Yannis Juglaret
601d46f680
Running PKCS#11 modules requires specific entitlements on macOS. Now that we have a dedicated process for running these modules, we can make this process run a different executable that has these specific entitlements. Ultimately, this will allow us to remove these entitlements from the firefox binary so that we obtain a more fine-grained privilege separation. For now we only use and make available the new executable in Nightly builds, and we continue to use the firefox executable in other builds. This is because we will only be running the new process in Nightly builds behind a pref for the moment, and we do not want to impact people's application directories and the size of our installers by adding a new executable before this executable is actually required. Based on prior work by Haik Aftandilian and Alexandre Lissy (D243560, D243561). Differential Revision: https://phabricator.services.mozilla.com/D270691
22 lines
788 B
XML
22 lines
788 B
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
|
<!--
|
|
Entitlements to apply to the security-module-helper.app bundle during
|
|
codesigning of developer builds.
|
|
-->
|
|
<plist version="1.0">
|
|
<dict>
|
|
<!-- Allow loading third party pkcs11 libraries -->
|
|
<key>com.apple.security.cs.disable-library-validation</key><true/>
|
|
|
|
<!-- For SmartCardServices(7) -->
|
|
<key>com.apple.security.smartcard</key><true/>
|
|
|
|
<!-- Allow dyld environment variables for debugging -->
|
|
<key>com.apple.security.cs.allow-dyld-environment-variables</key><true/>
|
|
|
|
<!-- Allow debuggers to attach to running executables -->
|
|
<key>com.apple.security.get-task-allow</key><true/>
|
|
</dict>
|
|
</plist>
|