Real entitlement, and real sandbox

LEOYoon-Tsaw · May 15, 2024 · b129e58 · b129e58
1 parent 36905ed
commit b129e58
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 10 deletions.
diff --git a/package/sign.bash b/package/sign.bash
@@ -1,15 +1,16 @@
 appDir="build/Release/Squirrel.app"
+entitlement="resources/Squirrel.entitlements"
 
 allFiles=$(find "$appDir" -print)
 for file in $allFiles; do
 	if ! [[ -d "$file" ]]; then
 		if [[ -x "$file" ]]; then
 			echo "$file"
-			codesign --force --preserve-metadata=entitlements --options runtime --timestamp --sign "Developer ID Application: $1" "$file";
+			codesign --force --entitlements "$entitlement" --options runtime --timestamp --sign "Developer ID Application: $1" "$file";
 		fi;
 	fi;
 done;
 
-codesign -d --entitlements --preserve-metadata=entitlements --force --options runtime --timestamp --sign "Developer ID Application: $1" "$appDir";
+codesign -d --entitlements --entitlements "$entitlement" --force --options runtime --timestamp --sign "Developer ID Application: $1" "$appDir";
 
 spctl -a -vv "$appDir";
diff --git a/resources/Squirrel.entitlements b/resources/Squirrel.entitlements
@@ -2,6 +2,8 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>com.apple.security.cs.disable-library-validation</key>
+	<true/>
 	<key>com.apple.security.temporary-exception.files.absolute-path.read-write</key>
 	<array>
 		<string>/Library/Input Methods/Squirrel.app</string>

diff --git a/sources/InputSource.swift b/sources/InputSource.swift
@@ -9,8 +9,6 @@ import Foundation
 import InputMethodKit
 
 struct SquirrelInstaller {
-  static let installLocation = try! FileManager.default.url(for: .libraryDirectory, in: .localDomainMask, appropriateFor: nil, create: false).appendingPathComponent("Input Methods").appendingPathComponent("Squirrel.app")
-
   enum InputMode: String, CaseIterable {
     static let primary = Self.hant
     case hans = "im.rime.inputmethod.Squirrel.Hans"
@@ -49,8 +47,8 @@ struct SquirrelInstaller {
       // Already registered.
       return
     }
-    TISRegisterInputSource(SquirrelInstaller.installLocation as CFURL)
-    print("Registered input source from \(SquirrelInstaller.installLocation)")
+    TISRegisterInputSource(SquirrelApp.appDir as CFURL)
+    print("Registered input source from \(SquirrelApp.appDir)")
   }
 
   func enable(modes: [InputMode] = [.primary]) {

diff --git a/sources/Main.swift b/sources/Main.swift
@@ -10,6 +10,15 @@ import InputMethodKit
 
 @main
 struct SquirrelApp {
+  static let userDir = if let pw = getpwuid(getuid()) {
+    URL(fileURLWithFileSystemRepresentation: pw.pointee.pw_dir, isDirectory: true, relativeTo: nil).appending(components: "Library", "Rime")
+  } else {
+    try! FileManager.default.url(for: .libraryDirectory, in: .userDomainMask, appropriateFor: nil, create: false).appendingPathComponent("Rime", isDirectory: true)
+  }
+  static let appDir = "/Library/Input Library/Squirrel.app".withCString { dir in
+    URL(fileURLWithFileSystemRepresentation: dir, isDirectory: false, relativeTo: nil)
+  }
+
   static func main() {
     let installer = SquirrelInstaller()
     let rimeAPI = rime_get_api().pointee
@@ -73,7 +82,9 @@ struct SquirrelApp {
         print("Problematic launch detected!")
         let args = ["Problematic launch detected! Squirrel may be suffering a crash due to improper configuration. Revert previous modifications to see if the problem recurs."]
         let task = Process()
-        task.executableURL = URL(fileURLWithPath: "/usr/bin/say")
+        task.executableURL = "/usr/bin/say".withCString { dir in
+          URL(fileURLWithFileSystemRepresentation: dir, isDirectory: false, relativeTo: nil)
+        }
         task.arguments = args
         try? task.run()
       } else {

diff --git a/sources/SquirrelApplicationDelegate.swift b/sources/SquirrelApplicationDelegate.swift
@@ -47,8 +47,7 @@ class SquirrelApplicationDelegate: NSObject, NSApplicationDelegate {
   }
 
   func openRimeFolder() {
-    let rimeDir = try! FileManager.default.url(for: .libraryDirectory, in: .userDomainMask, appropriateFor: nil, create: false).appendingPathComponent("Rime", isDirectory: true)
-    NSWorkspace.shared.open(rimeDir)
+    NSWorkspace.shared.open(SquirrelApp.userDir)
   }
 
   func checkForUpdates() {
@@ -90,7 +89,7 @@ class SquirrelApplicationDelegate: NSObject, NSApplicationDelegate {
   }
 
   func setupRime() {
-    let userDataDir = try! FileManager.default.url(for: .libraryDirectory, in: .userDomainMask, appropriateFor: nil, create: false).appendingPathComponent("Rime", isDirectory: true)
+    let userDataDir = SquirrelApp.userDir
     let fileManager = FileManager.default
     if !fileManager.fileExists(atPath: userDataDir.path()) {
       do {