<@U0F2G55TM> Is there still a way to test Endpoint...
# macosz
zwass
12/19/2024, 5:22 PM
@sharvil Is there still a way to test EndpointSecurity in development? I can't figure out how to add the entitlement in the right way (always getting
EndpointSecurity client lacks entitlementzwass
12/19/2024, 5:40 PM
I already have SIP disabled
s
sharvil
12/19/2024, 5:49 PM@zwass you don’t need SIP disabled — you will have to create and download local development certs from your apple developer account
sharvil
12/19/2024, 5:49 PMThen install those certs, and codesign using them, and change the team id accordingly https://github.com/osquery/osquery/blob/master/tools/deployment/macos_packaging/osquery.entitlements
sharvil
12/19/2024, 5:50 PM Copy code
codesign -s <signing_id_of_local_cert> -f --options runtime --entitlements /path/to/osquery.entitlements -v --timestamp /path/to/osquerydz
zwass
12/19/2024, 5:51 PM
But do I need that entitlement on my account?
s
sharvil
12/19/2024, 5:51 PMYes, you do need entitlement on your account
z
zwass
12/19/2024, 5:51 PM
That's going to be a problem I think
s
sharvil
12/19/2024, 5:52 PMThen you can disable SIP and do an ad-hoc signature I believe, but not 100% sure
z
zwass
12/19/2024, 5:52 PM
Okay so you haven't done it that way?
s
sharvil
12/19/2024, 5:54 PMCan you try adhoc signing and see?
Copy code
codesign -s - -f --entitlements /path/to/osquery.entitlements /path/to/osqueryd Copy code
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "<http://www.apple.com/DTDs/PropertyList-1.0.dtd>">
<plist version="1.0">
<dict>
<key>com.apple.developer.endpoint-security.client</key>
<true/>
</dict>
</plist>sharvil
12/19/2024, 5:54 PMI am on a non-macos laptop tonight, so will be harder for me to check
sharvil
12/19/2024, 5:55 PMBut I think that should work
z
zwass
12/19/2024, 5:57 PM
It worked! Thank you!!
t
Travis Cline
01/02/2025, 7:45 PMAny tips on getting the entitlement approved to be able to develop without having to disable SIP?
56 Views