n bind_rows() %>% \n distinct() -> apple_entitlements_definitions\n\n# look at rstudio again ---------------------------------------------------\n\nmy_apps_entitlements %>% \n left_join(apple_entitlements_definitions) %>% \n filter(grepl(\"RStudio\", app)) %>% \n select(title, description)\n## Joining, by = \"entitlement\"\n## # A tibble: 6 x 2\n## title description \n## <chr> <chr> \n## 1 Camera Entitlement A Boolean value that indicates whether the app may capture movies\u2026\n## 2 Audio Input Entitlement A Boolean value that indicates whether the app may record audio u\u2026\n## 3 Disable Library Validation Enti\u2026 A Boolean value that indicates whether the app may load arbitrary\u2026\n## 4 Disable Executable Memory Prote\u2026 A Boolean value that indicates whether to disable all code signin\u2026\n## 5 Allow DYLD Environment Variable\u2026 A Boolean value that indicates whether the app may be affected by\u2026\n## 6 Apple Events Entitlement A Boolean value that indicates whether the app may prompt the use\u2026\n<\/code><\/pre>\nIt might be interesting to see what the most requested entitlements are:<\/p>\n
my_apps_entitlements %>% \n filter(\n grepl(\"security\", entitlement)\n ) %>% \n count(entitlement, sort = TRUE)\n## # A tibble: 60 x 2\n## entitlement n\n## <chr> <int>\n## 1 com.apple.security.app-sandbox 51\n## 2 com.apple.security.network.client 44\n## 3 com.apple.security.files.user-selected.read-write 35\n## 4 com.apple.security.application-groups 29\n## 5 com.apple.security.automation.apple-events 26\n## 6 com.apple.security.device.audio-input 19\n## 7 com.apple.security.device.camera 17\n## 8 com.apple.security.files.bookmarks.app-scope 16\n## 9 com.apple.security.network.server 16\n## 10 com.apple.security.cs.disable-library-validation 15\n## # \u2026 with 50 more rows\n<\/code><\/pre>\nPlaying in an app sandbox, talking to the internet, and handling files are unsurprising in the top three slots since that’s how most apps get stuff done for you.<\/p>\n
There are a few entitlements which increase your attack surface, one of which is apps that use untrusted third-party libraries:<\/p>\n
my_apps_entitlements %>% \n filter(\n entitlement == \"com.apple.security.cs.disable-library-validation\"\n ) %>% \n select(app)\n## # A tibble: 15 x 1\n## app \n## <chr> \n## 1 Epic Games Launcher.app \n## 2 GarageBand.app \n## 3 HandBrake.app \n## 4 IINA.app \n## 5 iStat Menus.app \n## 6 krisp.app \n## 7 Microsoft Excel.app \n## 8 Microsoft PowerPoint.app \n## 9 Microsoft Word.app \n## 10 Mirror for Chromecast.app\n## 11 Overflow.app \n## 12 R.app \n## 13 RStudio.app \n## 14 RSwitch.app \n## 15 Wireshark.app \n<\/code><\/pre>\n(‘Tis ironic that one of Apple’s own apps is in that list.)<\/p>\n
What about apps that listen on the network (i.e. are also servers)?<\/p>\n
## # A tibble: 16 x 1\n## app \n## <chr> \n## 1 1Blocker.app \n## 2 1Password 7.app \n## 3 Adblock Plus.app \n## 4 Divinity - Original Sin 2.app\n## 5 Fantastical.app \n## 6 feedly.app \n## 7 GarageBand.app \n## 8 iMovie.app \n## 9 Keynote.app \n## 10 Kindle.app \n## 11 Microsoft Remote Desktop.app \n## 12 Mirror for Chromecast.app \n## 13 Slack.app \n## 14 Tailscale.app \n## 15 Telegram.app \n## 16 xScope.app \n<\/code><\/pre>\nYou should read through the retrieved definitions to see what else you may want to observe to be an informed macOS app user.<\/p>\n
The Big Picture<\/h3>\n
Looking at individual apps is great, but why not look at them all<\/em>? We can build a large, but searchable network graph hierarchy if we output it as PDf, so let’s do that:<\/p>\n# this is just some brutish force code to build a hierarchical edge list\n\nmy_apps_entitlements %>% \n distinct(entitlement) %>% \n pull(entitlement) %>% \n stri_count_fixed(\".\") %>% \n max() -> max_dots\n\nmy_apps_entitlements %>% \n distinct(entitlement, app) %>% \n separate(\n entitlement,\n into = sprintf(\"level_%02d\", 1:(max_dots+1)),\n fill = \"right\",\n sep = \"\\\\.\"\n ) %>% \n select(\n starts_with(\"level\"), app\n ) -> wide_hierarchy\n\nbind_rows(\n\n distinct(wide_hierarchy, level_01) %>%\n rename(to = level_01) %>%\n mutate(from = \".\") %>%\n select(from, to) %>% \n mutate(to = sprintf(\"%s_1\", to)),\n\n map_df(1:nrow(wide_hierarchy), ~{\n\n wide_hierarchy[.x,] %>% \n unlist(use.names = FALSE) %>% \n na.exclude() -> tmp\n\n tibble(\n from = tail(lag(tmp), -1),\n to = head(lead(tmp), -1),\n lvl = 1:length(from)\n ) %>% \n mutate(\n from = sprintf(\"%s_%d\", from, lvl),\n to = sprintf(\"%s_%d\", to, lvl+1)\n )\n\n }) %>% \n distinct()\n\n) -> long_hierarchy\n\n# all that so we can make a pretty graph! ---------------------------------\n\ng <- graph_from_data_frame(long_hierarchy, directed = TRUE)\n\nggraph(g, 'partition', circular = FALSE) + \n geom_edge_diagonal2(\n width = 0.125, color = \"gray70\"\n ) + \n geom_node_text(\n aes(\n label = stri_replace_last_regex(name, \"_[[:digit:]]+$\", \"\")\n ),\n hjust = 0, size = 3, family = font_gs\n ) +\n coord_flip() -> gg\n\n# saving as PDF b\/c it is ginormous, but very searchable\n\nquartz(\n file = \"~\/output-tmp\/.pdf\", # put it where you want\n width = 21,\n height = 88,\n type = \"pdf\",\n family = font_gs\n)\nprint(gg)\ndev.off()\n<\/code><\/pre>\nThe above generates a large<\/em> (dimension-wise; it’s ~<5MB on disk for me) PDF graph that is barely viewable in thumnail mode:<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2021\/02\/ent-grph-01.png?resize=268%2C1036&ssl=1\")
<\/a><\/p>\nHere are some screen captures of portions of it. First are all network servers and clients:<\/p>\n
![\"\"](\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2021\/02\/ent-grph-02.png?resize=510%2C538&ssl=1\")
<\/a><\/p>\nLast are seekrit entitlements only for Apple:<\/p>\n
![\"\"](\"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2021\/02\/ent-grph-01.png?ssl=1\")
<\/a><\/p>\n