Skip to content

Commit af6fa6f

Browse files
bookmebookme
bookme
authored and
bookme
committed
Harden privileged helper security
1 parent 1bd439f commit af6fa6f

27 files changed

Lines changed: 121702 additions & 122614 deletions

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ jobs:
1717

1818
steps:
1919
- name: Check out repository
20-
uses: actions/checkout@v4
20+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2121

2222
- name: Select Xcode
23-
uses: maxim-lobanov/setup-xcode@v1
23+
uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
2424
with:
2525
xcode-version: latest-stable
2626

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ jobs:
2727

2828
steps:
2929
- name: Check out repository
30-
uses: actions/checkout@v4
30+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3131
with:
3232
fetch-depth: 0
3333
ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
3434

3535
- name: Select Xcode
36-
uses: maxim-lobanov/setup-xcode@v1
36+
uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1
3737
with:
3838
xcode-version: latest-stable
3939

@@ -68,7 +68,7 @@ jobs:
6868
security create-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}"
6969
security set-keychain-settings -lut 21600 "${KEYCHAIN_PATH}"
7070
security unlock-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}"
71-
security import "${CERT_PATH}" -P "${P12_PASSWORD}" -A -t cert -f pkcs12 -k "${KEYCHAIN_PATH}"
71+
security import "${CERT_PATH}" -P "${P12_PASSWORD}" -t cert -f pkcs12 -k "${KEYCHAIN_PATH}" -T /usr/bin/codesign -T /usr/bin/xcodebuild -T /usr/bin/security
7272
security list-keychains -d user -s "${KEYCHAIN_PATH}" $(security list-keychains -d user | tr -d '"')
7373
security set-key-partition-list -S apple-tool:,apple: -s -k "${KEYCHAIN_PASSWORD}" "${KEYCHAIN_PATH}"
7474
@@ -152,7 +152,7 @@ jobs:
152152
} >> "${GITHUB_ENV}"
153153
154154
- name: Upload release artifacts
155-
uses: actions/upload-artifact@v4
155+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
156156
with:
157157
name: core-monitor-release
158158
path: |

‎App-Info.plist‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
<key>SMPrivilegedExecutables</key>
3030
<dict>
3131
<key>ventaphobia.smc-helper</key>
32-
<string>anchor apple generic and identifier "ventaphobia.smc-helper" and certificate leaf[subject.OU] = "6VDP675K4L"</string>
32+
<string>anchor apple generic and identifier "ventaphobia.smc-helper" and certificate leaf[subject.OU] = "6VDP675K4L" and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate 1[field.1.2.840.113635.100.6.2.6] exists</string>
3333
</dict>
3434
</dict>
3535
</plist>

