Skip to content

Commit f42caef

Browse files
erikj79erikj79
committed
8293550: Optionally add get-task-allow entitlement to macos binaries
Reviewed-by: mikael, cjplummer, ihse
1 parent 5feca68 commit f42caef

File tree

10 files changed

+200
-51
lines changed

10 files changed

+200
-51
lines changed

‎doc/building.html

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,9 @@ <h1 class="title">Building the JDK</h1>
7070
<li><a href="#make-control-variables">Make Control Variables</a></li>
7171
</ul></li>
7272
<li><a href="#running-tests">Running Tests</a></li>
73+
<li><a href="#signing">Signing</a><ul>
74+
<li><a href="#macos-1">macOS</a></li>
75+
</ul></li>
7376
<li><a href="#cross-compiling">Cross-compiling</a><ul>
7477
<li><a href="#cross-compiling-the-easy-way-with-openjdk-devkits">Cross compiling the easy way with OpenJDK devkits</a></li>
7578
<li><a href="#boot-jdk-and-build-jdk">Boot JDK and Build JDK</a></li>
@@ -519,6 +522,12 @@ <h2 id="running-tests">Running Tests</h2>
519522
<p>To execute the most basic tests (tier 1), use:</p>
520523
<pre><code>make run-test-tier1</code></pre>
521524
<p>For more details on how to run tests, please see <strong>Testing the JDK</strong> (<a href="testing.html">html</a>, <a href="testing.md">markdown</a>).</p>
525+
<h2 id="signing">Signing</h2>
526+
<h3 id="macos-1">macOS</h3>
527+
<p>Modern versions of macOS require applications to be signed and notarizied before distribution. See Apple's documentation for more background on what this means and how it works. To help support this, the JDK build can be configured to automatically sign all native binaries, and the JDK bundle, with all the options needed for successful notarization, as well as all the entitlements required by the JDK. To enable <code>hardened</code> signing, use configure parameter <code>--with-macosx-codesign=hardened</code> and configure the signing identity you wish to use with <code>--with-macosx-codesign-identity=&lt;identity&gt;</code>. The identity refers to a signing identity from Apple that needs to be preinstalled on the build host.</p>
528+
<p>When not signing for distribution with the hardened option, the JDK build will still attempt to perform <code>adhoc</code> signing to add the special entitlement <code>com.apple.security.get-task-allow</code> to each binary. This entitlement is required to be able to dump core files from a process. Note that adding this entitlement makes the build invalid for notarization, so it is only added when signing in <code>debug</code> mode. To explicitly enable this kind of adhoc signing, use configure parameter <code>--with-macosx-codesign=debug</code>. It will be enabled by default in most cases.</p>
529+
<p>It's also possible to completely disable any explicit codesign operations done by the JDK build using the configure parameter <code>--without-macosx-codesign</code>. The exact behavior then depends on the architecture. For macOS on x64, it (at least at the time of this writing) results in completely unsigned binaries that should still work fine for development and debugging purposes. On aarch64, the Xcode linker will apply a default &quot;adhoc&quot; signing, without any entitlements. Such a build does not allow dumping core files.</p>
530+
<p>The default mode &quot;auto&quot; will try for <code>hardened</code> signing if the debug level is <code>release</code> and either the default identity or the specified identity is valid. If hardened isn't possible, then <code>debug</code> signing is chosen if it works. If nothing works, the codesign build step is disabled.</p>
522531
<h2 id="cross-compiling">Cross-compiling</h2>
523532
<p>Cross-compiling means using one platform (the <em>build</em> platform) to generate output that can ran on another platform (the <em>target</em> platform).</p>
524533
<p>The typical reason for cross-compiling is that the build is performed on a more powerful desktop computer, but the resulting binaries will be able to run on a different, typically low-performing system. Most of the complications that arise when building for embedded is due to this separation of <em>build</em> and <em>target</em> systems.</p>

