1860950 - Drop the disable-library-validation entitlement from the parent process executable

Status: NEW

(Core :: Security: Process Sandboxing, enhancement, P2)

Description

[Haik Aftandilian [:haik]]

This bug is to remove the com.apple.security.cs.disable-library-validation entitlement from the parent process executable. At this time, is is required to allow for loading of user-specified pkcs#11 modules.

With the fix for bug 1593072 - Use different entitlement files for child processes and other resources, we added support to our release pipeline for different entitlements for different executables in the bundle.

At the same time we attempted to reduce the entitlements allowed for each executable. The fix went to far and removed com.apple.security.cs.disable-library-validation from the parent process executable and we added it back to address bug 1856972.