Debug System Pref Pane w/10.15 and System Integrity Protection

Question

In the past, I have been able to run/debug a self-developed Preference Pane in System Preferences by self-signing a copy of the System Preferences app, and setting it as the run target in Xcode.

A symbolic link is placed in ~/Library/PreferencePanes that points to the output prefPane built by Xcode and everything works... at least it used to under 10.11 through 10.14.

See: Debug System Pref Pane w/10.11 and System Integrity Protection

Under 10.15 this breaks. While the prefPane properly loads with the real (Apple-Signed) System Preferences app, when I try to run my prefPane in the self-signed copy of System Preferences, I get "Could not load preference pane". The same thing happens when trying to load any of the Apple built-in pref panes as well.

I have tried both:

codesign -s "My Developer ID" -f "/Applications/System Preferences Copy.app"

and

codesign -s - -f "/Applications/System Preferences Copy.app"

No errors are generated in the Console.

My guess is that somewhere in the loading process, it is checking to see if the System Preferences host app is signed by Apple. If I try to use the real System Preferences app as a debug target, I get a System Integrity Protection error.

Is there any way to do this without disabling SIP like there was in 10.11 to 10.14?

Answer 1

Probably, the app is subject to the restrictions of the hardened runtime. Without entitlements to ease those restrictions, it will be prevented from, for example, loading code that's not signed by Apple or an identity from the same team.

You will need to sign your copy with the --options runtime --entitlements <path> options. The path should point to a plist file of a dictionary whose keys are entitlements and values are typically booleans. For example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
</dict>
</plist>