Entitlement Hardened Runtime Exception

ID

swift.entitlement_hardened_runtime_exception

Severity

low

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

medium

Resource

Misconfiguration

Language

Swift

Tags

ASVS50:v16.4.1, CWE:693, MASVS:MSTG-CODE-9

Description

The macOS Hardened Runtime imposes runtime protections that, among other things, prevent unsigned executable memory pages, disallow dynamic library injection, and require shared-library validation. Each of the following entitlements opts the process out of one of those guarantees:

  • com.apple.security.cs.allow-jit — allows mmap with MAP_JIT, required for JavaScriptCore-style JIT and similar runtimes.

  • com.apple.security.cs.disable-library-validation — lets the process load libraries signed by any team ID, not just the binary’s own.

  • com.apple.security.cs.allow-unsigned-executable-memory — allows mprotect to turn a writable page executable.

<key>com.apple.security.cs.allow-jit</key>  <!-- FLAW -->
<true/>

Rationale

Each opt-out is legitimate for specific applications (browser JS engines, plugin hosts, scripting runtimes) but should always be a conscious decision — the rule fires at low severity to signal "this needs review", not "this is a defect".

Remediation

Remove the entitlement when the runtime does not actually need it. When the opt-out is required for a legitimate use case (Electron-style hosts, embedded WebKit, dynamic plugin loaders), document the reason inline and consider scoping it to the smallest possible host process.

References