Add Mach-O security feature detection
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 962
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
ELF security feature detections was added in https://github.com/anchore/syft/pull/2443 . It would be nice to also add this same kind of features but for darwin (Mach-O formatted binaries).
Proposed features to detect:
- Code signing, we could reuse/import functions from anchore/quill to do this.
- PIE (same as in ELF)
- Non-Executable stack/heap flags (similar to DEP in PE formatted files)
- Stack canaries
- Hardened runtimes, detectable in the binary's entitlements (there might be a function in anchore/quill for this)
There may be more features to detect that I'm unaware of.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the ELF security feature detection added in pull request 2443 and investigate how Mach-O binaries are handled in Syft. Compare the proposed code signing, PIE, executable stack/heap, stack canary, and hardened runtime detections, including possible functions from anchore/quill. Done means agreeing on the supported Mach-O feature set and adding equivalent detections.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- reverse-engineering, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100