From 3efaea218082c77740782a964e4e40220ae5a2d3 Mon Sep 17 00:00:00 2001 From: Ernesto Rivera Date: Tue, 15 Feb 2022 14:28:41 -0400 Subject: [PATCH 1/3] Define UseDataProtectionKeychain --- Lib/KeychainAccess/Keychain.swift | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Lib/KeychainAccess/Keychain.swift b/Lib/KeychainAccess/Keychain.swift index aaecf049d..09d931077 100644 --- a/Lib/KeychainAccess/Keychain.swift +++ b/Lib/KeychainAccess/Keychain.swift @@ -1299,6 +1299,9 @@ private let UseAuthenticationUIFail = String(kSecUseAuthenticationUIFail) @available(iOS 9.0, OSX 10.11, watchOS 2.0, tvOS 9.0, *) private let UseAuthenticationUISkip = String(kSecUseAuthenticationUISkip) +@available(iOS 13.0, OSX 10.15, watchOS 6.0, tvOS 13.0, *) +private let UseDataProtectionKeychain = String(kSecUseDataProtectionKeychain) + #if os(iOS) && !targetEnvironment(macCatalyst) /** Credential Key Constants */ private let SharedPassword = String(kSecSharedPassword) From b608cad78d435ae7f05a5d1dd52e6a3b3369efb2 Mon Sep 17 00:00:00 2001 From: Ernesto Rivera Date: Tue, 15 Feb 2022 14:31:24 -0400 Subject: [PATCH 2/3] Set UseDataProtectionKeychain to true when accessGroup is set Fixes macOS access groups issues as described in https://github.com/kishikawakatsumi/KeychainAccess/issues/438, https://github.com/kishikawakatsumi/KeychainAccess/issues/491 and https://github.com/kishikawakatsumi/KeychainAccess/issues/535 --- Lib/KeychainAccess/Keychain.swift | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/Lib/KeychainAccess/Keychain.swift b/Lib/KeychainAccess/Keychain.swift index 09d931077..394e7c9c6 100644 --- a/Lib/KeychainAccess/Keychain.swift +++ b/Lib/KeychainAccess/Keychain.swift @@ -893,7 +893,7 @@ public final class Keychain { query[AttributeSynchronizable] = SynchronizableAny query[MatchLimit] = MatchLimitAll query[ReturnAttributes] = kCFBooleanTrue - + var result: AnyObject? let status = SecItemCopyMatching(query as CFDictionary, &result) @@ -1364,6 +1364,12 @@ extension Options { } } #endif + + if #available(iOS 13.0, OSX 10.15, watchOS 6.0, tvOS 13.0, *) { + if accessGroup != nil { + query[UseDataProtectionKeychain] = true + } + } return query } @@ -1406,6 +1412,12 @@ extension Options { } attributes[AttributeSynchronizable] = synchronizable ? kCFBooleanTrue : kCFBooleanFalse + + if #available(iOS 13.0, OSX 10.15, watchOS 6.0, tvOS 13.0, *) { + if accessGroup != nil { + attributes[UseDataProtectionKeychain] = true + } + } return (attributes, nil) } From 7b0af2cc342cf019982d7ab4275adf9a8a2b162c Mon Sep 17 00:00:00 2001 From: Ernesto Rivera Date: Tue, 15 Feb 2022 14:31:55 -0400 Subject: [PATCH 3/3] Add optional accessGroupsCompatible to class func allKeys() --- Lib/KeychainAccess/Keychain.swift | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Lib/KeychainAccess/Keychain.swift b/Lib/KeychainAccess/Keychain.swift index 394e7c9c6..4981d039f 100644 --- a/Lib/KeychainAccess/Keychain.swift +++ b/Lib/KeychainAccess/Keychain.swift @@ -887,13 +887,19 @@ public final class Keychain { // MARK: - public class func allKeys(_ itemClass: ItemClass) -> [(String, String)] { + public class func allKeys(_ itemClass: ItemClass, accessGroupsCompatible: Bool = true) -> [(String, String)] { var query = [String: Any]() query[Class] = itemClass.rawValue query[AttributeSynchronizable] = SynchronizableAny query[MatchLimit] = MatchLimitAll query[ReturnAttributes] = kCFBooleanTrue + if #available(iOS 13.0, OSX 10.15, watchOS 6.0, tvOS 13.0, *) { + if accessGroupsCompatible { + query[UseDataProtectionKeychain] = true + } + } + var result: AnyObject? let status = SecItemCopyMatching(query as CFDictionary, &result)