mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-08 15:59:55 +00:00
Check for Library Validation #309
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @robertgendler on GitHub.
Library Validation. This protection checks if an app's libraries are signed by Apple or the creator. Until very recently, macOS apps could load code freely from foreign sources called code libraries. With macOS 10.15, apps are no longer allowed to load libraries that weren't originally packaged with it, unless they explicitly allow it.
defaults write /Library/Preferences/com.apple.security.libraryvalidation.plist DisableLibraryValidation -bool false@robertgendler commented on GitHub:
It seems at least in part SIP and enabling the hardened Runtime requirement as part of the notarization process for apps maybe makes this setting useless and and with gatekeeper being set to identified developers it will put up a warning that the library can't be opened. Though non notarized apps as well as apps with the
com.apple.security.cs.disable-library-validationentitlement may still be able to load malicious libraries. Not to mention AMFI is still checking the signatures of every app that is run.https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-library-validation
Using the dylib in this article https://jon-gabilondo-angulo-7635.medium.com/how-to-inject-code-into-mach-o-apps-part-ii-ddb13ebc8191
Disabling library validation key and trying to inject code using the dylib results in immediate crash due to invalid code signature.
Tried a whole lot and haven't gotten very far due to multiple levels of protection in macOS.
@robertgendler commented on GitHub:
Not really a useful check.
@robertgendler commented on GitHub:
800-53 R5 SI-7(1), SI-3