I need to store auth keys somewhere, previously app network extension would store them in a shared keychain. Now we're trying to move to system extensions, for out of appstore distribution, and shared keychain will no longer work.
Is it possible to write to system keychain from system extension? If yes, how do I specify that I want to use system keychain?
Our current code returns errSecNotAvailable if run in System Extension instead of App Extension. The code looks like this. If uncommented, it will work from the App Extension.
NSString *teamID = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"Development Team"];
NSString *groupID = [[[NSBundle mainBundle] infoDictionary] objectForKey:@"App Group ID"];
NSMutableDictionary *query = [NSMutableDictionary dictionaryWithDictionary:@{
(id)kSecClass: (id)kSecClassGenericPassword,
// (id)kSecAttrAccessGroup: [NSString stringWithFormat:@"%@.%@", teamID, groupID],
(id)kSecAttrService: groupID,
// (id)kSecAttrAccessible: (id)kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
}];
[query setObject:(id)kCFBooleanTrue forKey:(id)kSecUseDataProtectionKeychain];
[query setObject:@(key) forKey:(id)kSecAttrAccount];
[query setObject:[NSData dataWithBytes:buffer length:length] forKey:(id)kSecValueData];
SecItemAdd(cfQuery, NULL);
Oh, I just had cause to check on FB11916222 today and it’s reported as fixed in macOS 14. I don’t have time to check that right now, but if you have the opportunity to do so I’d appreciate you posting your results here.
IMPORTANT Once a bug like this is fixed, App Review typically requires you to conditionalise your workaround so that it only applies on older systems. If you find that you no longer need this temporary exception entitlement on macOS 14 and later, conditionalise it so that it only applies on older systems. For an example of how to do this, see here.
That example is for com.apple.security.temporary-exception.apple-events but the same process works for other temporary exception entitlements.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"