kornelski / kornelski/rust-security-framework

Save password with "USER_PRESENCE"

Open
#251 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
304
Forks
105
PR merge metrics
No merged PRs in 30d

Description

Hi!
I'm trying to insert a new password inside the keychain.
To do that, I wrote the following code:
```rust
pub fn set_secret(service: &str, account: &str, secret: &[u8]) -> anyhow::Result<()> {
let mut pwd_option = PasswordOptions::new_generic_password(service, account);
pwd_option.set_access_control_options(AccessControlOptions::USER_PRESENCE);
set_generic_password_options(secret, pwd_option).unwrap(); // <--- error

Ok(())
}
```

I aim to write a CLI, and when a credential is required to proceed, "force" the user to use their fingerprint to unblock the security check.
Unfortunately, the above code goes to an error:
```rust
called `Result::unwrap()` on an `Err` value: Error { code: -34018, message: "A required entitlement isn't present." }
```
I comment `set_access_control_options` line, it worked.

Instead, using the below approach goes ok:
```rust
let class = ItemClass::generic_password();
let data = CFData::from_buffer(secret);
let value = ItemAddValue::Data { class, data };
let mut item_to_add = ItemAddOptions::new(value);
item_to_add.set_service(service);
item_to_add.set_account_name(account);
item_to_add.add().unwrap();
```
However, I am unable to set the access control option.

I also tried to sign the bin and run the bin with:
```
cargo build --release
codesign -s - -f target/release/my-cli
codesign --verify --deep --strict target/release/my-cli
```
But the error is still there.

Can you suggest to me how to fix it?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with PasswordOptions::set_access_control_options and set_generic_password_options, then compare their behavior with ItemAddOptions::add. Reproduce the -34018 error using the unsigned and codesigned CLI commands shown, and investigate the macOS entitlement requirement for USER_PRESENCE. Done means identifying whether the crate or the CLI signing setup must change and documenting a verified path.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, rust
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.