Save password with "USER_PRESENCE"

[allevo]

Hi!
I'm trying to insert a new password inside the keychain.
To do that, I wrote the following code:

    pub fn set_secret(service: &str, account: &str, secret: &[u8]) -> anyhow::Result<()> {
        let mut pwd_option = PasswordOptions::new_generic_password(service, account);
        pwd_option.set_access_control_options(AccessControlOptions::USER_PRESENCE);
        set_generic_password_options(secret, pwd_option).unwrap(); // <--- error

        Ok(())
    }

I aim to write a CLI, and when a credential is required to proceed, "force" the user to use their fingerprint to unblock the security check.
Unfortunately, the above code goes to an error:

called `Result::unwrap()` on an `Err` value: Error { code: -34018, message: "A required entitlement isn't present." }

I comment set_access_control_options line, it worked.

Instead, using the below approach goes ok:

        let class = ItemClass::generic_password();
        let data = CFData::from_buffer(secret);
        let value = ItemAddValue::Data { class, data };
        let mut item_to_add = ItemAddOptions::new(value);
        item_to_add.set_service(service);
        item_to_add.set_account_name(account);
        item_to_add.add().unwrap();

However, I am unable to set the access control option.

I also tried to sign the bin and run the bin with:

cargo build --release
codesign -s - -f target/release/my-cli
codesign --verify --deep --strict target/release/my-cli

But the error is still there.

Can you suggest to me how to fix it?

[ospfranco]

I'm facing the same issue but it's not this crate fault. On iOS if you build your app via Xcode, entitlements are automatically added for you and you can use access control transparently. However for macOS you need to have a properly built binary (via Xcode or xcodebuild I guess) that contains the correct entitlements.

Here is an example of how Tauri does it:

https://v2.tauri.app/distribute/macos-application-bundle/#entitlements

I have not looked into the documentation of xcodebuild to see if there is anyway to build a binary directly with it passing an entitlements file but I guess it needs to go through all of the apple signing chain for this to work.

[madsmtm]

If you only use Cargo, you can probably do something like:

security find-identity
codesign --force --sign "your identity" --entitlements entitlements.xml target/release/your_binary

[allevo]

I tried your suggestions:

• I created a certificate for code purposes using Keychain (type: Code signing)
• cargo build
• codesign --force --verbose --sign "my identity" --entitlements Entitlements.plist target/debug/my-cli

where Entitlements.plist is:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
</dict>
</plist>

After I checked the entitlements:

% codesign -d --entitlements - target/debug/my-cli
Executable=<path>/target/debug/my-cli
[Dict]
	[Key] com.apple.security.app-sandbox
	[Value]
		[Bool] true

But when I launch it, I got an error:

% ./target/debug/orama-cli
zsh: trace trap  ./target/debug/orama-cli

The code it runs is the following:

use anyhow::Result;

use security_framework::{access_control::{ProtectionMode, SecAccessControl}, passwords::{
    PasswordOptions, generic_password, set_generic_password_options
}};
use security_framework_sys::access_control::kSecAccessControlUserPresence;

pub fn set_secret(service: &str, account: &str, secret: &[u8]) -> anyhow::Result<()> {
    let mut pwd_option = PasswordOptions::new_generic_password(service, account);
    let access_control = SecAccessControl::create_with_protection(
        Some(ProtectionMode::AccessibleAfterFirstUnlockThisDeviceOnly),
        kSecAccessControlUserPresence,
    )?;
    pwd_option.set_access_control(access_control);
    // pwd_option.set_access_control_options();
    set_generic_password_options(secret, pwd_option).unwrap();
    Ok(())
}

pub fn read_secret(service: &str, account: &str, _prompt: &str) -> Result<Vec<u8>> {
    let mut pwd_option = PasswordOptions::new_generic_password(service, account);
    let access_control = SecAccessControl::create_with_protection(
        Some(ProtectionMode::AccessibleAfterFirstUnlockThisDeviceOnly),
        kSecAccessControlUserPresence,
    )?;
    pwd_option.set_access_control(access_control);
    let pwd = generic_password(pwd_option)?;
    Ok(pwd)
}

[ospfranco]

I don't think you can access sandbox without going through the apple app store