‎doc/building.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -877,6 +877,42 @@ make run-test-tier1
877877
For more details on how to run tests, please see **Testing the JDK**
878878
([html](testing.html), [markdown](testing.md)).
879879
880+
## Signing
881+
882+
### macOS
883+
884+
Modern versions of macOS require applications to be signed and notarizied before
885+
distribution. See Apple's documentation for more background on what this means
886+
and how it works. To help support this, the JDK build can be configured to
887+
automatically sign all native binaries, and the JDK bundle, with all the options
888+
needed for successful notarization, as well as all the entitlements required by
889+
the JDK. To enable `hardened` signing, use configure parameter
890+
`--with-macosx-codesign=hardened` and configure the signing identity you wish to
891+
use with `--with-macosx-codesign-identity=<identity>`. The identity refers to a
892+
signing identity from Apple that needs to be preinstalled on the build host.
893+
894+
When not signing for distribution with the hardened option, the JDK build will
895+
still attempt to perform `adhoc` signing to add the special entitlement
896+
`com.apple.security.get-task-allow` to each binary. This entitlement is required
897+
to be able to dump core files from a process. Note that adding this entitlement
898+
makes the build invalid for notarization, so it is only added when signing in
899+
`debug` mode. To explicitly enable this kind of adhoc signing, use configure
900+
parameter `--with-macosx-codesign=debug`. It will be enabled by default in most
901+
cases.
902+
903+
It's also possible to completely disable any explicit codesign operations done
904+
by the JDK build using the configure parameter `--without-macosx-codesign`.
905+
The exact behavior then depends on the architecture. For macOS on x64, it (at
906+
least at the time of this writing) results in completely unsigned binaries that
907+
should still work fine for development and debugging purposes. On aarch64, the
908+
Xcode linker will apply a default "adhoc" signing, without any entitlements.
909+
Such a build does not allow dumping core files.
910+
911+
The default mode "auto" will try for `hardened` signing if the debug level is
912+
`release` and either the default identity or the specified identity is valid.
913+
If hardened isn't possible, then `debug` signing is chosen if it works. If
914+
nothing works, the codesign build step is disabled.
915+
880916
## Cross-compiling
881917
882918
Cross-compiling means using one platform (the *build* platform) to generate

‎make/Bundles.gmk

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -278,16 +278,7 @@ ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), )
278278
$(SYMBOLS_EXCLUDE_PATTERN), \
279279
$(ALL_JRE_FILES))
280280

281-
# On Macosx release builds, when there is a code signing certificate available,
282-
# the final bundle layout can be signed.
283-
SIGN_BUNDLE := false
284-
ifeq ($(call isTargetOs, macosx)+$(DEBUG_LEVEL), true+release)
285-
ifneq ($(CODESIGN), )
286-
SIGN_BUNDLE := true
287-
endif
288-
endif
289-
290-
ifeq ($(SIGN_BUNDLE), true)
281+
ifeq ($(MACOSX_CODESIGN_MODE), hardened)
291282
# Macosx release build and code signing available.
292283

293284
################################################################################

‎make/autoconf/basic_tools.m4

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -376,41 +376,6 @@ AC_DEFUN_ONCE([BASIC_SETUP_COMPLEX_TOOLS],
376376
UTIL_REQUIRE_PROGS(MIG, mig)
377377
UTIL_REQUIRE_PROGS(XATTR, xattr)
378378
UTIL_LOOKUP_PROGS(CODESIGN, codesign)
379-
380-
# Check for user provided code signing identity.
381-
UTIL_ARG_WITH(NAME: macosx-codesign-identity, TYPE: string,
382-
DEFAULT: openjdk_codesign, CHECK_VALUE: UTIL_CHECK_STRING_NON_EMPTY,
383-
DESC: [specify the macosx code signing identity],
384-
CHECKING_MSG: [for macosx code signing identity]
385-
)
386-
AC_SUBST(MACOSX_CODESIGN_IDENTITY)
387-
388-
if test "x$CODESIGN" != "x"; then
389-
# Verify that the codesign certificate is present
390-
AC_MSG_CHECKING([if codesign certificate is present])
391-
$RM codesign-testfile
392-
$TOUCH codesign-testfile
393-
$CODESIGN -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile 2>&AS_MESSAGE_LOG_FD \
394-
>&AS_MESSAGE_LOG_FD || CODESIGN=
395-
$RM codesign-testfile
396-
if test "x$CODESIGN" = x; then
397-
AC_MSG_RESULT([no])
398-
else
399-
AC_MSG_RESULT([yes])
400-
# Verify that the codesign has --option runtime
401-
AC_MSG_CHECKING([if codesign has --option runtime])
402-
$RM codesign-testfile
403-
$TOUCH codesign-testfile
404-
$CODESIGN --option runtime -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile \
405-
2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD || CODESIGN=
406-
$RM codesign-testfile
407-
if test "x$CODESIGN" = x; then
408-
AC_MSG_ERROR([codesign does not have --option runtime. macOS 10.13.6 and above is required.])
409-
else
410-
AC_MSG_RESULT([yes])
411-
fi
412-
fi
413-
fi
414379
UTIL_REQUIRE_PROGS(SETFILE, SetFile)
415380
fi
416381
if ! test "x$OPENJDK_TARGET_OS" = "xwindows"; then

‎make/autoconf/configure.ac

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,7 @@ JDKOPT_EXCLUDE_TRANSLATIONS
247247
JDKOPT_ENABLE_DISABLE_MANPAGES
248248
JDKOPT_ENABLE_DISABLE_CDS_ARCHIVE
249249
JDKOPT_ENABLE_DISABLE_COMPATIBLE_CDS_ALIGNMENT
250+
JDKOPT_SETUP_MACOSX_SIGNING
250251

