System Keychain Certs Import fail with UNIX[Operation not permitted]

Question

I'm trying to add certs to my System keychain, which failed in the Keychain Access utility with a ERROR 10001 -- an unhelpful error message -- so I tried to run it in the terminal:

$sudo security import RootCert.cer  -k /Library/Keychains/System.keychain

security: SecKeychainItemImport: UNIX[Operation not permitted]

Does anyone know what is going on here?

I don't believe that this keychain is subject to System Integrity Protection (SIP) as indicated in this answer since I'm not modifying /System. I can definitely add the certs to my Login keychain, but I need it to be in the System keychain for my application to function.

EDIT: I'm running High Sierra (10.13.5)

Answer 1

The issue is that, somehow (not sure how), the extra restricted flag was add to System.keychain which meant it could not be modified while the system is running. Thus, it was SIP protected. I followed this guide to correct the issue.

(From the guide) You can check if your keychain is restricted using the following ls flags in the Terminal

cd /Library/Keychain
ls -@Oaen

My original output had the following info --- note the restricted flag on System.keychain.

total 536
drwxr-xr-x  11 0  0  -             352 Jun 21 08:54 .
drwxr-xr-x+ 66 0  0  sunlnk       2112 Jun  4 17:28 ..
 0: ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C deny delete
-r--r--r--@  1 0  0  -               0 Jun 15  2016 .fl043D1EDD
    com.apple.quarantine        29 
-r--r--r--   1 0  0  -               0 Jun 15  2016 .fl947E1BDB
-r--r--r--   1 0  0  -               0 Jun 21 07:59 .flD2C1AB74
drwxr-xr-x   2 0  0  -              64 Jun  4 17:32 SupplementalsAssets
-rw-r--r--@  1 0  0  restricted 124792 Jun 19  2016 System.keychain
    com.apple.metadata:_kTimeMachineNewestSnapshot      50 
    com.apple.metadata:_kTimeMachineOldestSnapshot      50 
-rw-r--r--   1 0  0  -           33208 Jul  1  2016 System.keychain-orig
-rw-r--r--@  1 0  0  -           53488 Jul  1  2016 apsd.keychain
    com.apple.quarantine        29 
drwxr-xr-x   3 0  0  -              96 Jun 21 07:50 crls
-rw-r--r--   1 0  0  -           53248 Jun  4 17:32 pinningrules.sqlite3

To correct this, you have to boot into recovery mode. Hold down CMD-R during reboot when hear the chime. When there:

1. Open DiskUtility and check to make sure your main disk is mounted. It will not be if use FileVault to encrypt it. If not, mount it by entering your password. Quit DiskUtility.

2. Under Utilities menu, you can open a Terminal, change directory to keychain folder and edit the restrictions. (Note your volume name may be different if you have a non-standard installation.)

   cd "/Volumes/Macintosh HD/Library/Keychains/"
   chflags norestricted *
   

3. Check the ls -@Oaen and you should not see the restricted tag.

4. Exit Terminal and reboot.

Answer 2

This is an old question, but the issue still occurs. I'm on Ventura 13.5.2, and still seeing the issue.

The simple fix, is close the Keychain Access.app app and then add it to Full Disk Access in System Settings. No need to reboot, or disable SIP.