Skip to content

Commit da6fca4

Browse files
Ben TaylorPaul Hohensee
Ben Taylor
authored and
Paul Hohensee
committed
8293550: Optionally add get-task-allow entitlement to macos binaries
Backport-of: f42caefe2e7658bfb5ab8ef938b134bdb6746ff1
1 parent 85a655b commit da6fca4

File tree

10 files changed

+200
-51
lines changed

10 files changed

+200
-51
lines changed

‎doc/building.html

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,9 @@ <h1 class="title">Building the JDK</h1>
7070
<li><a href="#make-control-variables">Make Control Variables</a></li>
7171
</ul></li>
7272
<li><a href="#running-tests">Running Tests</a></li>
73+
<li><a href="#signing">Signing</a><ul>
74+
<li><a href="#macos-1">macOS</a></li>
75+
</ul></li>
7376
<li><a href="#cross-compiling">Cross-compiling</a><ul>
7477
<li><a href="#cross-compiling-the-easy-way-with-openjdk-devkits">Cross compiling the easy way with OpenJDK devkits</a></li>
7578
<li><a href="#boot-jdk-and-build-jdk">Boot JDK and Build JDK</a></li>
@@ -515,6 +518,12 @@ <h2 id="running-tests">Running Tests</h2>
515518
<p>To execute the most basic tests (tier 1), use:</p>
516519
<pre><code>make run-test-tier1</code></pre>
517520
<p>For more details on how to run tests, please see <strong>Testing the JDK</strong> (<a href="testing.html">html</a>, <a href="testing.md">markdown</a>).</p>
521+
<h2 id="signing">Signing</h2>
522+
<h3 id="macos-1">macOS</h3>
523+
<p>Modern versions of macOS require applications to be signed and notarizied before distribution. See Apple's documentation for more background on what this means and how it works. To help support this, the JDK build can be configured to automatically sign all native binaries, and the JDK bundle, with all the options needed for successful notarization, as well as all the entitlements required by the JDK. To enable <code>hardened</code> signing, use configure parameter <code>--with-macosx-codesign=hardened</code> and configure the signing identity you wish to use with <code>--with-macosx-codesign-identity=&lt;identity&gt;</code>. The identity refers to a signing identity from Apple that needs to be preinstalled on the build host.</p>
524+
<p>When not signing for distribution with the hardened option, the JDK build will still attempt to perform <code>adhoc</code> signing to add the special entitlement <code>com.apple.security.get-task-allow</code> to each binary. This entitlement is required to be able to dump core files from a process. Note that adding this entitlement makes the build invalid for notarization, so it is only added when signing in <code>debug</code> mode. To explicitly enable this kind of adhoc signing, use configure parameter <code>--with-macosx-codesign=debug</code>. It will be enabled by default in most cases.</p>
525+
<p>It's also possible to completely disable any explicit codesign operations done by the JDK build using the configure parameter <code>--without-macosx-codesign</code>. The exact behavior then depends on the architecture. For macOS on x64, it (at least at the time of this writing) results in completely unsigned binaries that should still work fine for development and debugging purposes. On aarch64, the Xcode linker will apply a default &quot;adhoc&quot; signing, without any entitlements. Such a build does not allow dumping core files.</p>
526+
<p>The default mode &quot;auto&quot; will try for <code>hardened</code> signing if the debug level is <code>release</code> and either the default identity or the specified identity is valid. If hardened isn't possible, then <code>debug</code> signing is chosen if it works. If nothing works, the codesign build step is disabled.</p>
518527
<h2 id="cross-compiling">Cross-compiling</h2>
519528
<p>Cross-compiling means using one platform (the <em>build</em> platform) to generate output that can ran on another platform (the <em>target</em> platform).</p>
520529
<p>The typical reason for cross-compiling is that the build is performed on a more powerful desktop computer, but the resulting binaries will be able to run on a different, typically low-performing system. Most of the complications that arise when building for embedded is due to this separation of <em>build</em> and <em>target</em> systems.</p>

