Re: Code Signing Examples
Re: Code Signing Examples
- Subject: Re: Code Signing Examples
- From: Chris Suter <email@hidden>
- Date: Sat, 21 Feb 2009 08:52:01 +1100
Hi Tom,
(Sorry Tom for the duplicate—I meant to send this to the list earlier.
Also, cross posting is generally frowned upon and the best list for
code signing questions is the apple-cdsa list.)
On Sat, Feb 21, 2009 at 1:47 AM, Tom Fortmann
<email@hidden> wrote:
> Can anyone point me to sample code on how to verify an application or
> process is signed? My application executes a couple other processes and I
> would like to validate their signatures before I blindly execute them. I've
> found a ton of Apple documentation on the theory but not a lot on practical
> application within my code. I've also looked at simply running the codesign
> utility and parsing its XML output, but this seems like a weak design. What
> is codesign gets replaced?
That's what you're supposed to do; you run codesign. They might expose
different APIs with Snow Leopard and later releases but at this time,
codesign is the only one you can rely on.
If codesign gets replaced it means someone has root privileges which
means it's game over anyway so don't worry about that. You do realise
that if you're worried about others tampering with your binaries, it's
a difficult problem to solve. You'd need to make sure that the system
wasn't compromised at time of installation (otherwise a hacker can
just modify your installation and remove the codesign checks) and make
sure that all your files are installed somewhere with restricted
permisions (otherwise your codesign checks can be removed), but if
you've done that you don't need to run codesign since your files have
restricted permissions and the only way to modify them would be if you
had root permissions (which is game over).
So, if I were you, I wouldn't bother. That's not what code signing is
for at this point in time although that may change with future OS
updates.
Kind regards,
Chris
_______________________________________________
Cocoa-dev mailing list (email@hidden)
Please do not post admin requests or moderator comments to the list.
Contact the moderators at cocoa-dev-admins(at)lists.apple.com
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden