I want to manually create, delete, and restored to snapshots on my APFS volumes (external, for data use, so not limited by SIP). I'm using snaputil, but maintaining APFS snapshots require two entitlements: com.apple.developer.vfs.snapshot and com.apple.private.apfs.revert-to-snapshot. However, I neither have access to nor intend to enroll (buy) in Apple's developer program, which grants permission to use these entitlements.

On my old Intel MacBook, I was able to sign it ad-hoc with these two entitlements and disable AMFI to run the program. On my new M1 MacBook, I don't want to degrade the security, so I want to search for another solution. I find this article explaining how to sign gdb with the permission to debug other programs (create and trust your own signing certificate, then use it to sign gdb), but using the same steps (replacing com.apple.security.cs.debugger with com.apple.developer.vfs.snapshot) failed (get SIGKILL immediately) with these messages in Console:

ERROR   21:05:32.777057+0800    taskgated-helper    Disallowing snaputil because no eligible provisioning profiles found
DEFAULT 21:05:32.777558+0800    kernel  mac_vnode_check_signature: /Volumes/Data/snaputil: code signature validation failed fatally: When validating /Volumes/Data/snaputil:
  Code has restricted entitlements, but the validation of its code signature failed.
Unsatisfied Entitlements:
DEFAULT 21:05:32.777568+0800    kernel  proc 23718: load code signature error 4 for file "snaputil"
DEFAULT 21:05:32.777446+0800    amfid   /Volumes/Data/snaputil signature not valid: -67671

What do these error messages mean? Is it impossible to run snaputil and manage APFS snapshots without paying Apple or degrading the system security?


You must log in to answer this question.

Browse other questions tagged .