Objective-See details macOS App Translocation bypass

A researcher explains how Apple's App Translocation security feature broke his macOS tools and how to programmatically 'untranslocate' apps to restore functionality.

This blog post from Objective-See's Patrick Wardle recounts his prior research into Gatekeeper bypasses (CVE-2015-3715 and CVE-2015-7024) that abused unsigned external content referenced by signed macOS applications, such as dylib hijacking and dynamic execution of unverified binaries. Apple's comprehensive fix for these issues, introduced in macOS Sierra as 'App Translocation' (Gatekeeper Path Randomization), mounts downloaded applications in a randomized, read-only location to prevent access to unverified external content.

While effective as a security mitigation, App Translocation broke legitimate functionality in several of the author's tools, including TaskExplorer, which needed to modify its own bundle (e.g., setuid an XPC service) at runtime. The author evaluates several Apple-suggested workarounds—refactoring with SMJobBless, moving the app bundle, creating installers, signed DMGs, and signed XIP archives—and finds each impractical or broken. He ultimately presents a technique using undocumented/private Security.framework APIs (SecTranslocateIsTranslocatedURL and SecTranslocateCreateOriginalPathForURL) to detect translocation, strip the com.apple.quarantine attribute from the original app copy, and relaunch it from its original location, effectively bypassing App Translocation's restrictions transparently to the end user.

This is a research/developer-focused writeup rather than an active threat report; it describes a legitimate technique to restore app functionality but also documents an approach that could theoretically be leveraged to circumvent a macOS security control using private APIs.

Source reporting: https://objective-see.org/blog/blog_0x15.html