User doesn't have permission to launch the app (managed networks)

Question

Created Nov ’21

Replies 2

Boosts 0

Participants 2

This is for a non-GUI program -- intended to be a LaunchDaemon at some point; I followed Quinn's instructions for this. As I've commented before, I'm using cmake to generate an xcodeproj (wheeeee), so I wouldn't be surprised if it's doing something wrong.

I get the error if I use open Debug/HelperDaemon.app or try to run it in Xcode. That doesn't quite surprise me a lot (again, not a GUI app), and Xcode says there may be a problem with signing. If I run it via the command line (that is, ./Debu/HelperDaemon.app/Contents/MacOS/HelperDaemon), it is immediately killed. I haven't been able to find much in the logs.

What I have noted is that if I do codesign --force --deep --sign - ./Debug/HelperDaemon.app, it then does work (although then I run into other crashes). However, doing codesign -vv Debug/HelperDaemon.app, it says everything is fine. (codesign -dv --entitlements :- Debug/HelperDaemon.app shows the entitlements I expect, as well.)

This is on macOS; I'm building on and for 11.6, using Xcode 13.1.

For the program's entitlements, I've got com.apple.developer.system-extension.install, keychain-access-groups, and com.apple.security.application-groups (although I tried removing that one, with no difference in behaviour).

Boost

Answer 1

DTS Engineer OP

Apple

Nov ’21

I’m not why of my instructions you’re referring to, but there’s two likely candidates:

Signing a Daemon with a Restricted Entitlement explains the general process for using restricted entitlements in a daemon.
Signing a Mac Product For Distribution explains the general process for signing Mac products from the command line. Keys points from that doc are:
- If the code is bundled, sign the bundle, not the executable.
- Embed the provisioning profile before signing.

Also, make sure that all the entitlements you use are allowlisted by the provisioning, per What exactly is a provisioning profile?.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

kithrup OP

Nov ’21

I was referring to "Signing a Daemon with a Restricted Entitlement." The bundle is signed. I'll go over your article again; I've confirmed it's the entitlements it doesn't like. (It turns out I don't currently need the entitlements yet -- but the plan is to use Endpoint Security in it eventually, I just don't have that permission yet.)

0