‎doc/building.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -868,6 +868,42 @@ make run-test-tier1
868868
For more details on how to run tests, please see **Testing the JDK**
869869
([html](testing.html), [markdown](testing.md)).
870870
871+
## Signing
872+
873+
### macOS
874+
875+
Modern versions of macOS require applications to be signed and notarizied before
876+
distribution. See Apple's documentation for more background on what this means
877+
and how it works. To help support this, the JDK build can be configured to
878+
automatically sign all native binaries, and the JDK bundle, with all the options
879+
needed for successful notarization, as well as all the entitlements required by
880+
the JDK. To enable `hardened` signing, use configure parameter
881+
`--with-macosx-codesign=hardened` and configure the signing identity you wish to
882+
use with `--with-macosx-codesign-identity=<identity>`. The identity refers to a
883+
signing identity from Apple that needs to be preinstalled on the build host.
884+
885+
When not signing for distribution with the hardened option, the JDK build will
886+
still attempt to perform `adhoc` signing to add the special entitlement
887+
`com.apple.security.get-task-allow` to each binary. This entitlement is required
888+
to be able to dump core files from a process. Note that adding this entitlement
889+
makes the build invalid for notarization, so it is only added when signing in
890+
`debug` mode. To explicitly enable this kind of adhoc signing, use configure
891+
parameter `--with-macosx-codesign=debug`. It will be enabled by default in most
892+
cases.
893+
894+
It's also possible to completely disable any explicit codesign operations done
895+
by the JDK build using the configure parameter `--without-macosx-codesign`.
896+
The exact behavior then depends on the architecture. For macOS on x64, it (at
897+
least at the time of this writing) results in completely unsigned binaries that
898+
should still work fine for development and debugging purposes. On aarch64, the
899+
Xcode linker will apply a default "adhoc" signing, without any entitlements.
900+
Such a build does not allow dumping core files.
901+
902+
The default mode "auto" will try for `hardened` signing if the debug level is
903+
`release` and either the default identity or the specified identity is valid.
904+
If hardened isn't possible, then `debug` signing is chosen if it works. If
905+
nothing works, the codesign build step is disabled.
906+
871907
## Cross-compiling
872908
873909
Cross-compiling means using one platform (the *build* platform) to generate

‎make/Bundles.gmk

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -278,16 +278,7 @@ ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), )
278278
$(SYMBOLS_EXCLUDE_PATTERN), \
279279
$(ALL_JRE_FILES))
280280

281-
# On Macosx release builds, when there is a code signing certificate available,
282-
# the final bundle layout can be signed.
283-
SIGN_BUNDLE := false
284-
ifeq ($(call isTargetOs, macosx)+$(DEBUG_LEVEL), true+release)
285-
ifneq ($(CODESIGN), )
286-
SIGN_BUNDLE := true
287-
endif
288-
endif
289-
290-
ifeq ($(SIGN_BUNDLE), true)
281+
ifeq ($(MACOSX_CODESIGN_MODE), hardened)
291282
# Macosx release build and code signing available.
292283

293284
################################################################################

