We claim that a process has zero or more capabilities. Does a processes signature identity count as a capability?

[alecdeshotels]

We claim that a process has zero or more capabilities. Does a processes signature identity count as a capability?

[razvand]

What is a "process signature identity"?

[alecdeshotels]

Each signed executable on iOS should have an Identifier as part of its signature. If you run jtool --sig on a signed mach-o executable, you should see a field for the Identifier.

There is also an entitlement with the key "application-identifier" that seemed to correspond to the signature identifier, and I wondered if all legitimately signed executables would have this entitlement. However, I have found that the Calculator application does not have the "application-identifier" entitlement, so it should be safe to claim that an iOS executable could be signed while having zero entitlements.

Based on my findings with the iOS 8 Calculator app, I think our claim is reasonable, and I will close this issue.