Remove com.apple.security.cs.debugger entitlement from dotnet muxer and apphosts (dotnet#122901)

Copilot · agocke · web-flow · commit d2324cafe2a2 · 2026-01-06T15:39:32.000-08:00
# Description

Removes `com.apple.security.cs.debugger` entitlement from
`eng/native/entitlements.plist`, which is used to sign the dotnet muxer,
apphost, singlefilehost, and corerun on macOS.

This entitlement is meant for debuggers. It's unnecessary for the
muxer—debuggers should ship with their own apphost and set their own
entitlements.

**Preserved**: `createdump-entitlements.plist` retains the debugger
entitlement since createdump uses `task_for_pid()` and `ptrace()` APIs
for dump generation.

Low. Removes unnecessary entitlement that could potentially trigger
macOS security prompts for non-debugging tools.

---------

Co-authored-by: copilot-swe-agent[bot] &lt;198982749+Copilot@users.noreply.github.com&gt;
Co-authored-by: agocke &lt;515774+agocke@users.noreply.github.com&gt;
diff --git a/eng/native/entitlements.plist b/eng/native/entitlements.plist
@@ -8,8 +8,6 @@
       <true/>
     <key>com.apple.security.cs.disable-library-validation</key>
       <true/>
-    <key>com.apple.security.cs.debugger</key>
-      <true/>
     <key>com.apple.security.get-task-allow</key>
       <true/>
   </dict>
