Simple Firewall Content Filter example is not prompting for 'Security Preferences' for permissions

Question

Created Oct ’20

Replies 1

Boosts 0

Participants 2

HI,
Simple Firewall Content Filter example is not prompting for 'Security Preferences' for permissions if I changed the code signing through script.

If I have tried with Apple developer or If I have tried by attaching provisional profile in x-code for code signing, this is working fine. But It is not working if I have tried to provide code sign through a script at Build Phases in xcode. To make code sign from script, I have changed 'Code Sign Style' to Automatic from manual.

I have verified code sign details using codesign -vvvv -d -r- <process name> command on both working & non-working SimpleFirewall processes.

I have noticed difference in 'designated' tag and remaining tags are same for both. The difference is lack of one leaf node in non-working one as below.

For Non-working one:
designated => identifier "com.test.sample" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ABCD1234XYZ

For working one:
$ designated => anchor apple generic and identifier "com.test.sample" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ABCD1234XYZ)

Code sign command in script:

Code Block cp "<path>/MacDistribution_NetworkExtension.provisionprofile" "$TARGET_BUILD_DIR/$WRAPPER_NAME/Contents/embedded.provisionprofile"
touch "$TARGET_BUILD_DIR/$WRAPPER_NAME"
codesign -vfs "Developer ID Application: Sample Test, Inc. (ABCD1234XYZ)" --entitlements "<path>/SimpleFirewallExtension.entitlements" --timestamp "$TARGET_BUILD_DIR/$WRAPPER_NAME"

Please help me to fix the issue.

Boost

Answer 1

Systems Engineer OP

Apple

Oct ’20

The leaf certificate appears to be there in both designated identifiers, but some how they are identified in the chain differently. If you are able to, try moving your script out of the Build Phases in Xcode and try signing from an external script. Does that produce any tangible results here? Take a look at the article Quinn wrote on this topic for Signing a Mac Product For Distribution and also Notarizing macOS Software Before Distribution.. Lastly, it may be worth testing this on a fresh VM too just to verify that the results on a machine that has never seen your application before.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0