25

Sandboxed apps have to declare their entitlements. Of course, that doesn't do me any good if I can't tell what entitlements it declares. A text editor that has entitlements for Core Location, Network Server, and my Address Book, without my knowledge, could be much worse than an unsandboxed app.

How can I see what entitlements an app has?

29

After some more searching, I found a command-line answer:

codesign -d --entitlements - /Applications/Whatever.app/

This will print out an XML plist with values like:

<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>

If anyone knows an easier/nicer way, though, I'd love to hear it.

  • 1
    Also more documentation about that: developer.apple.com/library/content/documentation/Security/… – JHG May 15 '18 at 9:42
  • On Mojave 10.14.4, the command above prints an extra 8 bytes at the start: fade7171000000fb, making the XML invalid. Any way to avoid that or strip it away? – luckman212 Apr 22 at 15:03
  • codesign -d --entitlements - <filepath> 2>&1 | LANG=C LC_CTYPE=C sed 's/^.*\<\?xml/\<\?xml/g' | grep "<.*>" Maybe there's another solution, but that's how I strip those bytes. But I don't think it's necessary: you can codesign an app by pointing to an entitlements xml, and macOS will ignore those bytes anyway. – JayB May 18 at 6:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .