Can an iOS app read its own entitlements at runtime?

Question

Can an iOS app discover, inspect, or otherwise read its own entitlements at runtime?

Ideally, I could read the whole (processed) contents of my .entitlements file as a plist. Getting just the app identifier prefix would be an acceptable second-best.

Goals here include: allowing the app to be signed with various app identifier prefixes, without needing to make a matching change in code; and to act differently in the presence or absence of shared keychain access groups. This is library code, so the less I impose on the client app's configuration, the better.

Answer 1

In short, no. The entitlements file is only used at compile-time and is not copied into the app bundle.

Clarification: During development, the entitlements are written into the embedded.mobileprovision file in the app bundle. When your app is released as an IPA on the App Store, it will not contain a embedded.mobileprovision.

Answer 2

As others mentioned in comments, the signed executable of your app contains an embedded entitlements plist, which suggests it should be possible.

You will need to use some non-ios-public (but documented) APIs. Try the following code:

// Declare the private SecTask functions in your header file void* (SecTaskCopyValueForEntitlement)(void* task, CFStringRef entitlement, CFErrorRef  _Nullable *error); void* (SecTaskCreateFromSelf)(CFAllocatorRef allocator);   // And call it in your code like this: CFErrorRef err = nil; NSArray* groups = SecTaskCopyValueForEntitlement(SecTaskCreateFromSelf(NULL), CFSTR("com.apple.security.application-groups"), &err);