I want to manually create, delete, and restored to snapshots on my APFS volumes (external, for data use, so not limited by SIP). I'm using snaputil, but maintaining APFS snapshots require two entitlements:
com.apple.private.apfs.revert-to-snapshot. However, I neither have access to nor intend to enroll (buy) in Apple's developer program, which grants permission to use these entitlements.
On my old Intel MacBook, I was able to sign it ad-hoc with these two entitlements and disable AMFI to run the program. On my new M1 MacBook, I don't want to degrade the security, so I want to search for another solution. I find this article explaining how to sign
gdb with the permission to debug other programs (create and trust your own signing certificate, then use it to sign
gdb), but using the same steps (replacing
com.apple.developer.vfs.snapshot) failed (get
SIGKILL immediately) with these messages in Console:
ERROR 21:05:32.777057+0800 taskgated-helper Disallowing snaputil because no eligible provisioning profiles found DEFAULT 21:05:32.777558+0800 kernel mac_vnode_check_signature: /Volumes/Data/snaputil: code signature validation failed fatally: When validating /Volumes/Data/snaputil: Code has restricted entitlements, but the validation of its code signature failed. Unsatisfied Entitlements: DEFAULT 21:05:32.777568+0800 kernel proc 23718: load code signature error 4 for file "snaputil" DEFAULT 21:05:32.777446+0800 amfid /Volumes/Data/snaputil signature not valid: -67671
What do these error messages mean? Is it impossible to run
snaputil and manage APFS snapshots without paying Apple or degrading the system security?