App translocation! Security fails

Unity Engine
, ,
1

I simply need to distribute apps for internal testing on mac (preferably via windows but that was not worth the number of failures!).
However Mac OS seems so determined to prevent anything running freely unless it is signed (which I have not yet been able to do).

If you download a (unsigned) zipped mac app, it runs in its own private location (app translocation), which is not ok for me as need to communicate to another app and write files.

Any tips to just make an app run where you start it and ignore over-zealous security or just point me at a dummies guide to signing an app (using terminal commands seems insane to me in 2021!).

2

Remove the quarantine attribute:

xattr -r -d com.apple.quarantine /path/to/game.app
1 Like
3

ok but does each ‘tester’ (some less technical) need to do this after downloading zip, it seems zipping up causes the quarantine?

4

I was under the impression that the browser puts the attribute on when it downloads your .zip file. If you checked, the .zip file will have this attribute too. Unfortunately I’m not exactly sure how to disable this behaviour, and I know it’s not in any way related to Unity.

5

Yes not a unity issue - this should probably be elsewhere, thanks anyway

6

Note we went digging a bit further and discovered that this indeed broke with Unity 2020.2. The issue can be seen here: Unity Issue Tracker - macOS builds no longer run when with a quarantine attribute due to incorrect codesigning

We’re going to work on fixing it.

7

OK I’m using LTS for this kind of reason, clearly Unity staff need to build mac apps with each Unity version and latest OS because docs fall behind and new issues appear.

8

I did… I just didn’t realize this started behaving differently. I had the impression it was part of the new OS security stuff.

1 Like
9

Yes I would check it is not that of course - the security does seem to get tougher and tougher.
You can destroy the security of an app by sending it zipped, sending it in an unsigned package (I think) etc. so distribution alone can be the cause

10

I’m running into this issue as well and so far I’ve found this workaround (seems a bit silly though)

I’ve created a small Unity app that needs a map (mapfortxt) with two files it can read and write to. Somehow, after zipping and downloading, the access to the map is denied to the Unity app, and it cannot be fixed by clearing read/write access and security setting. So here is what I did:

  • After downloading and unzipping
  • Start the app and fix all security issues, then close it again.
  • Create a complete new directory for the app. The new directory must be the in same or higer level than the former one in where the file was unzupped.
    Do NOT re-use an old one.
  • Move only the app (not the mapfortxt) to a different directory
  • Manually re-create a new map (mapfortxt that is needed for the app)
  • Execute the app. Mac will now generate a message where it requests access to the directory of the app
    If all goes well access from the Unity app to the manually created map is now granted. But make sure you do not use the files in that map you got from the unzipper. I had two simple txt-files which I generated manually as well.

Somehow moving the app to a new directory gets it out of a rather vaguely defined sandbox.

11

I have this issue for a long time, and for it to work I need to both sign the app and remove quarantine, How ever in an attempt to automate the process, I created an .sh file and added it to Post-Build Script in cloud build config. It signs the app alright but the remove quarantine part not working. Any Ideas why ? here is the content of my .sh file:

codesign --deep -s - -f $path
xattr -r -d com.apple.quarantine $path