FeaturesCompareGuidesPricingFAQ Buy $4 Download the free trial

What is the hardened runtime?

Security and signing Published

All of glossary Try NotchStar in the browser Buy for $4

The hardened runtime is a setting applied when a Mac app is signed. Apple describes it as a way to manage security protections and resource access for your macOS apps. Together with System Integrity Protection, Apple says it protects the runtime integrity of software by preventing certain classes of exploits, such as code injection, dynamically linked library hijacking and process memory space tampering.

Why it matters

Apple says that to upload a macOS app to be notarized, the developer must enable the Hardened Runtime capability. So a notarized app is also a hardened one. Apple says the hardened runtime does not affect most apps, but it disallows some less common capabilities, and a developer can add an entitlement to turn off an individual protection or to allow access that the app needs. Apple advises using only the entitlements that are absolutely necessary.

How NotchStar uses it

NotchStar sets ENABLE_HARDENED_RUNTIME: YES in its project file. NotchStar needs entitlements for camera, calendar and Apple Events access. During development a release script step stripped them. It did no harm while the app was signed ad hoc, but under the hardened runtime that access would have failed without warning. The fix was to sign the framework first, then the app with --entitlements.

Do not confuse it

The hardened runtime is not the App Sandbox. They are separate features that restrict different things.

Read about notarization and is NotchStar safe.

Keep reading.

What are entitlements in macOS?
Entitlements are key value pairs signed into a Mac app that grant it permission to use a service or technology. Learn what NotchStar asks for and why.
What is notarization on Mac?
Notarization is Apple's automated check of Mac software before you download it. Learn what Apple says it covers and what it does not.
What is the App Sandbox on Mac?
The App Sandbox is a macOS feature that limits an app's access to system resources and user data. Learn how it differs from the hardened runtime.
Is NotchStar safe? Signing, permissions and what it sends
NotchStar is signed and notarized by Apple, needs no account and sends nothing unless you opt in. See every permission it asks for and how to check it yourself.

More in Security and signing.

What is Gatekeeper on a Mac?
Gatekeeper is the macOS check that decides whether downloaded software may run. Learn what it checks, why it shows warnings and how it relates to notarization.
What is notarization on Mac?
Notarization is Apple's automated check of Mac software before you download it. Learn what Apple says it covers and what it does not.
What is an Apple Developer ID?
A Developer ID is the certificate Apple gives developers to sign Mac apps shared outside the App Store. Learn what it proves and what it does not.
What is a DMG file?
A DMG is a disk image, a single file that opens like a drive. Learn how apps ship in one, how to install from it and how to verify the download.
What are entitlements in macOS?
Entitlements are key value pairs signed into a Mac app that grant it permission to use a service or technology. Learn what NotchStar asks for and why.
What is the App Sandbox on Mac?
The App Sandbox is a macOS feature that limits an app's access to system resources and user data. Learn how it differs from the hardened runtime.
NotchStar app icon

Put your notch to work.

Buy it once for $4, activate it in a minute, and keep it. Not sure yet? Try every tool in the browser on the home page, or install the 7 day trial.

Buy NotchStar for $4 Try it in the browser