I need to restrict macOS keychain operations to a single keychain

I need to restrict operations to a single keychain file in a daemon.
This is easy to do with the legacy APIs but I can't get things to work with the SecItem API.
I can add things to the keychain file but trying to find them again isn't working with SecItem.
I get screams about not being able to open files.

Before I open a bug/feature request to enable SecItem to do this I'd like to be sure that I'm not missing something obvious.

Accepted Reply

Thanks -- I found my mistake.

Replies

As you targeting the iOS style keychain? Or the traditional file-based keychain?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
Hi Quinn,

Since I'm in a daemon and I need my own keychain file separated from the rest of the world I'm targeting a traditional file-based keychain.

I tried adding items to my keychain using the dictionary key that you specified elsewhere to set the target keychain and that worked. The keychain item is actually where I want it when I open up the keychain file in Keychain Access. However, when I search for it using the SecItem APIs I don't get it returned to me.

I would ALSO like the ability to have a memory based keychain eventually, but that is secondary.

Thanks for any help.
Jim

I would ALSO like the ability to have a memory based keychain eventually, but that is secondary.

There’s no such thing.

However, when I search for it using the SecItem APIs I don't get it returned to me.

It sounds like you’re conflating two different attributes:
  • kSecUseKeychain is used when you add an item to specify the keychain to add it to.

  • kSecMatchSearchList is used when you query for items to specify the keychains to search.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"
Thanks -- I found my mistake.