Cannot save file when phone is locked- file permissions error

Question

Created Nov ’20

Replies 4

Boosts 0

Views 1.5k

Participants 3

I am doing some file download work using a notification service extension; just noticed that I'm unable to save the files if the device is locked. Getting the following error:

You don’t have permission to save the file “1604427874_24344399xxxxxx.json” in the folder “posts”."

Have tried manually setting the permissions of that folder like so, with no luck:

Code Block var attributes = [FileAttributeKey : Any]()
   attributes[.posixPermissions] = 0o777
   try FileManager.default.createDirectory(at: postsDirectory, withIntermediateDirectories: true, attributes: attributes)

We suspect this is an issue in the main application as well, if the device is trying to do this download work while the device is locked.

Answered by DTS Engineer in 644576022

This is unlikely to be a permissions error but rather a data protection issue. Most iOS code defaults to ‘complete’ data protection, which means you can’t access it while the device is locked. If you have code that runs in that state, like an NSE, you need to change your data protection accordingly. The protection to choose depends on your execution context:

If your code can run before the user has ever unlocked the device, the only option is ‘none’.
If not, ‘complete until first user authentication’ is a better choice.
If you code starts when the device is unlocked but then needs to work on a file after the device has been locked, you can play around with ‘complete unless open’.

Note that I’m not naming actual APIs here because these concepts are expressed at many different levels in the system. For example:

Data has WritingOptions
URL has fileProtectionKey
SQLite has SQLITE_OPEN_FILEPROTECTION_*

Also, data protection is discussed extensively in the Apple Platform Security and if you’re new to this concept I recommend that you start there.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

Nov ’20

Accepted Answer

This is unlikely to be a permissions error but rather a data protection issue. Most iOS code defaults to ‘complete’ data protection, which means you can’t access it while the device is locked. If you have code that runs in that state, like an NSE, you need to change your data protection accordingly. The protection to choose depends on your execution context:

If your code can run before the user has ever unlocked the device, the only option is ‘none’.
If not, ‘complete until first user authentication’ is a better choice.
If you code starts when the device is unlocked but then needs to work on a file after the device has been locked, you can play around with ‘complete unless open’.

Note that I’m not naming actual APIs here because these concepts are expressed at many different levels in the system. For example:

Data has WritingOptions
URL has fileProtectionKey
SQLite has SQLITE_OPEN_FILEPROTECTION_*

Also, data protection is discussed extensively in the Apple Platform Security and if you’re new to this concept I recommend that you start there.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

michellepriv OP

Nov ’20

Thank you so much! That solved my problem.

0

Answer 3

jon.gary OP

Mar ’21

I'm assuming ‘complete unless open’ applies to file open before the device is locked, and that if I need to open files while the device is locked, I need to use 'none.' It's also unclear if I need to set the protection on the parent directory. Does that ever matter?

0

Answer 4

DTS Engineer OP

Apple

Mar ’21

I'm assuming ‘complete unless open’ applies to file open

Correct.

It's also unclear if I need to set the protection on the parent
directory. Does that ever matter?

No, and yes (-: When you create a file in a directory the file will, by default, inherit its data protection setting from that directory.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0