macos: Update our macOS entitlements

[apyrgio]

Our entitlements were last updated when Dangerzone was considering using HyperKit to spawn VMs (9158d02, on 2021-06-30). Now that we use Docker Desktop, we can make them stricter.

Fixes #638

[deeplow]

Apparently this is not working. Reverting my review.

[apyrgio]

This PR is blocked because the suggested entitlements break mounting files in the container. This will have to wait until we resolve #625, in which case, we will pass files via the container's standard streams.

[almet]

Now that #625 has been merged in main, I've rebased this on top.

Relaxing Deeplow from his dangerzone duties :-)

[apyrgio]

Just tested this PR once more. I'm afraid that the recently merged on-host conversion PR does not solve this issue. I've encountered the following issues:

Accessing the Docker socket

Opening the GUI app shows the following error message:

Note that there's indeed no Unix Domain socket there. When I attempt to specify it via the DOCKER_HOST envvar, I get this error:

Accessing files from the Dangerzone CLI

Pointing the dangerzone-cli to a file in the host fails with "file is not found":

user@macos ~ % /Applications/Dangerzone.app/Contents/MacOS/dangerzone-cli dangerzone/tests/test_docs/sample-pdf.pdf
Input file not found: make sure you typed it correctly.
user@macos ~ % ls dangerzone/tests/test_docs/sample-pdf.pdf
dangerzone/tests/test_docs/sample-pdf.pdf

My understanding is that sandboxed apps cannot read any file in the host, but instead have to open a browser window, and let the user choose the file on their own. See: https://developer.apple.com/documentation/security/accessing-files-from-the-macos-app-sandbox

[apyrgio]

One question I had while looking into this is, what's the deal with Docker Desktop? How can the Docker CLI access the Unix Domain Socket of the Docker server?

Turns out that two things happen. First, Docker is not a sandboxed app, as we can see from the missing entitlement in the output below:

user@macos ~ % codesign -d --entitlements - /Applications/Docker.app/Contents/MacOS/Docker\ Desktop.app/Contents/MacOS/Docker\ Desktop
[Dict]
        [Key] com.apple.application-identifier
        [Value]
                [String] 9BNSXJN65R.com.docker.docker
        [Key] com.apple.security.application-groups
        [Value]
                [Array]
                        [String] group.com.docker
        [Key] com.apple.security.cs.allow-jit
        [Value]
                [Bool] true
        [Key] com.apple.security.cs.allow-unsigned-executable-memory
        [Value]
                [Bool] true

Second, the Docker CLI belongs in the same application group as Docker Desktop (group.com.docker), meaning that it has unconditional access to files that Docker Desktop has created:

user@macos ~ % codesign -d --entitlements - /usr/local/bin/docker
[Dict]
        [Key] com.apple.application-identifier
        [Value]
                [String] 9BNSXJN65R.com.docker.docker
        [Key] com.apple.security.application-groups
        [Value]
                [Array]
                        [String] group.com.docker

[apyrgio]

Still, even though we can't go full app sandbox here, it doesn't mean that we can't ditch some older entitlements that are no longer used. I have updated this PR to remove some that I found, and tested that the resulting .dmg works on macOS.

[almet]

Thanks for the investigation on this. Too bad it's not possible. Neverhtless, let's merge the removal of these old permissions :-)