mirror of
https://github.com/apple/swift.git
synced 2025-12-14 20:36:38 +01:00
[Backtracing] Security improvements.
Use `task_read_for_pid()` rather than having the crashing program pass its own task port through. This opts us in to additional OS security measures surrounding the use of this call. rdar://107362003
This commit is contained in:
@@ -10,7 +10,7 @@ import subprocess
|
||||
import sys
|
||||
|
||||
utils = os.path.dirname(os.path.realpath(__file__))
|
||||
|
||||
get_task_allow_plist = os.path.join(utils, 'get-task-allow.plist')
|
||||
|
||||
def main(arguments):
|
||||
parser = argparse.ArgumentParser(
|
||||
@@ -91,7 +91,9 @@ def unrpathize(filename):
|
||||
|
||||
def codesign(filename):
|
||||
# "-" is the signing identity for ad-hoc signing.
|
||||
command = ["/usr/bin/codesign", "--force", "--sign", "-", filename]
|
||||
command = ['/usr/bin/codesign', '--force', '--sign', '-',
|
||||
'--options=runtime', '--entitlements', get_task_allow_plist,
|
||||
filename]
|
||||
subprocess.check_call(command)
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user