add explanation to documentation about bypassing gatekeeper

mandiant · Jul 17, 2020 · 2a7d4e7 · 2a7d4e7 · darkmonk94 · Jul 20, 2020
1 parent bd2303d
commit 2a7d4e7
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/doc/img/approve.png b/doc/img/approve.png
diff --git a/doc/installation.md b/doc/installation.md
@@ -8,6 +8,12 @@ We use PyInstaller to create these packages.
 
 The capa [README](../README.md#download) also links to nightly builds of standalone binaries from the latest development branch.
 
+### MacOS Standalone installation
+
+By default, on MacOS Catalina or greater, Gatekeeper will block execution of the standalone binary. To resolve this, simply try to execute it once on the command-line and then go to `System Preferences` / `Security & Privacy` / `General` and approve the application:
+
+![approve dialog](img/approve.png)
+
 ## Method 2: Using capa as a Python library
 To install capa as a Python library, you'll need to install a few dependencies, and then use `pip` to fetch the capa module.
 Note: this technique doesn't pull the default rule set, so you should check it out separately from [capa-rules](https://github.com/fireeye/capa-rules/) and pass the directory to the entrypoint using `-r`.