macOS XPC: SecItemAdd throws an error [-25308 errSecInteractionNotAllowed]

Question

Created Jan ’21

Replies 1

Boosts 0

Participants 1

When I create an XPC service
And that XPC service runs a command line tool via NSTask API
And that command line tool tries to use SecItemAdd to store an item in Keychain
Then I receive -25308 error which is errSecInteractionNotAllowed in Keychain API reference

However, when there's no XPC service between Main app (UI) and command line tool, then SecItemAdd works as expected (i.e. NSTask is run from the app that user has launched comparing to XPC service that was launched with launchd)

Code is available here: https://github.com/art-divin/XcodeUpdates/tree/feature/issue-6

While running, one can notice that there's an error when the app tries to write an item to Keychain.

TSI #757702091

Boost

Answer 1

ruslan.alikhamov OP

Jan ’21

I have found the most-likely issue:

Seems like when a command-line utility is run by an XPC (via NSTask API) then it needs entitlements to access Keychain API
Command line utility and entitlements? Xcode ain't going to support this kind of behavoir! Except if to follow @eskimo1's instructions here: https:// developer.apple.com/forums/thread/129596

I am still waiting for another reply to my TSI #757702091 that will be definitive in terms of what should work and what cannot. Then I will update this post.

0