Launch Daemon is not able to access login keychain entries

Question

Created Jul ’20

Replies 1

Boosts 0

Views 1.3k

Participants 2

I have a command line process which is calling an API and fetching tokens from login keychain. When I am running this process standalone with/without sudo from terminal, it is able to access the keychain entries. Now I have converted this into a launch daemon and trying to execute it as a launch daemon then it is not able to access tokens and giving me the error as **"errSecItemNotFound = -25300, /* The specified item could not be found in the keychain. */". **
I am using the below plist for creating the launch daemon.

Code Block <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
		<key>Label</key>
		<string>TestAuth_SilentDaemon</string>
		<key>Program</key>
		<string>*complete path of TestAuth_SilentDaemon*</string>	
		<key>KeepAlive</key>
		<true/>
		<key>SessionCreate</key>
		<true/>
</dict>
</plist>

Is there any way we can access the login keychain items using launch daemons with sudo?
Further I tried to execute launch daemon by impersonating the logged in user context "su user_name" and tried to execute it without sudo. Now also I am not able to get the access of keychain entries and got the different error **as errSecInteractionNotAllowed = -25308, /* User interaction is not allowed. */**
Is there any way of truly impersonating the logged int user context to execute the launch daemon so that I can get access of login keychain items?

Answer 1

TyngJJ OP

Jul ’20

There are a few parts here with how you expect your tool to 1) find a/the keychain 2) access it 3) have permission.
If you're running a LaunchDaemon (not a LaunchAgent) without specifying the user, it runs as root. That implies you're using the system keychain, not your personal login one.
User interaction not allowed means your process is trying to prompt for access (it wasn't granted it already), and user interaction has been disallowed (common when you're not running in a GUI-capable session, can also be specified at runtime using the relevant API in the Security framework).
Daemon processes should always be given access to the keychain items they need beforehand, and shouldn't require user interaction.