kornelski / kornelski/rust-security-framework
Save password with "USER_PRESENCE"
- Dominant language
- Rust
- Stars
- 304
- Forks
- 105
- PR merge metrics
- No merged PRs in 30d
Description
Hi!
I'm trying to insert a new password inside the keychain.
To do that, I wrote the following code:
```rust
pub fn set_secret(service: &str, account: &str, secret: &[u8]) -> anyhow::Result<()> {
let mut pwd_option = PasswordOptions::new_generic_password(service, account);
pwd_option.set_access_control_options(AccessControlOptions::USER_PRESENCE);
set_generic_password_options(secret, pwd_option).unwrap(); // <--- error
Ok(())
}
```
I aim to write a CLI, and when a credential is required to proceed, "force" the user to use their fingerprint to unblock the security check.
Unfortunately, the above code goes to an error:
```rust
called `Result::unwrap()` on an `Err` value: Error { code: -34018, message: "A required entitlement isn't present." }
```
I comment `set_access_control_options` line, it worked.
Instead, using the below approach goes ok:
```rust
let class = ItemClass::generic_password();
let data = CFData::from_buffer(secret);
let value = ItemAddValue::Data { class, data };
let mut item_to_add = ItemAddOptions::new(value);
item_to_add.set_service(service);
item_to_add.set_account_name(account);
item_to_add.add().unwrap();
```
However, I am unable to set the access control option.
I also tried to sign the bin and run the bin with:
```
cargo build --release
codesign -s - -f target/release/my-cli
codesign --verify --deep --strict target/release/my-cli
```
But the error is still there.
Can you suggest to me how to fix it?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with PasswordOptions::set_access_control_options and set_generic_password_options, then compare their behavior with ItemAddOptions::add. Reproduce the -34018 error using the unsigned and codesigned CLI commands shown, and investigate the macOS entitlement requirement for USER_PRESENCE. Done means identifying whether the crate or the CLI signing setup must change and documenting a verified path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- macos, rust
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100