Hardened Runtime and Sandboxing
The relationship between the hardened runtime and sandboxing can be confusing to Mac developers, both because the hardened runtime is new and because it’s not well documented by Apple. I’ll attempt to explain the relationship here. App sandboxing was introduced in Mac OS X 10.7 Lion and eventually became a requirement for all Mac App Store apps, though developers can also choose to sandbox apps distributed outside the Mac App Store. The hardened runtime was introduced in macOS 10.14 Mojave and is currently optional for all apps, though it is required in order to notarize your app. Apple has announced that at some point in the future, all apps distributed outside the Mac App Store will need to be notarized, which means they will need to be "hardened" too. I suspect that Apple will eventually require Mac App Store apps to hardened as well. This may be surprising to developers, who associate sandboxing with the App Store and the hardened runtime with Developer ID, but the two technologies are independent of the distribution method and independent of each other, which means that a single app can be sandboxed and hardened.
[…]
Some protections of the hardened runtime such as debugging and Address Book are indeed enforced by SIP. However, it turns out that the Apple Events protection is not enforced by SIP but rather applies to hardened apps regardless of whether SIP is enabled.
Previously: AEDeterminePermissionToAutomateTarget Added, But AEpocalyse Still Looms.
5 Comments RSS · Twitter
Since Apple intends to make notarizing and hardening required for non-MAS apps, is there anything (legit) you can't do in a notarized hardened app, assuming you enable all the entitlements? I guess I'll find out when I try it…
Forcing all apps require to be notarized in the future makes little sense for private, in-house developed, apps, like I do a lot for customers. I can't have every update I make for a customer have notarized thru Apple every time, of course. But I also don't want to have to disable SIP entirely just because of it. I can't believe that Apple would go that far.
I don't see why you can't notarize each version of your app. You can totally have every update you make notarized, assuming your app works fine with the "hardened runtime". Just do a developer id export with notarization or setup fastlane to do it for you. We build, sign, and notarize on every single git commit.
