title: Setting entitlements on executables
body: <p>I am developing a macOS program based on the C language. I created a macOS wrapper app called MyApp.app which is supposed to execute the program. I want to sandbox the program and to give it permission to access only certain resources.</p>
  
  <p>This is how I codesign the program and the wrapper app:</p>
  
  <pre><code>codesign -s MyCert -f --keychain login.keychain --timestamp --options=runtime --deep --entitlements ents.plist myprogram
  
  codesign -s MyCert -f --keychain login.keychain --timestamp --options=runtime --deep --entitlements ents.plist MyApp.app
  </code></pre>
  
  <p>Where <code>ents.plist</code> enables the <code>com.apple.security.app-sandbox</code> entitlement among others. The above commands don't report any errors. Then I check if sandboxing is really enabled on the app and it is on:</p>
  
  <pre><code>asctl sandbox check MyApp.app
  /Users/Me/MyApp.app:
          signed with App Sandbox entitlements
  </code></pre>
  
  <p>As for the binary program, I get an error:</p>
  
  <pre><code>asctl sandbox check myprogram
  asctl: unable to resolve path for application "myprogram"
  </code></pre>
  
  <p>If I run the program and check on the process, it gives me the following:</p>
  
  <pre><code>asctl sandbox check -p 16890
  /Users/Me/myprogram:
          not signed with App Sandbox entitlements
          running without App Sandbox enabled
          running unsandboxed
  </code></pre>
  
  <p>How is sandboxing supposed to be enabled on binary executable programs?</p>