1858573 - Adopt macOS Launch Environment and Library Constraints

Status: NEW

(Core :: Security: Process Sandboxing, enhancement, P3)

Description

[Haik Aftandilian [:haik]]

Starting with macOS Sonoma, applications can embed constraints about their required launch environment and loadable libraries per-executable. The constraints are added at the codesigning step much like entitlements.

For any executable using com.apple.security.cs.disable-library-validation, this allows the developer to limit which libraries can be loaded. We can have a list of acceptable team IDs or as a minimum require the library be signed with an Apple Developer ID cert.

Some possible use cases:

1. Limit the Media Plugin Helper process so that it can only load modules signed by the CDM providers.

2. Only allow child processes to be launched by the browser process.

Docs:
https://developer.apple.com/documentation/security/defining_launch_environment_and_library_constraints

WWDC Video:
https://developer.apple.com/videos/play/wwdc2023/10266/

This will require us to upgrade our signing machines to have a version of codesign that supports specifying these constraints.

Comment 1

[Haik Aftandilian [:haik]]

Gregory Szorc added initial support for this in rcodesign which may be an option for getting launch and library constraints without upgrading macOS. More testing needed.