App Entitlements

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
    <key>application-identifier</key>
    <string>TEAMID.com.company.appname</string>
    
    <key>com.apple.developer.icloud-container-identifiers</key>
    <array>
        <string>iCloud.com.company.appname</string>
    </array>
    
    <key>com.apple.developer.icloud-services</key>
    <array>
        <string>CloudKit</string>
    </array>
    
    <key>keychain-access-groups</key>
    <array>
        <string>TEAMID.com.company.appname</string>
    </array>
</dict>
</plist>

┌──────────────────────────────────────────┐
│   Developer enables capability in Xcode  │
└────────────────┬─────────────────────────┘
                 ↓
┌──────────────────────────────────────────┐
│   Apple generates provisioning profile   │
│   with entitlements                      │
└────────────────┬─────────────────────────┘
                 ↓
┌──────────────────────────────────────────┐
│   codesign embeds entitlements in        │
│   signature during build                 │
└────────────────┬─────────────────────────┘
                 ↓
┌──────────────────────────────────────────┐
│   iOS validates entitlements at launch   │
│   and enforces during runtime            │
└──────────────────────────────────────────┘

# Extract from binary
codesign -d --entitlements binary_ent.xml MyApp

# Extract from profile
security cms -D -i MyApp.app/embedded.mobileprovision | \
  plutil -extract Entitlements xml1 -o profile_ent.xml -

# Compare
diff binary_ent.xml profile_ent.xml

import Security

func hasEntitlement(_ entitlement: String) -> Bool {
    let task = SecTaskCreateFromSelf(nil)
    guard let task = task else { return false }
    
    let value = SecTaskCopyValueForEntitlement(task, entitlement as CFString, nil)
    return value != nil
}

// Check for debugging
if hasEntitlement("get-task-allow") {
    print("Warning: Running with debug entitlement")
}

# Extract example IPA
unzip ~/workspace/source/ObfuscatedAppExamples/ObjectiveSwizzling.ipa -d /tmp/swizzle/
cd /tmp/swizzle/Payload/*.app/

# Extract entitlements from binary
codesign -d --entitlements :- ObjectiveSwizzling > entitlements.xml

# View formatted
cat entitlements.xml | plutil -p -

# Check for debug capability
grep "get-task-allow" entitlements.xml

# List keychain access groups
grep -A 5 "keychain-access" entitlements.xml

# Find apps with same app group
for app in /var/containers/Bundle/Application/*/*.app; do
    echo "Checking $app"
    codesign -d --entitlements :- "$app/$(basename "${app%.app}")" 2>/dev/null | \
      grep "application-groups" -A 3
done