Sample Header Ad - 728x90

Executing bundled shell command in a hardened runtime application

2 votes
1 answer
421 views
I have written a Java application which I want to distribute in form of a macOS application bundle. The application needs to execute a command line application which is also part of the bundle. The bundle is correctly signed (verified using the codesign command) and the hardened runtime is enabled. I am able to run the application, but then the application fails to execute the bundled command line application. The code used to execute the command line application:
Runtime.getRuntime().exec("/path/to/app/bundle/Contents/cli/myCommandLineApplication");
The code works fine when I sign the bundle without enabling the hardened runtime. Once I enable the hardened runtime, I get the following exception: > Cannot run program "myCommandLineApplication": error=0, posix_spawn failed What am I doing wrong? Is it even possible to spawn child processes from within a hardened runtime application? The Java runtime I am using is AdoptOpenJDK (build 11.0.4+11). The application is not sandboxed. The entitlements I used when signing the bundle were
com.apple.security.cs.allow-jit

com.apple.security.cs.allow-unsigned-executable-memory

com.apple.security.cs.disable-executable-page-protection

com.apple.security.cs.disable-library-validation

com.apple.security.cs.allow-dyld-environment-variables

com.apple.security.automation.apple-events
Asked by Oliver Matuschin (81 rep)
Mar 7, 2020, 08:58 PM
Last activity: Mar 8, 2020, 09:15 AM