get-task-allow entitlement
Thanks! node.js is notarized with these entitlements, so I am fairly sure that Apple will allow it. I have re-signed all my R installations and added this entitlement some time ago, and haven't seen any issues so far. But yeah, that is not much testing at all. Btw. if anyone wants to add it to already installed R versions, it goes like this. Replace the version number (installation directory) as needed: codesign -d --xml --entitlements - /Library/Frameworks/R.framework/Versions/4.1-arm64/Resources/bin/exec/R
~/r.entitlements
/usr/libexec/PlistBuddy -c "Add :com.apple.security.get-task-allow bool true" ~/r.entitlements sudo codesign -s - -f --entitlements ~/r.entitlements /Library/Frameworks/R.framework/Versions/4.1-arm64/Resources/bin/exec/R I have also added this to https://github.com/gaborcsardi/rim so you can run rim system allow-debugger --all to update all installed versions of R. Thanks for considering this, G. On Tue, Apr 5, 2022 at 1:04 AM Simon Urbanek
<simon.urbanek at r-project.org> wrote:
G?bor, thanks. I will check the notarization process to see if Apple will allow it. There are some restrictions for processes that have get-task-allow entitlement, so if it is allowed I'll would ask for some more testing to make sure this doesn't affect something else in the R ecosystem. I agree that having to clear the entitlements to debug R is a bit of a pain. Thanks, Simon
On 5/04/2022, at 4:59 AM, G?bor Cs?rdi <csardi.gabor at gmail.com> wrote: Simon, I wonder if you would consider adding the get-task-allow entitlement to the R builds. get-task-allow allows debugging with lldb or other debuggers, and also enables core dumps. Apple suggests that you avoid get-task-allow in production builds: https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/resolving_common_notarization_issues?language=objc However, they also note here that a legitimate use case for it is allowing the debugging of plugins, which is exactly the case we have for R: "To enable debugging a plug-in in the context of a host executable, the host can include the com.apple.security.get-task-allow entitlement if it also includes the Disable Library Validation Entitlement. Don?t disable library validation for executables that don?t host plug-ins because library validation protects them from loading untrusted code." R already has disable-library-validation of course. FWIW node.js, which is a similar environment to R, in that it needs load extension packages, added this to their builds: https://github.com/nodejs/node/pull/34378 https://github.com/nodejs/node/commit/b0e4970b8fe0dbd6bf437b3b06d0438d906ea94d G.
_______________________________________________ R-SIG-Mac mailing list R-SIG-Mac at r-project.org https://stat.ethz.ch/mailman/listinfo/r-sig-mac