‎Core-Monitor.xcodeproj/project.pbxproj‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
/* Begin PBXFileReference section */
4545
33D1932E6B3C54A956AF5F6C /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.sdk/System/Library/Frameworks/Cocoa.framework; sourceTree = DEVELOPER_DIR; };
4646
353B02D12F640A0700A65F2C /* Core-Monitor.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = "Core-Monitor.app"; sourceTree = BUILT_PRODUCTS_DIR; };
47-
35F039AB2F64444D004CB9F8 /* smc-helper */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = "smc-helper"; sourceTree = BUILT_PRODUCTS_DIR; };
47+
35F039AB2F64444D004CB9F8 /* smc-helper */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; name = "smc-helper"; path = "ventaphobia.smc-helper"; sourceTree = BUILT_PRODUCTS_DIR; };
4848
7381A6E72B87236C00C0DE01 /* CustomFanPresetTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CustomFanPresetTests.swift; sourceTree = "<group>"; };
4949
8D6F3C76B69FEDB140682676 /* AlertEngineTests.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; path = AlertEngineTests.swift; sourceTree = "<group>"; };
5050
E5B12BED2CCB8BBEC03C227F /* Core-MonitorTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = "Core-MonitorTests.xctest"; sourceTree = BUILT_PRODUCTS_DIR; };
@@ -456,7 +456,7 @@
456456
"CODE_SIGN_IDENTITY[sdk=macosx*]" = "Apple Development";
457457
CODE_SIGN_STYLE = Automatic;
458458
COMBINE_HIDPI_IMAGES = YES;
459-
CURRENT_PROJECT_VERSION = 14080;
459+
CURRENT_PROJECT_VERSION = 15000;
460460
DEAD_CODE_STRIPPING = YES;
461461
DEVELOPMENT_TEAM = 6VDP675K4L;
462462
ENABLE_APP_SANDBOX = NO;
@@ -473,7 +473,7 @@
473473
"@executable_path/../Frameworks",
474474
);
475475
LIBRARY_SEARCH_PATHS = "$(inherited)";
476-
MARKETING_VERSION = 14.08;
476+
MARKETING_VERSION = 15;
477477
OTHER_LDFLAGS = "";
478478
PRODUCT_BUNDLE_IDENTIFIER = "CoreTools.Core-Monitor";
479479
PRODUCT_NAME = "$(TARGET_NAME)";
@@ -484,7 +484,6 @@
484484
RUNTIME_EXCEPTION_ALLOW_UNSIGNED_EXECUTABLE_MEMORY = NO;
485485
RUNTIME_EXCEPTION_DEBUGGING_TOOL = NO;
486486
RUNTIME_EXCEPTION_DISABLE_EXECUTABLE_PAGE_PROTECTION = NO;
487-
RUNTIME_EXCEPTION_DISABLE_LIBRARY_VALIDATION = YES;
488487
STRING_CATALOG_GENERATE_SYMBOLS = YES;
489488
SWIFT_APPROACHABLE_CONCURRENCY = YES;
490489
SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor;
@@ -505,7 +504,7 @@
505504
CODE_SIGN_ENTITLEMENTS = "Core-Monitor-WeatherKit.entitlements";
506505
CODE_SIGN_STYLE = Automatic;
507506
COMBINE_HIDPI_IMAGES = YES;
508-
CURRENT_PROJECT_VERSION = 14080;
507+
CURRENT_PROJECT_VERSION = 15000;
509508
DEAD_CODE_STRIPPING = YES;
510509
DEVELOPMENT_TEAM = 6VDP675K4L;
511510
ENABLE_APP_SANDBOX = NO;
@@ -522,7 +521,7 @@
522521
"@executable_path/../Frameworks",
523522
);
524523
LIBRARY_SEARCH_PATHS = "$(inherited)";
525-
MARKETING_VERSION = 14.08;
524+
MARKETING_VERSION = 15;
526525
OTHER_LDFLAGS = "";
527526
PRODUCT_BUNDLE_IDENTIFIER = "$(CORE_MONITOR_APP_BUNDLE_IDENTIFIER)";
528527
PRODUCT_NAME = "$(TARGET_NAME)";
@@ -532,7 +531,6 @@
532531
RUNTIME_EXCEPTION_ALLOW_UNSIGNED_EXECUTABLE_MEMORY = NO;
533532
RUNTIME_EXCEPTION_DEBUGGING_TOOL = NO;
534533
RUNTIME_EXCEPTION_DISABLE_EXECUTABLE_PAGE_PROTECTION = NO;
535-
RUNTIME_EXCEPTION_DISABLE_LIBRARY_VALIDATION = YES;
536534
STRING_CATALOG_GENERATE_SYMBOLS = YES;
537535
SWIFT_APPROACHABLE_CONCURRENCY = YES;
538536
SWIFT_DEFAULT_ACTOR_ISOLATION = MainActor;

‎Core-Monitor/AppLocaleSettings.swift‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,7 @@ struct LocalizationSettingsCard: View {
9999
}
100100

101101
var body: some View {
102-
DarkCard(padding: 18) {
103-
VStack(alignment: .leading, spacing: 16) {
102+
VStack(alignment: .leading, spacing: 16) {
104103
HStack(alignment: .top, spacing: 16) {
105104
VStack(alignment: .leading, spacing: 4) {
106105
Text("Language & Locale")
@@ -172,7 +171,8 @@ struct LocalizationSettingsCard: View {
172171
.foregroundStyle(Color.bdAccent)
173172
}
174173
}
175-
}
174+
.padding(18)
175+
.background(.regularMaterial, in: RoundedRectangle(cornerRadius: 18))
176176
}
177177

178178
private func quickPickLabel(for identifier: String) -> some View {

0 commit comments

Comments
 (0)