3

I'm developing an application extension for an already released mac application. I need to share the keychain items between the application and extension. I am able to successfully "share" the keychain items between the application and extension in terms of reading the items. The problem is when I trying to remove the keychain items from the application.

Both the application and extension have a keychain-access-group specified in the entitlements and are specifying the access group with the application prefix when making calls to SecItemCopyMatching, SecItemAdd, and SecItemDelete.

Basically the keychain items are created and deleted from the application. The extension only reads the keychain items via SecItemCopyMatching. The problem is that any items the extension reads, can't be deleted by the application later, as SecItemDelete fails with the below error.

SecItemDelete returns -25244, which is "Invalid attempt to change the owner of this item"

I can't find any documentation of what this error means, or why calling SecItemCopyMatching would change the "owner" of the keychain items to the extension.

FYI, I am using UIKeyChainStore for interacting with the keychain, though at this time I don't believe it is the cause of the problem.

duncanc4
  • 1,191
  • 1
  • 9
  • 17
  • Can you please show your code of how you're accessing and deleting the keychain ACL? There are two method of changing the ACL 1) replace it with a new one 2) retrieve the current ACL and update it. Also, does your application need to be root to delete the ACL in this instance? – TheDarkKnight Feb 16 '15 at 13:45
  • I did some more testing and have a better idea of out what is going on. Basically the keychain sharing isn't working. What is happening is when I run the extension it prompts the user for permission to access the keychain items. If I click always allow for the extension, then the extension is added to the list of trusted applications. As long as the extension is listed as a trusted application, the keychain item can't be deleted from the application. – duncanc4 Feb 16 '15 at 18:42
  • @duncanc4 how did you resolve this please? I have the same issue – Houman Feb 27 '20 at 20:06

0 Answers0