‎make/autoconf/basic_tools.m4

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -376,41 +376,6 @@ AC_DEFUN_ONCE([BASIC_SETUP_COMPLEX_TOOLS],
376376
UTIL_REQUIRE_PROGS(MIG, mig)
377377
UTIL_REQUIRE_PROGS(XATTR, xattr)
378378
UTIL_LOOKUP_PROGS(CODESIGN, codesign)
379-
380-
# Check for user provided code signing identity.
381-
UTIL_ARG_WITH(NAME: macosx-codesign-identity, TYPE: string,
382-
DEFAULT: openjdk_codesign, CHECK_VALUE: UTIL_CHECK_STRING_NON_EMPTY,
383-
DESC: [specify the macosx code signing identity],
384-
CHECKING_MSG: [for macosx code signing identity]
385-
)
386-
AC_SUBST(MACOSX_CODESIGN_IDENTITY)
387-
388-
if test "x$CODESIGN" != "x"; then
389-
# Verify that the codesign certificate is present
390-
AC_MSG_CHECKING([if codesign certificate is present])
391-
$RM codesign-testfile
392-
$TOUCH codesign-testfile
393-
$CODESIGN -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile 2>&AS_MESSAGE_LOG_FD \
394-
>&AS_MESSAGE_LOG_FD || CODESIGN=
395-
$RM codesign-testfile
396-
if test "x$CODESIGN" = x; then
397-
AC_MSG_RESULT([no])
398-
else
399-
AC_MSG_RESULT([yes])
400-
# Verify that the codesign has --option runtime
401-
AC_MSG_CHECKING([if codesign has --option runtime])
402-
$RM codesign-testfile
403-
$TOUCH codesign-testfile
404-
$CODESIGN --option runtime -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile \
405-
2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD || CODESIGN=
406-
$RM codesign-testfile
407-
if test "x$CODESIGN" = x; then
408-
AC_MSG_ERROR([codesign does not have --option runtime. macOS 10.13.6 and above is required.])
409-
else
410-
AC_MSG_RESULT([yes])
411-
fi
412-
fi
413-
fi
414379
UTIL_REQUIRE_PROGS(SETFILE, SetFile)
415380
fi
416381
if ! test "x$OPENJDK_TARGET_OS" = "xwindows"; then

‎make/autoconf/configure.ac

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,7 @@ JDKOPT_EXCLUDE_TRANSLATIONS
249249
JDKOPT_ENABLE_DISABLE_MANPAGES
250250
JDKOPT_ENABLE_DISABLE_CDS_ARCHIVE
251251
JDKOPT_ENABLE_DISABLE_COMPATIBLE_CDS_ALIGNMENT
252+
JDKOPT_SETUP_MACOSX_SIGNING
252253

253254
###############################################################################
254255
#

