Executing bundled shell command in a hardened runtime application
2
votes
1
answer
421
views
I have written a Java application which I want to distribute in form of a macOS application bundle. The application needs to execute a command line application which is also part of the bundle. The bundle is correctly signed (verified using the codesign command) and the hardened runtime is enabled.
I am able to run the application, but then the application fails to execute the bundled command line application.
The code used to execute the command line application:
Runtime.getRuntime().exec("/path/to/app/bundle/Contents/cli/myCommandLineApplication");
The code works fine when I sign the bundle without enabling the hardened runtime.
Once I enable the hardened runtime, I get the following exception:
> Cannot run program "myCommandLineApplication": error=0, posix_spawn failed
What am I doing wrong? Is it even possible to spawn child processes from within a hardened runtime application?
The Java runtime I am using is AdoptOpenJDK (build 11.0.4+11).
The application is not sandboxed.
The entitlements I used when signing the bundle were
com.apple.security.cs.allow-jit
com.apple.security.cs.allow-unsigned-executable-memory
com.apple.security.cs.disable-executable-page-protection
com.apple.security.cs.disable-library-validation
com.apple.security.cs.allow-dyld-environment-variables
com.apple.security.automation.apple-events
Asked by Oliver Matuschin
(81 rep)
Mar 7, 2020, 08:58 PM
Last activity: Mar 8, 2020, 09:15 AM
Last activity: Mar 8, 2020, 09:15 AM