I need to restrict macOS keychain operations to a single keychain

Question

Created Aug ’20

Replies 4

Boosts 0

Participants 2

I need to restrict operations to a single keychain file in a daemon.
This is easy to do with the legacy APIs but I can't get things to work with the SecItem API.
I can add things to the keychain file but trying to find them again isn't working with SecItem.
I get screams about not being able to open files.

Before I open a bug/feature request to enable SecItem to do this I'd like to be sure that I'm not missing something obvious.

Answered by joconnor in 626842022

Thanks -- I found my mistake.

Boost

Answer 1

DTS Engineer OP

Apple

Aug ’20

As you targeting the iOS style keychain? Or the traditional file-based keychain?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

joconnor OP

Aug ’20

Hi Quinn,

Since I'm in a daemon and I need my own keychain file separated from the rest of the world I'm targeting a traditional file-based keychain.

I tried adding items to my keychain using the dictionary key that you specified elsewhere to set the target keychain and that worked. The keychain item is actually where I want it when I open up the keychain file in Keychain Access. However, when I search for it using the SecItem APIs I don't get it returned to me.

I would ALSO like the ability to have a memory based keychain eventually, but that is secondary.

Thanks for any help.
Jim

0

Answer 3

DTS Engineer OP

Apple

Aug ’20

I would ALSO like the ability to have a memory based keychain eventually, but that is secondary.

There’s no such thing.

However, when I search for it using the SecItem APIs I don't get it returned to me.

It sounds like you’re conflating two different attributes:

kSecUseKeychain is used when you add an item to specify the keychain to add it to.
kSecMatchSearchList is used when you query for items to specify the keychains to search.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 4

joconnor OP

Aug ’20

Accepted Answer

Thanks -- I found my mistake.

0