-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Expand file tree
/
Copy pathprocess-entitlements.sh
More file actions
executable file
·238 lines (206 loc) · 8.68 KB
/
process-entitlements.sh
File metadata and controls
executable file
·238 lines (206 loc) · 8.68 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
#!/bin/bash
function plistbuddy()
{
/usr/libexec/PlistBuddy -c "$*" "${WK_PROCESSED_XCENT_FILE}"
}
# ========================================
# Mac entitlements
# ========================================
function mac_process_jsc_entitlements()
{
plistbuddy Add :com.apple.security.cs.allow-jit bool YES
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.security.fatal-exceptions array
plistbuddy Add :com.apple.security.fatal-exceptions:0 string jit
fi
if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
then
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.private.pac.exception bool YES
fi
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
then
plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
fi
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 120000 )) && [[ -z "${SKIP_ROSETTA_BREAKING_ENTITLEMENTS}" ]]
then
plistbuddy Add :com.apple.private.verified-jit bool YES
plistbuddy Add :com.apple.security.cs.single-jit bool YES
fi
plistbuddy Add :com.apple.developer.hardened-process bool YES
fi
}
function mac_process_testapi_entitlements()
{
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.security.fatal-exceptions array
plistbuddy Add :com.apple.security.fatal-exceptions:0 string jit
fi
if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
then
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.private.pac.exception bool YES
fi
plistbuddy Add :com.apple.security.cs.allow-jit bool YES
plistbuddy Add :com.apple.rootless.storage.JavaScriptCore bool YES
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
then
plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
fi
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 120000 )) && [[ -z "${SKIP_ROSETTA_BREAKING_ENTITLEMENTS}" ]]
then
plistbuddy Add :com.apple.private.verified-jit bool YES
plistbuddy Add :com.apple.security.cs.single-jit bool YES
fi
plistbuddy Add :com.apple.developer.hardened-process bool YES
fi
}
# ========================================
# macCatalyst entitlements
# ========================================
function maccatalyst_process_jsc_entitlements()
{
plistbuddy Add :com.apple.security.cs.allow-jit bool YES
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.security.fatal-exceptions array
plistbuddy Add :com.apple.security.fatal-exceptions:0 string jit
fi
if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
then
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.private.pac.exception bool YES
fi
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
then
plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
fi
plistbuddy Add :com.apple.developer.hardened-process bool YES
fi
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 120000 )) && [[ -z "${SKIP_ROSETTA_BREAKING_ENTITLEMENTS}" ]]
then
plistbuddy Add :com.apple.private.verified-jit bool YES
plistbuddy Add :com.apple.security.cs.single-jit bool YES
fi
}
function maccatalyst_process_testapi_entitlements()
{
plistbuddy Add :com.apple.rootless.storage.JavaScriptCore bool YES
plistbuddy Add :com.apple.security.cs.allow-jit bool YES
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.security.fatal-exceptions array
plistbuddy Add :com.apple.security.fatal-exceptions:0 string jit
fi
if [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]]
then
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.private.pac.exception bool YES
fi
plistbuddy Add :com.apple.developer.hardened-process bool YES
fi
