Quick note: The report makes it sound like /bin/ls is being given special privileges. That would be reminiscent of many past macOS security issues: processes are treated differently based on their code signature and entitlements, and sometimes that has unexpected consequences.
But that's not the case here. /bin/ls has no entitlements. And if I modify the sample project to just call stat() directly rather than invoking ls, it still works.
So it's really a kernel issue where for some reason filesystem metadata is not being protected as much as the actual data.
But that's not the case here. /bin/ls has no entitlements. And if I modify the sample project to just call stat() directly rather than invoking ls, it still works.
So it's really a kernel issue where for some reason filesystem metadata is not being protected as much as the actual data.