‎make/autoconf/jdk-options.m4

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -727,3 +727,105 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_REPRODUCIBLE_BUILD],
727727
AC_SUBST(SOURCE_DATE)
728728
AC_SUBST(ENABLE_REPRODUCIBLE_BUILD)
729729
])
730+
731+
################################################################################
732+
#
733+
# Setup signing on macOS. This can either be setup to sign with a real identity
734+
# and enabling the hardened runtime, or it can simply add the debug entitlement
735+
# com.apple.security.get-task-allow without actually signing any binaries. The
736+
# latter is needed to be able to debug processes and dump core files on modern
737+
# versions of macOS. It can also be skipped completely.
738+
#
739+
# Check if codesign will run with the given parameters
740+
# $1: Parameters to run with
741+
# $2: Checking message
742+
# Sets CODESIGN_SUCCESS=true/false
743+
AC_DEFUN([JDKOPT_CHECK_CODESIGN_PARAMS],
744+
[
745+
PARAMS="$1"
746+
MESSAGE="$2"
747+
CODESIGN_TESTFILE="$CONFIGURESUPPORT_OUTPUTDIR/codesign-testfile"
748+
$RM "$CODESIGN_TESTFILE"
749+
$TOUCH "$CODESIGN_TESTFILE"
750+
CODESIGN_SUCCESS=false
751+
$CODESIGN $PARAMS "$CODESIGN_TESTFILE" 2>&AS_MESSAGE_LOG_FD \
752+
>&AS_MESSAGE_LOG_FD && CODESIGN_SUCCESS=true
753+
$RM "$CODESIGN_TESTFILE"
754+
AC_MSG_CHECKING([$MESSAGE])
755+
if test "x$CODESIGN_SUCCESS" = "xtrue"; then
756+
AC_MSG_RESULT([yes])
757+
else
758+
AC_MSG_RESULT([no])
759+
fi
760+
])
761+
762+
AC_DEFUN([JDKOPT_CHECK_CODESIGN_HARDENED],
763+
[
764+
JDKOPT_CHECK_CODESIGN_PARAMS([-s "$MACOSX_CODESIGN_IDENTITY" --option runtime],
765+
[if codesign with hardened runtime is possible])
766+
])
767+
768+
AC_DEFUN([JDKOPT_CHECK_CODESIGN_DEBUG],
769+
[
770+
JDKOPT_CHECK_CODESIGN_PARAMS([-s -], [if debug mode codesign is possible])
771+
])
772+
773+
AC_DEFUN([JDKOPT_SETUP_MACOSX_SIGNING],
774+
[
775+
ENABLE_CODESIGN=false
776+
if test "x$OPENJDK_TARGET_OS" = "xmacosx" && test "x$CODESIGN" != "x"; then
777+
778+
UTIL_ARG_WITH(NAME: macosx-codesign, TYPE: literal, OPTIONAL: true,
779+
VALID_VALUES: [hardened debug auto], DEFAULT: auto,
780+
ENABLED_DEFAULT: true,
781+
CHECKING_MSG: [for macosx code signing mode],
782+
DESC: [set the macosx code signing mode (hardened, debug, auto)]
783+
)
784+
785+
MACOSX_CODESIGN_MODE=disabled
786+
if test "x$MACOSX_CODESIGN_ENABLED" = "xtrue"; then
787+
788+
# Check for user provided code signing identity.
789+
UTIL_ARG_WITH(NAME: macosx-codesign-identity, TYPE: string,
790+
DEFAULT: openjdk_codesign, CHECK_VALUE: UTIL_CHECK_STRING_NON_EMPTY,
791+
DESC: [specify the macosx code signing identity],
792+
CHECKING_MSG: [for macosx code signing identity]
793+
)
794+
AC_SUBST(MACOSX_CODESIGN_IDENTITY)
795+
796+
if test "x$MACOSX_CODESIGN" = "xauto"; then
797+
# Only try to default to hardened signing on release builds
798+
if test "x$DEBUG_LEVEL" = "xrelease"; then
799+
JDKOPT_CHECK_CODESIGN_HARDENED
800+
if test "x$CODESIGN_SUCCESS" = "xtrue"; then
801+
MACOSX_CODESIGN_MODE=hardened
802+
fi
803+
fi
804+
if test "x$MACOSX_CODESIGN_MODE" = "xdisabled"; then
805+
JDKOPT_CHECK_CODESIGN_DEBUG
806+
if test "x$CODESIGN_SUCCESS" = "xtrue"; then
807+
MACOSX_CODESIGN_MODE=debug
808+
fi
809+
fi
810+
AC_MSG_CHECKING([for macosx code signing mode])
811+
AC_MSG_RESULT([$MACOSX_CODESIGN_MODE])
812+
elif test "x$MACOSX_CODESIGN" = "xhardened"; then
813+
JDKOPT_CHECK_CODESIGN_HARDENED
814+
if test "x$CODESIGN_SUCCESS" = "xfalse"; then
815+
AC_MSG_ERROR([Signing with hardened runtime is not possible])
816+
fi
817+
MACOSX_CODESIGN_MODE=hardened
818+
elif test "x$MACOSX_CODESIGN" = "xdebug"; then
819+
JDKOPT_CHECK_CODESIGN_DEBUG
820+
if test "x$CODESIGN_SUCCESS" = "xfalse"; then
821+
AC_MSG_ERROR([Signing in debug mode is not possible])
822+
fi
823+
MACOSX_CODESIGN_MODE=debug
824+
else
825+
AC_MSG_ERROR([unknown value for --with-macosx-codesign: $MACOSX_CODESIGN])
826+
fi
827+
fi
828+
AC_SUBST(MACOSX_CODESIGN_IDENTITY)
829+
AC_SUBST(MACOSX_CODESIGN_MODE)
830+
fi
831+
])