251252
###############################################################################
252253
#

‎make/autoconf/jdk-options.m4

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -696,3 +696,105 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_REPRODUCIBLE_BUILD],
696696
697697
UTIL_DEPRECATED_ARG_ENABLE(reproducible-build)
698698
])
699+
700+
################################################################################
701+
#
702+
# Setup signing on macOS. This can either be setup to sign with a real identity
703+
# and enabling the hardened runtime, or it can simply add the debug entitlement
704+
# com.apple.security.get-task-allow without actually signing any binaries. The
705+
# latter is needed to be able to debug processes and dump core files on modern
706+
# versions of macOS. It can also be skipped completely.
707+
#
708+
# Check if codesign will run with the given parameters
709+
# $1: Parameters to run with
710+
# $2: Checking message
711+
# Sets CODESIGN_SUCCESS=true/false
712+
AC_DEFUN([JDKOPT_CHECK_CODESIGN_PARAMS],
713+
[
714+
PARAMS="$1"
715+
MESSAGE="$2"
716+
CODESIGN_TESTFILE="$CONFIGURESUPPORT_OUTPUTDIR/codesign-testfile"
717+
$RM "$CODESIGN_TESTFILE"
718+
$TOUCH "$CODESIGN_TESTFILE"
719+
CODESIGN_SUCCESS=false
720+
$CODESIGN $PARAMS "$CODESIGN_TESTFILE" 2>&AS_MESSAGE_LOG_FD \
721+
>&AS_MESSAGE_LOG_FD && CODESIGN_SUCCESS=true
722+
$RM "$CODESIGN_TESTFILE"
723+
AC_MSG_CHECKING([$MESSAGE])
724+
if test "x$CODESIGN_SUCCESS" = "xtrue"; then
725+
AC_MSG_RESULT([yes])
726+
else
727+
AC_MSG_RESULT([no])
728+
fi
729+
])
730+
731+
AC_DEFUN([JDKOPT_CHECK_CODESIGN_HARDENED],
732+
[
733+
JDKOPT_CHECK_CODESIGN_PARAMS([-s "$MACOSX_CODESIGN_IDENTITY" --option runtime],
734+
[if codesign with hardened runtime is possible])
735+
])
736+
737+
AC_DEFUN([JDKOPT_CHECK_CODESIGN_DEBUG],
738+
[
739+
JDKOPT_CHECK_CODESIGN_PARAMS([-s -], [if debug mode codesign is possible])
740+
])
741+
742+
AC_DEFUN([JDKOPT_SETUP_MACOSX_SIGNING],
743+
[
744+
ENABLE_CODESIGN=false
745+
if test "x$OPENJDK_TARGET_OS" = "xmacosx" && test "x$CODESIGN" != "x"; then
746+
747+
UTIL_ARG_WITH(NAME: macosx-codesign, TYPE: literal, OPTIONAL: true,
748+
VALID_VALUES: [hardened debug auto], DEFAULT: auto,
749+
ENABLED_DEFAULT: true,
750+
CHECKING_MSG: [for macosx code signing mode],
751+
DESC: [set the macosx code signing mode (hardened, debug, auto)]
752+
)
753+
754+
MACOSX_CODESIGN_MODE=disabled
755+
if test "x$MACOSX_CODESIGN_ENABLED" = "xtrue"; then
756+
757+
# Check for user provided code signing identity.
758+
UTIL_ARG_WITH(NAME: macosx-codesign-identity, TYPE: string,
759+
DEFAULT: openjdk_codesign, CHECK_VALUE: UTIL_CHECK_STRING_NON_EMPTY,
760+
DESC: [specify the macosx code signing identity],
761+
CHECKING_MSG: [for macosx code signing identity]
762+
)
763+
AC_SUBST(MACOSX_CODESIGN_IDENTITY)
764+
765+
if test "x$MACOSX_CODESIGN" = "xauto"; then
766+
# Only try to default to hardened signing on release builds
767+
if test "x$DEBUG_LEVEL" = "xrelease"; then
768+
JDKOPT_CHECK_CODESIGN_HARDENED
769+
if test "x$CODESIGN_SUCCESS" = "xtrue"; then
770+
MACOSX_CODESIGN_MODE=hardened
771+
fi
772+
fi
773+
if test "x$MACOSX_CODESIGN_MODE" = "xdisabled"; then
774+
JDKOPT_CHECK_CODESIGN_DEBUG
775+
if test "x$CODESIGN_SUCCESS" = "xtrue"; then
776+
MACOSX_CODESIGN_MODE=debug
777+
fi
778+
fi
779+
AC_MSG_CHECKING([for macosx code signing mode])
780+
AC_MSG_RESULT([$MACOSX_CODESIGN_MODE])
781+
elif test "x$MACOSX_CODESIGN" = "xhardened"; then
782+
JDKOPT_CHECK_CODESIGN_HARDENED
783+
if test "x$CODESIGN_SUCCESS" = "xfalse"; then
784+
AC_MSG_ERROR([Signing with hardened runtime is not possible])
785+
fi
786+
MACOSX_CODESIGN_MODE=hardened
787+
elif test "x$MACOSX_CODESIGN" = "xdebug"; then
788+
JDKOPT_CHECK_CODESIGN_DEBUG
789+
if test "x$CODESIGN_SUCCESS" = "xfalse"; then
790+
AC_MSG_ERROR([Signing in debug mode is not possible])
791+
fi
792+
MACOSX_CODESIGN_MODE=debug
793+
else
794+
AC_MSG_ERROR([unknown value for --with-macosx-codesign: $MACOSX_CODESIGN])
795+
fi
796+
fi
797+
AC_SUBST(MACOSX_CODESIGN_IDENTITY)
798+
AC_SUBST(MACOSX_CODESIGN_MODE)
799+
fi
800+
])

