Changeset 97191 in vbox for trunk/src/VBox/HostDrivers

Timestamp:

Oct 18, 2022 9:35:22 AM (2 years ago)

Author:

vboxsync

Message:

Support/darwin/SUPR3HardenedEntitlements.plist: Need to have the com.apple.security.device.audio-input and com.apple.security.device.camera entitlements in the non VM process list as well or TCC crashes the VM process as soon as it requests any of these entitlements because it looks up the primary bundle identifier

File:

• trunk/src/VBox/HostDrivers/Support/darwin/SUPR3HardenedEntitlements.plist (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/darwin/SUPR3HardenedEntitlements.plist

@@ -5 +5 @@
     <!-- <key>com.apple.security.cs.allow-jit</key>                          <true/> -->
     <!-- <key>com.apple.security.cs.allow-unsigned-executable-memory</key>   <true/> -->
-    <!-- <key>com.apple.security.device.audio-input</key>                    <true/> -->
+    <!--
+      The following two are required here even though they apply only to the VM
+      process. The issue is that TCC is looking up the primary bundle for these entitlements
+      and crashes the VM process if the entitlements are not here even though they are used
+      in the VM process only. This is not documented anywhere by Apple.
+      From Console.app when these are missing:
+
+        tccd: [com.apple.TCC:access] Prompting policy for hardened runtime; service:
+            kTCCServiceMicrophone requires entitlement com.apple.security.device.audio-input but it is missing for
+                RESP:{
+                    ID: org.virtualbox.app.VirtualBox,
+                    PID[17253],
+                    auid: 501,
+                    euid: 501,
+                    responsible path: '/Applications/VirtualBox.app/Contents/MacOS/VirtualBox',
+                    binary path: '/Applications/VirtualBox.app/Contents/MacOS/VirtualBox'
+                },
+                REQ:{
+                    ID: org.virtualbox.app.VirtualBoxVM,
+                    PID[17331],
+                    auid: 501,
+                    euid: 501,
+                    binary path: '/Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VirtualBoxVM'
+                }
+    -->
+    <!-- For audio input -->
+    <key>com.apple.security.device.audio-input</key>                    <true/>
+    <!-- For emulated webcam -->
+    <key>com.apple.security.device.camera</key>                         <true/>
 </dict>
 </plist>