Introduction

The get-task-allow entitlement is a boolean flag in an iOS/macOS app's code signature that controls whether other processes (like the debugger) can attach to the application. When set to true, Xcode's debugger (LLDB) can connect to the app and inspect memory, set breakpoints, and control execution. Development builds have get-task-allow = true by default, while App Store distribution builds have it set to false for security. If this entitlement is misconfigured, debugging fails or App Store submission is rejected.

What get-task-allow Does

<!-- In your app's entitlements file (*.entitlements) -->
<key>com.apple.security.get-task-allow</key>
<true/>  <!-- Allows debugger attachment -->

When get-task-allow is true:

• Xcode's LLDB debugger can attach to the running process
• Instruments can profile the app
• Other developer tools can inspect the process
• The app can be debugged on a physical device via Xcode

When get-task-allow is false:

• No external process can attach to the app
• Debugging is disabled
• The app is hardened against runtime inspection
• Required for App Store and enterprise distribution

How Xcode Manages It Automatically

Xcode handles get-task-allow through build configurations and provisioning profiles:

1Debug build configuration:
2  → Uses Development provisioning profile
3  → get-task-allow = true
4  → Debugger can attach
5
6Release build configuration:
7  → Uses Distribution provisioning profile
8  → get-task-allow = false
9  → Debugger cannot attach

You normally never need to set this manually. Xcode's automatic code signing handles it based on the selected scheme and provisioning profile.

Checking the Entitlement

1# Check entitlements on a built .app bundle
2codesign -d --entitlements - /path/to/MyApp.app
3
4# Output for a debug build:
5# <key>com.apple.security.get-task-allow</key>
6# <true/>
7
8# Output for a release/distribution build:
9# get-task-allow is absent or false
10
11# Check an IPA file
12unzip -o MyApp.ipa -d /tmp/app_contents
13codesign -d --entitlements - /tmp/app_contents/Payload/MyApp.app

Common Scenarios Where It Matters

App Store Rejection

1ERROR ITMS-90426: "Invalid Provisioning Profile Entitlements.
2The entitlements in your app bundle signature do not match
3the ones in the provisioning profile.
4Value for get-task-allow entitlement not supported."

This error means you submitted a build with get-task-allow = true (a debug build) to the App Store. The fix is to archive using the Release configuration with a Distribution provisioning profile.

Cannot Debug on Device

Could not attach to pid: "1234"

If debugging fails on a physical device, the provisioning profile may not include the get-task-allow entitlement. Check that:

1. You are using a Development provisioning profile
2. The device is registered in your Apple Developer account
3. The build configuration is Debug, not Release

Re-signing for Testing

1# Re-sign an IPA with get-task-allow enabled for testing
2# First, create an entitlements file
3cat > entitlements.plist << 'EOF'
4<?xml version="1.0" encoding="UTF-8"?>
5<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
6  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
7<plist version="1.0">
8<dict>
9    <key>com.apple.security.get-task-allow</key>
10    <true/>
11</dict>
12</plist>
13EOF
14
15# Re-sign the app
16codesign -f -s "iPhone Developer: Your Name" \
17  --entitlements entitlements.plist \
18  /path/to/MyApp.app

macOS Hardened Runtime

On macOS, get-task-allow interacts with the Hardened Runtime:

1<!-- macOS entitlements for development -->
2<key>com.apple.security.get-task-allow</key>
3<true/>
4
5<!-- This is separate from the hardened runtime flag -->
6<!-- Hardened Runtime is required for notarization -->

For macOS apps that need notarization (required for distribution outside the App Store), the Hardened Runtime must be enabled, and get-task-allow must be false in the notarized build. During development, Xcode automatically adds get-task-allow = true even with Hardened Runtime enabled.

Build Settings Reference

1Xcode Build Settings:
2  CODE_SIGN_IDENTITY
3    Debug:   "Apple Development"
4    Release: "Apple Distribution"
5
6  PROVISIONING_PROFILE_SPECIFIER
7    Debug:   "MyApp Development"
8    Release: "MyApp Distribution"
9
10  CODE_SIGN_ENTITLEMENTS
11    Both:    "MyApp/MyApp.entitlements"
12
13Xcode automatically strips get-task-allow from Release builds
14when using "Apple Distribution" identity.

CI/CD Considerations

1# In CI, ensure the correct configuration is used for archiving
2xcodebuild archive \
3  -scheme MyApp \
4  -configuration Release \
5  -archivePath build/MyApp.xcarchive
6
7# Export for App Store
8xcodebuild -exportArchive \
9  -archivePath build/MyApp.xcarchive \
10  -exportPath build/export \
11  -exportOptionsPlist ExportOptions.plist

1<!-- ExportOptions.plist for App Store -->
2<plist version="1.0">
3<dict>
4    <key>method</key>
5    <string>app-store</string>
6    <key>teamID</key>
7    <string>YOUR_TEAM_ID</string>
8</dict>
9</plist>

The method: app-store export option ensures get-task-allow is stripped from the final binary.

Common Pitfalls

• Submitting a debug build to the App Store: The most common error. Building with the Debug configuration or a Development provisioning profile includes get-task-allow = true, which Apple rejects. Always archive with the Release configuration and a Distribution profile.
• Manually adding get-task-allow to the entitlements file: Xcode manages this entitlement automatically based on the provisioning profile. Manually setting it in the .entitlements file can conflict with the profile and cause code signing failures.
• Using a Development profile for ad-hoc distribution: Ad-hoc and enterprise distribution profiles set get-task-allow = false. Using a Development profile for ad-hoc builds includes the entitlement and may cause installation failures on non-registered devices.
• Forgetting to disable for macOS notarization: macOS apps submitted for notarization must not include get-task-allow = true. Apple's notarization service rejects builds with this entitlement because it weakens the Hardened Runtime.
• CI/CD builds using the wrong configuration: Build scripts that default to the Debug configuration produce binaries with get-task-allow = true. Always specify -configuration Release in CI archive commands.

Summary

• get-task-allow is an entitlement that permits debugger attachment to your app
• true in development builds (enables LLDB debugging), false in distribution builds (security hardening)
• Xcode manages it automatically through provisioning profiles — you rarely need to set it manually
• App Store submissions fail with ITMS-90426 if get-task-allow = true is present
• Always archive with Release configuration and a Distribution provisioning profile for submission
• Use codesign -d --entitlements - to inspect the entitlement on a built binary