refactor(apple): Use kSecUseDataProtectionKeychain for token (#7756)

This will force the macOS Keychain to behave like the iOS Keychain. To
be honest, Apple's documentation is very much lacking in this regard,
but some research suggests this is both heavily recommended by Apple and
that it enables the Keychain operation to benefit from Apple's security
hardware in their Macs.

In my local testing, it also seems to make keychain operations more
reliable when SIP is disabled, but that could be a fluke given the
number of variables at play.


https://developer.apple.com/documentation/security/ksecusedataprotectionkeychain

Draft because stacked.
This commit is contained in:
Jamil
2025-01-14 09:49:05 -08:00
committed by GitHub
parent 0288d7e698
commit c349353600

View File

@@ -49,13 +49,17 @@ public struct Token: CustomStringConvertible {
return try Keychain.update(
query: query,
attributesToUpdate: [kSecValueData: data]
attributesToUpdate: [
kSecValueData: data,
kSecUseDataProtectionKeychain: true
]
)
}
let query = Token.query.merging([
kSecClass: kSecClassGenericPassword,
kSecValueData: data
kSecValueData: data,
kSecUseDataProtectionKeychain: true
]) { (_, new) in new }
try Keychain.add(query: query)