2

I want to manually create, delete, and restored to snapshots on my APFS volumes (external, for data use, so not limited by SIP). I'm using snaputil, but maintaining APFS snapshots require two entitlements: com.apple.developer.vfs.snapshot and com.apple.private.apfs.revert-to-snapshot. However, I neither have access to nor intend to enroll (buy) in Apple's developer program, which grants permission to use these entitlements.

On my old Intel MacBook, I was able to sign it ad-hoc with these two entitlements and disable AMFI to run the program. On my new M1 MacBook, I don't want to degrade the security, so I want to search for another solution. I find this article explaining how to sign gdb with the permission to debug other programs (create and trust your own signing certificate, then use it to sign gdb), but using the same steps (replacing com.apple.security.cs.debugger with com.apple.developer.vfs.snapshot) failed (get SIGKILL immediately) with these messages in Console:

ERROR   21:05:32.777057+0800    taskgated-helper    Disallowing snaputil because no eligible provisioning profiles found
DEFAULT 21:05:32.777558+0800    kernel  mac_vnode_check_signature: /Volumes/Data/snaputil: code signature validation failed fatally: When validating /Volumes/Data/snaputil:
  Code has restricted entitlements, but the validation of its code signature failed.
Unsatisfied Entitlements:
DEFAULT 21:05:32.777568+0800    kernel  proc 23718: load code signature error 4 for file "snaputil"
DEFAULT 21:05:32.777446+0800    amfid   /Volumes/Data/snaputil signature not valid: -67671

What do these error messages mean? Is it impossible to run snaputil and manage APFS snapshots without paying Apple or degrading the system security?

Improve this question
3
  • 2
    What the heck; why is this hard? We've been spoiled by ZFS.
    – David Braun
    Commented Feb 14, 2023 at 3:57
  • 2
    @DavidBraun Exactly. I should be able to manage APFS snapshots as an admin user without being an Apple "approved" developer or degrading system security.
    – Joy Jin
    Commented Feb 14, 2023 at 22:07
  • Anyone ever figure out a way around this?
    – hornairs
    Commented Oct 30, 2023 at 18:24

1 Answer 1

Reset to default
0

I'm afraid there is no solution as of 2024 too. There was a workaround using AMFIExemption kext injection with extra tools, but it's been working only for Intel Macs and doesn't support ARM as per discussions I found across the internet.

Furthermore, Apple is protecting access to snapshots so insanely that you even won't get all needed entitlements with a developer's program purchase. It seems there is no official way to get them for a wide audience. Here is the quote of Apple's engineer comment from the Apple Developers Forum:

The entitlement (he refers to com.apple.developer.vfs.snapshot) is a special entitlement that Apple that developers can request by contacting DTS. Note that it's currently only being granted to backup application developers and only after very close review.

Also, he added:

For special entitlements like this one, Apple must specifically grant you the ability to add the entitlement to your provisioning profile.

Original forum thread and Web Archive.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .