Index: trunk/src/VBox/Frontends/VirtualBox/Makefile.kmk
===================================================================
--- trunk/src/VBox/Frontends/VirtualBox/Makefile.kmk	(revision 56816)
+++ trunk/src/VBox/Frontends/VirtualBox/Makefile.kmk	(revision 56817)
@@ -36,4 +36,5 @@
 ifdef VBOX_WITH_HARDENING
 PROGRAMS += VirtualBoxHardened
+PROGRAMS.darwin += VirtualBoxVM
 DLLS += VirtualBox
 else
@@ -57,8 +58,17 @@
 VirtualBoxHardened_SOURCES.win = src/platform/win/VirtualBoxHardened.rc
 VirtualBoxHardened_NAME = VirtualBox
-VirtualBoxHardened_INST.darwin = $(INST_BIN)VirtualBox $(INST_BIN)VirtualBoxVM
 VirtualBoxHardened_LDFLAGS.win = /SUBSYSTEM:$(if-expr "$(KBUILD_TYPE)" != "release",console,windows)
 src/platform/win/VirtualBoxHardened.rc_INCS  = $(VirtualBox_0_OUTDIR)
 src/platform/win/VirtualBoxHardened.rc_DEPS  = $(VirtualBox_0_OUTDIR)/VirtualBox-icon.rc
+
+
+#
+# Hardened VirtualBoxVM.
+#
+ifeq ($(KBUILD_TARGET),darwin)
+ VirtualBoxVM_EXTENDS = VirtualBoxHardened
+ VirtualBoxVM_NAME    = VirtualBoxVM
+ VirtualBoxVM_DEFS    = $(VirtualBoxHardened_DEFS) VIRTUALBOX_VM
+endif
 
 
Index: trunk/src/VBox/Frontends/VirtualBox/src/hardenedmain.cpp
===================================================================
--- trunk/src/VBox/Frontends/VirtualBox/src/hardenedmain.cpp	(revision 56816)
+++ trunk/src/VBox/Frontends/VirtualBox/src/hardenedmain.cpp	(revision 56817)
@@ -65,5 +65,11 @@
     uint32_t fFlags = (fStartVM && !fSeparateProcess) ? 0 : SUPSECMAIN_FLAGS_DONT_OPEN_DEV;
 
+#ifdef VIRTUALBOX_VM
+    return SUPR3HardenedMain("VirtualBoxVM",
+                             fFlags | SUPSECMAIN_FLAGS_TRUSTED_ERROR | SUPSECMAIN_FLAGS_OSX_VM_APP,
+                             argc, argv, envp);
+#else
     return SUPR3HardenedMain("VirtualBox", fFlags | SUPSECMAIN_FLAGS_TRUSTED_ERROR, argc, argv, envp);
+#endif
 }
 
Index: trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h
===================================================================
--- trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h	(revision 56816)
+++ trunk/src/VBox/HostDrivers/Support/SUPLibInternal.h	(revision 56817)
@@ -440,5 +440,5 @@
 
 
-DECLHIDDEN(int)     supR3HardenedVerifyAll(bool fFatal, const char *pszProgName, const char *pszExePath);
+DECLHIDDEN(int)     supR3HardenedVerifyAll(bool fFatal, const char *pszProgName, const char *pszExePath, uint32_t fMainFlags);
 DECLHIDDEN(int)     supR3HardenedVerifyFixedDir(SUPINSTDIR enmDir, bool fFatal);
 DECLHIDDEN(int)     supR3HardenedVerifyFixedFile(const char *pszFilename, bool fFatal);
Index: trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp
===================================================================
--- trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp	(revision 56816)
+++ trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp	(revision 56817)
@@ -1910,5 +1910,5 @@
         SUP_DPRINTF(("SUPR3HardenedMain: Respawn #1\n"));
         supR3HardenedWinInit(SUPSECMAIN_FLAGS_DONT_OPEN_DEV, false /*fAvastKludge*/);
-        supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath);
+        supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath, fFlags);
         return supR3HardenedWinReSpawn(1 /*iWhich*/);
     }
@@ -1927,5 +1927,5 @@
      * Validate the installation.
      */
-    supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath);
+    supR3HardenedVerifyAll(true /* fFatal */, pszProgName, g_szSupLibHardenedExePath, fFlags);
 
     /*
Index: trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp
===================================================================
--- trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp	(revision 56816)
+++ trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp	(revision 56817)
@@ -189,4 +189,7 @@
     {   kSupIFT_Exe,  kSupID_AppBin,             true, "VirtualBox" SUPLIB_EXE_SUFF },
     {   kSupIFT_Dll,  kSupID_AppPrivArch,        true, "VirtualBox" SUPLIB_DLL_SUFF },
+# ifdef RT_OS_DARWIN
+    {   kSupIFT_Exe,  kSupID_AppBin,             true, "VirtualBoxVM" SUPLIB_EXE_SUFF },
+# endif
 # if !defined(RT_OS_DARWIN) && !defined(RT_OS_WINDOWS) && !defined(RT_OS_OS2)
     {   kSupIFT_Dll,  kSupID_AppSharedLib,       true, "VBoxKeyboard" SUPLIB_DLL_SUFF },
@@ -853,20 +856,35 @@
  * @param   fLeaveOpen          The leave open setting used by
  *                              supR3HardenedVerifyAll.
- */
-static int supR3HardenedVerifyProgram(const char *pszProgName, const char *pszExePath, bool fFatal, bool fLeaveOpen)
+ * @param   fMainFlags          Flags supplied to SUPR3HardenedMain.
+ */
+static int supR3HardenedVerifyProgram(const char *pszProgName, const char *pszExePath, bool fFatal,
+                                      bool fLeaveOpen, uint32_t fMainFlags)
 {
     /*
      * Search the table looking for the executable and the DLL/DYLIB/SO.
+     * Note! On darwin we have a hack in place for VirtualBoxVM helper app
+     *       to share VirtualBox.dylib with the VirtualBox app.  This ASSUMES
+     *       that cchProgNameDll is equal or shorter to the exe name.
      */
     int             rc = VINF_SUCCESS;
     bool            fExe = false;
     bool            fDll = false;
-    size_t const    cchProgName = suplibHardenedStrLen(pszProgName);
+    size_t const    cchProgNameExe = suplibHardenedStrLen(pszProgName);
+#ifndef RT_OS_DARWIN
+    size_t const    cchProgNameDll = cchProgNameExe;
+#else
+    size_t const    cchProgNameDll = fMainFlags & SUPSECMAIN_FLAGS_OSX_VM_APP
+                                   ? sizeof("VirtualBox") - 1
+                                   : cchProgNameExe;
+    if (cchProgNameDll > cchProgNameExe)
+        return supR3HardenedError(VERR_INTERNAL_ERROR, fFatal,
+                                  "supR3HardenedVerifyProgram: SUPSECMAIN_FLAGS_OSX_VM_APP + '%s'", pszProgName);
+#endif
     for (unsigned iFile = 0; iFile < RT_ELEMENTS(g_aSupInstallFiles); iFile++)
-        if (!suplibHardenedStrNCmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgName))
+        if (!suplibHardenedStrNCmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgNameDll))
         {
-            if (    (   g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
-                     || g_aSupInstallFiles[iFile].enmType == kSupIFT_TestDll)
-                &&  !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_DLL_SUFF))
+            if (   (   g_aSupInstallFiles[iFile].enmType == kSupIFT_Dll
+                    || g_aSupInstallFiles[iFile].enmType == kSupIFT_TestDll)
+                && !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgNameDll], SUPLIB_DLL_SUFF))
             {
                 /* This only has to be found (once). */
@@ -881,5 +899,7 @@
             else if (   (   g_aSupInstallFiles[iFile].enmType == kSupIFT_Exe
                          || g_aSupInstallFiles[iFile].enmType == kSupIFT_TestExe)
-                     && !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgName], SUPLIB_EXE_SUFF))
+                     && (   cchProgNameExe == cchProgNameDll
+                         || !suplibHardenedStrNCmp(pszProgName, g_aSupInstallFiles[iFile].pszFile, cchProgNameExe))
+                     && !suplibHardenedStrCmp(&g_aSupInstallFiles[iFile].pszFile[cchProgNameExe], SUPLIB_EXE_SUFF))
             {
                 /* Here we'll have to check that the specific program is the same as the entry. */
@@ -927,6 +947,7 @@
  *                              DLL/DYLIB/SO are valid.
  * @param   pszExePath          The path to the executable.
- */
-DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, const char *pszProgName, const char *pszExePath)
+ * @param   fMainFlags          Flags supplied to SUPR3HardenedMain.
+ */
+DECLHIDDEN(int) supR3HardenedVerifyAll(bool fFatal, const char *pszProgName, const char *pszExePath, uint32_t fMainFlags)
 {
     /*
@@ -955,5 +976,5 @@
      * sign things.
      */
-    int rc2 = supR3HardenedVerifyProgram(pszProgName, pszExePath, fFatal, fLeaveOpen);
+    int rc2 = supR3HardenedVerifyProgram(pszProgName, pszExePath, fFatal, fLeaveOpen, fMainFlags);
     if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
         rc2 = rc;