‎make/autoconf/spec.gmk.in

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -443,7 +443,8 @@ MACOSX_VERSION_MIN=@MACOSX_VERSION_MIN@
443443
# The highest allowed version of macosx
444444
MACOSX_VERSION_MAX=@MACOSX_VERSION_MAX@
445445

446-
# The macosx code signing identity to use
446+
# The macosx code signing configuration
447+
MACOSX_CODESIGN_MODE:=@MACOSX_CODESIGN_MODE@
447448
MACOSX_CODESIGN_IDENTITY=@MACOSX_CODESIGN_IDENTITY@
448449

449450
# Toolchain type: gcc, clang, xlc, microsoft...

‎make/common/NativeCompilation.gmk

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -267,10 +267,15 @@ endif
267267
# specialized file is found, returns the default file.
268268
# $1 Executable to find entitlements file for.
269269
ENTITLEMENTS_DIR := $(TOPDIR)/make/data/macosxsigning
270-
DEFAULT_ENTITLEMENTS_FILE := $(ENTITLEMENTS_DIR)/default.plist
270+
ifeq ($(MACOSX_CODESIGN_MODE), debug)
271+
CODESIGN_PLIST_SUFFIX := -debug
272+
else
273+
CODESIGN_PLIST_SUFFIX :=
274+
endif
275+
DEFAULT_ENTITLEMENTS_FILE := $(ENTITLEMENTS_DIR)/default$(CODESIGN_PLIST_SUFFIX).plist
271276

272277
GetEntitlementsFile = \
273-
$(foreach f, $(ENTITLEMENTS_DIR)/$(strip $(notdir $1)).plist, \
278+
$(foreach f, $(ENTITLEMENTS_DIR)/$(strip $(notdir $1))$(CODESIGN_PLIST_SUFFIX).plist, \
274279
$(if $(wildcard $f), $f, $(DEFAULT_ENTITLEMENTS_FILE)) \
275280
)
276281

@@ -1206,11 +1211,12 @@ define SetupNativeCompilationBody
12061211
$$($1_MT) -nologo -manifest $$($1_MANIFEST) -identity:"$$($1_NAME).exe, version=$$($1_MANIFEST_VERSION)" -outputresource:$$@;#1
12071212
endif
12081213
endif
1209-
# This only works if the openjdk_codesign identity is present on the system. Let
1210-
# silently fail otherwise.
1211-
ifneq ($(CODESIGN), )
1214+
# On macosx, optionally run codesign on every binary
1215+
ifeq ($(MACOSX_CODESIGN_MODE), hardened)
12121216
$(CODESIGN) -f -s "$(MACOSX_CODESIGN_IDENTITY)" --timestamp --options runtime \
12131217
--entitlements $$(call GetEntitlementsFile, $$@) $$@
1218+
else ifeq ($(MACOSX_CODESIGN_MODE), debug)
1219+
$(CODESIGN) -f -s - --entitlements $$(call GetEntitlementsFile, $$@) $$@
12141220
endif
12151221
endif
12161222

‎make/data/macosxsigning/default-debug.plist

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-jit</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-library-validation</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
12+
<true/>
13+
<key>com.apple.security.cs.debugger</key>
14+
<true/>
15+
<key>com.apple.security.get-task-allow</key>
16+
<true/>
17+
</dict>
18+
</plist>

‎make/data/macosxsigning/java-debug.plist

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>com.apple.security.cs.allow-jit</key>
6+
<true/>
7+
<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
8+
<true/>
9+
<key>com.apple.security.cs.disable-library-validation</key>
10+
<true/>
11+
<key>com.apple.security.cs.allow-dyld-environment-variables</key>
12+
<true/>
13+
<key>com.apple.security.cs.debugger</key>
14+
<true/>
15+
<key>com.apple.security.device.audio-input</key>
16+
<true/>
17+
<key>com.apple.security.get-task-allow</key>
18+
<true/>
19+
</dict>
20+
</plist>

0 commit comments

Comments
 (0)