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 110000 ))
then
plistbuddy Add :com.apple.security.cs.jit-write-allowlist bool YES
plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
fi
if (( "${TARGET_MAC_OS_X_VERSION_MAJOR}" >= 120000 )) && [[ -z "${SKIP_ROSETTA_BREAKING_ENTITLEMENTS}" ]]
then
plistbuddy Add :com.apple.private.verified-jit bool YES
plistbuddy Add :com.apple.security.cs.single-jit bool YES
fi
}
# ========================================
# iOS Family entitlements
# ========================================
function ios_family_process_jsc_entitlements()
{
if [[ "${WK_USE_FATAL_EXCEPTIONS}" == YES ]]
then
plistbuddy Add :com.apple.security.fatal-exceptions array
plistbuddy Add :com.apple.security.fatal-exceptions:0 string jit
plistbuddy Add :com.apple.private.pac.exception bool YES
fi
# If you update this, make sure to update jsc.cpp:3973 (or somewhere around there) to
# ensure that `Options::crashIfCantAllocateJITMemory` is disabled on non-JIT platforms
if [[ "${PLATFORM_NAME}" != watchos && "${PLATFORM_NAME}" != appletvos ]]; then
plistbuddy Add :com.apple.private.verified-jit bool YES
if [[ "${PLATFORM_NAME}" == iphoneos ]]; then
if (( $(( ${SDK_VERSION_ACTUAL} )) >= 170400 )); then
plistbuddy Add :com.apple.developer.cs.allow-jit bool YES
plistbuddy Add :com.apple.developer.web-browser-engine.webcontent bool YES
else
plistbuddy Add :dynamic-codesigning bool YES
fi
else
plistbuddy Add :dynamic-codesigning bool YES
fi
fi
plistbuddy Add :com.apple.developer.kernel.extended-virtual-addressing bool YES
plistbuddy Add :com.apple.developer.hardened-process bool YES
}
rm -f "${WK_PROCESSED_XCENT_FILE}"
plistbuddy Clear dict
if [[ "${WK_PLATFORM_NAME}" =~ .*simulator ]]
then
[[ "${RC_XBS}" != YES ]] && plistbuddy Add :com.apple.security.get-task-allow bool YES
elif [[ "${WK_PLATFORM_NAME}" == macosx ]]
then
[[ "${RC_XBS}" != YES ]] && [[ "${WK_USE_RESTRICTED_ENTITLEMENTS}" == YES ]] && plistbuddy Add :com.apple.security.get-task-allow bool YES
if [[ "${PRODUCT_NAME}" == jsc ||
"${PRODUCT_NAME}" == dynbench ||
"${PRODUCT_NAME}" == minidom ||
"${PRODUCT_NAME}" == testair ||
"${PRODUCT_NAME}" == testb3 ||
"${PRODUCT_NAME}" == testdfg ||
"${PRODUCT_NAME}" == testmasm ||
"${PRODUCT_NAME}" == testmem ||
"${PRODUCT_NAME}" == testRegExp ]]; then mac_process_jsc_entitlements
elif [[ "${PRODUCT_NAME}" == testapi ]]; then mac_process_testapi_entitlements
else echo "Unsupported/unknown product: ${PRODUCT_NAME}"
fi
elif [[ "${WK_PLATFORM_NAME}" == maccatalyst || "${WK_PLATFORM_NAME}" == iosmac ]]
then
[[ "${RC_XBS}" != YES && "${PRODUCT_NAME}" == jsc ]] && plistbuddy Add :com.apple.security.get-task-allow bool YES
if [[ "${PRODUCT_NAME}" == jsc ||
"${PRODUCT_NAME}" == dynbench ||
"${PRODUCT_NAME}" == minidom ||
"${PRODUCT_NAME}" == testair ||
"${PRODUCT_NAME}" == testb3 ||
"${PRODUCT_NAME}" == testdfg ||
"${PRODUCT_NAME}" == testmasm ||
"${PRODUCT_NAME}" == testmem ||
"${PRODUCT_NAME}" == testRegExp ]]; then maccatalyst_process_jsc_entitlements
elif [[ "${PRODUCT_NAME}" == testapi ]]; then maccatalyst_process_testapi_entitlements
else echo "Unsupported/unknown product: ${PRODUCT_NAME}"
fi
elif [[ "${WK_PLATFORM_NAME}" == iphoneos ||
"${WK_PLATFORM_NAME}" == appletvos ||
"${WK_PLATFORM_NAME}" == watchos ||
"${WK_PLATFORM_NAME}" == xros ]]
then
if [[ "${PRODUCT_NAME}" == jsc ||
"${PRODUCT_NAME}" == dynbench ||
"${PRODUCT_NAME}" == minidom ||
"${PRODUCT_NAME}" == testapi ||
"${PRODUCT_NAME}" == testair ||
"${PRODUCT_NAME}" == testb3 ||
"${PRODUCT_NAME}" == testdfg ||
"${PRODUCT_NAME}" == testmasm ||
"${PRODUCT_NAME}" == testmem ||
"${PRODUCT_NAME}" == testRegExp ]]; then ios_family_process_jsc_entitlements
else echo "Unsupported/unknown product: ${PRODUCT_NAME}"
fi
else
echo "Unsupported/unknown platform: ${WK_PLATFORM_NAME}"
fi
exit 0