57 lines
2.7 KiB
Markdown
57 lines
2.7 KiB
Markdown
# Entitlements
|
|
|
|
You might to enable this default to use private entitlements
|
|
```
|
|
sudo defaults write /Library/Preferences/com.apple.security.coderequirements Entitlements -string always
|
|
```
|
|
|
|
Maybe a better thing to do is to DYLD_PRELOAD `imagent` and swizzle `IMDAuditTokenTaskHasEntitlement` to always return YES.
|
|
|
|
Included in the project is "kordophoned-RestrictedEntitlements.plist", which contains all necessary restricted entitlements.
|
|
On production macOS builds, the kernel will kill kordophoned immediately if it's signed using restricted entitlements, so agent hook is a
|
|
better option when running on prod machines. By default, the project is configured to ignore kordophoned-RestrictedEntitlements.plist when building.
|
|
|
|
## Building/linking
|
|
If you get dyld errors running from the command line, use `install_name_tool` to update the @rpath (where @rpath points to where linked Frameworks like GCDWebServer is).
|
|
`install_name_tool -add_rpath . ./kordophoned`
|
|
|
|
|
|
## Running
|
|
You need to hook imagent first to bypass entitlements check. Look at `hookAgent.sh`
|
|
|
|
|
|
## SSL
|
|
If you want to run with SSL, you have to generate a self-signed certificate, and have the Mac trust the root cert.
|
|
|
|
### Generate a root cert
|
|
1. Generate root key
|
|
`openssl genrsa -out Kordophone-root.key 4096`
|
|
2. Generate root certificate
|
|
`openssl req -x509 -new -nodes -key Kordophone-root.key -sha256 -days 1024 -out Kordophone-root.crt`
|
|
3. Add this certificate to the Mac's trust store via Keychain Access. Set to "Always Trust"
|
|
|
|
### Create signing certificate by signing a new cert with the root cert
|
|
1. Generate signing key
|
|
`openssl genrsa -out kp.localhost.key 2048`
|
|
2. Create certificate signing request
|
|
`openssl req -new -key kp.localhost.key -out kp.localhost.csr`
|
|
3. Sign the cert with the root cert
|
|
`openssl x509 -req -in kp.localhost.csr -CA Kordophone-root.crt -CAkey Kordophone-root.key -CAcreateserial -out kp.localhost.crt -days 365 -sha256`
|
|
4. kordophoned works with a signing cert in PKCS12 format. Convert the cert and the privkey to PKCS12
|
|
`openssl pkcs12 -export -in kp.localhost.crt -inkey kp.localhost.key -out certificate.p12 -name "Kordophone"`
|
|
|
|
### Start kordophone with the SSL options and provide the p12
|
|
`kordophoned -s -c certificate.p12`
|
|
|
|
## Authentication
|
|
Basic Authentication is also optional, but requires SSL to be enabled as well. To configure basic authentication, create a file containing your username and password on two separate lines encrypted with your GPG key.
|
|
|
|
`echo "username\npassword" > password.txt"`
|
|
`gpg -e -r (your email) -o password.asc password.txt`
|
|
|
|
Then run kordophoned with the following option
|
|
`kordophone -s -c certificate.p12 -a password.asc`
|
|
|
|
You may need to unlock your GPG keyring (via gpg-agent) when running kordophoned the first time.
|
|
|