‎make/autoconf/spec.gmk.in

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -459,7 +459,8 @@ MACOSX_VERSION_MIN=@MACOSX_VERSION_MIN@
459459
# The highest allowed version of macosx
460460
MACOSX_VERSION_MAX=@MACOSX_VERSION_MAX@
461461

462-
# The macosx code signing identity to use
462+
# The macosx code signing configuration
463+
MACOSX_CODESIGN_MODE:=@MACOSX_CODESIGN_MODE@
463464
MACOSX_CODESIGN_IDENTITY=@MACOSX_CODESIGN_IDENTITY@
464465

465466
# Toolchain type: gcc, clang, xlc, microsoft...

‎make/common/NativeCompilation.gmk

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -267,10 +267,15 @@ endif
267267
# specialized file is found, returns the default file.
268268
# $1 Executable to find entitlements file for.
269269
ENTITLEMENTS_DIR := $(TOPDIR)/make/data/macosxsigning
270-
DEFAULT_ENTITLEMENTS_FILE := $(ENTITLEMENTS_DIR)/default.plist
270+
ifeq ($(MACOSX_CODESIGN_MODE), debug)
271+
CODESIGN_PLIST_SUFFIX := -debug
272+
else
273+
CODESIGN_PLIST_SUFFIX :=
274+
endif
275+
DEFAULT_ENTITLEMENTS_FILE := $(ENTITLEMENTS_DIR)/default$(CODESIGN_PLIST_SUFFIX).plist
271276

272277
GetEntitlementsFile = \
273-
$(foreach f, $(ENTITLEMENTS_DIR)/$(strip $(notdir $1)).plist, \
278+
$(foreach f, $(ENTITLEMENTS_DIR)/$(strip $(notdir $1))$(CODESIGN_PLIST_SUFFIX).plist, \
274279
$(if $(wildcard $f), $f, $(DEFAULT_ENTITLEMENTS_FILE)) \
275280
)
276281

@@ -1204,11 +1209,12 @@ define SetupNativeCompilationBody
12041209
$$($1_MT) -nologo -manifest $$($1_MANIFEST) -identity:"$$($1_NAME).exe, version=$$($1_MANIFEST_VERSION)" -outputresource:$$@;#1
12051210
endif
12061211
endif
1207-
# This only works if the openjdk_codesign identity is present on the system. Let
1208-
# silently fail otherwise.
1209-
ifneq ($(CODESIGN), )
1212+
# On macosx, optionally run codesign on every binary
1213+
ifeq ($(MACOSX_CODESIGN_MODE), hardened)
12101214
$(CODESIGN) -f -s "$(MACOSX_CODESIGN_IDENTITY)" --timestamp --options runtime \
12111215
--entitlements $$(call GetEntitlementsFile, $$@) $$@
1216+
else ifeq ($(MACOSX_CODESIGN_MODE), debug)
1217+
$(CODESIGN) -f -s - --entitlements $$(call GetEntitlementsFile, $$@) $$@
12121218
endif
12131219
endif
12141220

‎make/data/macosxsigning/default-debug.plist

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-jit</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-library-validation</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
12+
<true/>
13+
<key>com.apple.security.cs.debugger</key>
14+
<true/>
15+
<key>com.apple.security.get-task-allow</key>
16+
<true/>
17+
</dict>
18+
</plist>

‎make/data/macosxsigning/java-debug.plist

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-jit</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-library-validation</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
12+
<true/>
13+
<key>com.apple.security.cs.debugger</key>
14+
<true/>
15+
<key>com.apple.security.device.audio-input</key>
16+
<true/>
17+
<key>com.apple.security.get-task-allow</key>
18+
<true/>
19+
</dict>
20+
</plist>

0 commit comments

Comments
 (0)