main.m   [plain text]

//
//  main.m
//  seckeychainnetworkextensionunauthorizedaccesstest
//
//  Created by Luke Hiesterman on 2/23/17.
//

#import <Foundation/Foundation.h>
#import <Security/Security.h>
#import <Security/SecItemPriv.h>
#import <err.h>

static NSString* NetworkExtensionPersistentRefSharingAccessGroup = @"com.apple.NetworkExtensionPersistentRefSharingAccessGroup";
static NSString* TestAccount = @"MyTestAccount";

int main(int argc, const char* argv[])
{
    @autoreleasepool {
        NSMutableDictionary* attributes = [NSMutableDictionary dictionary];
        attributes[(__bridge NSString*)kSecClass] = (__bridge NSString*)kSecClassGenericPassword;
        attributes[(__bridge NSString*)kSecAttrAccessGroup] = NetworkExtensionPersistentRefSharingAccessGroup;
        attributes[(__bridge NSString*)kSecAttrAccount] = TestAccount;
        attributes[(__bridge NSString*)kSecReturnData] = @YES;
        attributes[(__bridge NSString*)kSecAttrNoLegacy] = @YES;

        CFTypeRef persistentRefData = NULL;
        OSStatus result = SecItemCopyMatching((__bridge CFDictionaryRef)attributes, &persistentRefData);
        if (result != 0 || !persistentRefData) {
            NSLog(@"got an error: %d", (int)result);
            errx(1, "failed to retrieve persistent ref data from keychain");
        }
        
        attributes = [NSMutableDictionary dictionary];
        attributes[(__bridge NSString*)kSecClass] = (__bridge NSString*)kSecClassGenericPassword;
        attributes[(__bridge NSString*)kSecValuePersistentRef] = (__bridge NSData*)persistentRefData;
        attributes[(__bridge NSString*)kSecReturnData] = @YES;
        attributes[(__bridge NSString*)kSecAttrNoLegacy] = @YES;

        CFTypeRef passwordData = NULL;
        result = SecItemCopyMatching((__bridge CFDictionaryRef)attributes, &passwordData);
        if (result == 0 && passwordData) {
            errx(1, "failed to block unentitled app from accessing network extension keychain item");
        }
        else {
            NSLog(@"successfully blocked unentitled app from accessing network extension keychain item");
        }
    }
    return 0;
}