dotnet tools do not support differing entitlements than the dotnet muxer on Mac

[agocke]

See dotnet/runtime#63952 for context. In this case, a dotnet tool requires more entitlements than dotnet, so it can't be executed using the dotnet muxer. If dotnet tools always use an apphost, then the host should be ad hoc signed, which would allow all requirements.

[ClearScriptLib]

This issue affects dotnet test as well.

[marcpopMSFT]

@agocke Do we have to increase the entitlements for the host created during tool install? Is there risk in setting more entitlements for dotnet?

[agocke]

Is there risk in setting more entitlements for dotnet?

Yeah, those are minimum install requirements for dotnet, so we want that list to be as small as possible. For the dotnet tool, the host that sometimes gets created is ad hoc signed, so it automatically has all entitlements. I believe the improvement here would be to always create and use a host for dotnet tools.