security: fixing up some permission checks

Author: cr4zyengineer

Config.xcconfig

@@ -9,4 +9,4 @@
 // https://developer.apple.com/documentation/xcode/adding-a-build-configuration-file-to-your-project
 
 VERSION = 0.9.0
-BUILD_NUMBER = 20260223.90.US.seanistethered
+BUILD_NUMBER = 20260223.94.US.seanistethered

Nyxian/LindChain/ProcEnvironment/Surface/permit.m

@@ -78,12 +78,6 @@ BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc,
         goto out_unlock;
     }
 
-    if(entitlementsNeeded != PEEntitlementNone &&
-       !entitlement_got_entitlement(proc_getentitlements(proc), entitlementsNeeded))
-    {
-        goto out_unlock;
-    }
-    
     /* handling sid bypass */
     if(allowSessionBypass &&
        caller_uid == proc_getruid(targetProc) &&
@@ -95,18 +89,24 @@ BOOL permitive_over_pid_allowed(ksurface_proc_copy_t *proc,
 
     /* handling platform bypass */
     if(allowPlatformBypass &&
-       (caller_uid == proc_getruid(targetProc) || caller_uid == 0) &&
        entitlement_got_entitlement(proc_getentitlements(proc), PEEntitlementPlatform))
     {
         allowed = YES;
         goto out_unlock;
     }
 
+    if(entitlementsNeeded != PEEntitlementNone &&
+       !entitlement_got_entitlement(proc_getentitlements(proc), entitlementsNeeded))
+    {
+        /* nope */
+        goto out_unlock;
+    }
+    
     /* checking if target got entitlement if applicable */
     if(targetEntitlementsNeeded != PEEntitlementNone &&
        !entitlement_got_entitlement(proc_getentitlements(targetProc), targetEntitlementsNeeded))
     {
-        /* nope! */
+        /* still nope! */
         goto out_unlock;
     }