Code_Signing - heldersrvio/PureDarwin GitHub Wiki
This page is about binary signature.
As of Mac OS X and Darwin, a Mach-O code signature system (similar in concept to Microsoft AuthentiCode for PE binaries on Windows, and Solaris ELF signing) has been implemented. At least on Darwin, this system is not "formally" used, and no binaries are signed.
On Mac OS X, the code signature system forms part of the basis of the "Seatbelt" GPC (Granular Process Control)/RBAC (Role Based Access Control) mechanism (an implementation detail of the Parental Control feature), and most binaries shipped are signed.
There are probably many ways of checking if a binary is signed on Darwin (although some techniques could also be possible on other operating systems), and Mac OS X ships with tools for checking code signatures.
On Darwin, you can quickly check for the presence of a code signature with otool -l /YourBinaryOfChoice | grep LC_CODE_SIGNATURE. You're looking for the "cmd LC_CODE_SIGNATURE" line (regardless of whether or not you decided to grep). Without grepping, output similar to the following is produced:
Load command 13 cmd LC_CODE_SIGNATURE cmdsize 16 dataoff 574704 datasize 7968 The binary used in the example above was (naturally) otool from Mac OS X Leopard.
strings YourBinaryOfChoice | grep "Apple Code Signing Certification Authority" or
The Apple object file utility shipped with Mac OS X is signed, in the contrary of the one built from DarwinBuild.
codesign -dvvvv /Volumes/Builds/9F33/BuildRoot/usr/bin/otool /Volumes/Builds/9F33/BuildRoot/usr/bin/otool: code object is not signed
Note: No "impurity" detected at codesign' inspection with otool', so perhaps it could be build with the DarwinBuild project and be available in PureDarwin.
In this example, we will take launchd' process, which also run as an init' replacement.
ps ux -p1 USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND root 1 0.0 0.0 600820 552 ?? Ss 9:46PM 0:00.42 /sbin/launchd
codesign -vvvv 1 1: dynamically valid 1: satisfies its Designated Requirement
Note: The "-h" options seems not (yet) documented but remains functional:
codesign -h 1 /sbin/launchd /mach_kernel
Related fields found in Xcode:
Apple Technical Note TN2206: Mac OS X Code Signing In Depth The Apple Mac OS X 10.5 codesign Manual Page is attached to this page (PDF) Sun Solaris 10 elfsign(1) Manual Page
man codesign man csreq
The goal of this project is to make Darwin more usable by providing an installation ISO, documentation, and add-on software. You are welcome to join #puredarwin on irc.freenode.net or the Gitter chat if you would like to join PureDarwin development and to add to this site.
The Wiki pages were recently moved from Google Sites and in the conversion process some formatting was lost. Please help fixing the markdown of this page by editing it. But please delete nothing, especially not (broken) images; fix them instead (see the main page of the Wiki for an example).