I am wondering how the Keychain identifies applications. I suspect that this based on code signing, but the experiments are not really consistent with this:

It works for executables that are not signed at all:

codesign -dv  /Library/Frameworks/R.framework/Resources/bin/exec/R
# /Library/Frameworks/R.framework/Resources/bin/exec/R: code object is not signed at all

But the R process is added to the ACL of this secret, and it can query it happily...

There is also nothing in the extended attributes of the executable:

xattr -l  /usr/bin/security

If I change the file itself, it still works:

cp /usr/bin/security foobar
echo "\nharmless" >> foobar
./foobar find-generic-password -a 'gaborcsardi' -s foobar -g
# keychain: "/Users/gaborcsardi/Library/Keychains/login.keychain"
# class: "genp"
# attributes:
#     0x00000007 <blob>="foobar"
#     0x00000008 <blob>=<NULL>
#     "acct"<blob>="gaborcsardi"
# ...
# password: "secret"

But then how does it work? More specifically, how does the keychain know that the password query is coming from the security app, that I specifically allowed access to this entry?

1 Answer 1


The Keychain doesn't identify applications, the applications call the Keychain API

The Keychain Services API provides a solution to this problem. By making a single call to this API, an app can store small bits of secret information on a keychain, from which the app can later retrieve the information—also with a single call. The keychain secures data by encrypting it before storing it in the file system, relieving you of the need to implement complicated encryption algorithms. The system also carefully controls access to stored items. The entire keychain can be locked, meaning no one can decrypt its protected contents until it is unlocked with a master password. Even with an unlocked keychain, the system’s Keychain Access policy ensures that only authorized apps gain access to a given item in the keychain. In the simplest case, the app that created an item is the only one that can access it later. However, Keychain Services also provides ways to share secrets among apps.

enter image description here

  • OK, so how does the keychain know that it does not have to ask for confirmation if /usr/bin/security queries a password? Commented Jan 20, 2017 at 12:50
  • A couple of things because this is now going off topic: 1) That's a different question and 2) did you read the API documentation? I suggest having a look at the Tour
    – Allan
    Commented Jan 20, 2017 at 12:59
  • OK, see the the small edits, maybe that clarifies the question. Yes, I did read the API documentation, but could not find this described anywhere. But the Keychain API reference is immerse, so maybe I just missed it. Commented Jan 20, 2017 at 14:02
  • You say "The Keychain doesn't identify applications,". So how does it know that executable 'x' has passwordless access to an entry and executable 'y' does not? Surely, it must identify them somehow, and it is (obviously) not doing it by their path. Commented Jan 20, 2017 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .