launchctl LaunchDaemons and keychain access

Is there a way to make this work with /Library/LaunchDaemons, possibly through some plist property?

The problem here is that you are using a daemon, which uses a system context, whereas an agent uses a user context. For this reason you can run into all sorts of strange issues with access a user level Keychain and other edge cases with code signing and the Security framework. My recommendation would be to use an agent, if you must do this, to make sure you can execute from a user context.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Hi Matt,

thank you for your advise. I would like to note that I am setting the user in the job properties.

<key>UserName</key>
<string>dev</string>

Apparently, this is not enough to setup up the proper context. Could you elaborate please how I can achieve this?

I prefer a solution that automatically starts up after reboot to minimize the maintenance effort. As an alternative, is there a way to pass the certificate / signing identity differently to the codesign executable? Or would it have to reside in a keychain?

Best regards

Maik

Maik,

I would like to note that I am setting the user in the job properties.

<key>UserName</key>
<string>dev</string>

Right, so when you do this you are running a system daemon in a global context, acting as a specific user. I suspect this is what is causing you the issues here. To make you code work in a user context you will need to run as an agent.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Thank You Matt,

I might just stick with the agent for now.

For completeness, I've been toying with ways to avoid the agent. When I unlock the default keychain prior to codesigning, it seems to work, i.e.

security unlock-keychain -p <PASSWORD>

I would like to note the security implications, potentially giving access to all information inside the keychain to all kinds of tasks.

Best regards

Maik

Using Xcode 12.5 and 13, unlocking the keychain from a non GUI session (i.e. SSH) does not work anymore. codesign fails with errSecInternalComponent

I filed a RADAR report to Apple https://feedbackassistant.apple.com/feedback/9642986

@maikschulze what is the Xcode and macOS version you're using ? For me "security unlock-keychain" does not work on global context (when I SSH to the instance, no GUI session whatsoever) I Tried with macOS 11.5, 11.6 and Xcode 12.5.1 and Xcode 13

I lost days to this, but finally found a solution. https://stackoverflow.com/questions/47582989/launchd-not-able-to-access-mac-os-keychains

Add this to your plist

<key>SessionCreate</key>
<true/>

Our LaunchDaemon can run xcode builds, and finds a valid identity to sign with now.

Also had to add the Apple Worlwide Developer Relation cert to the system keychain

if [ ! -f ./AppleWWDRCAG3.cer ]; then
    echo "Downloadind Apple Worlwide Developer Relation GA3 certificate"
    curl -s -o ./AppleWWDRCAG3.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
fi
echo "Installing Apple Worlwide Developer Relation GA3 certificate into System keychain"
SYSTEM_KEYCHAIN=/Library/Keychains/System.keychain
sudo security import ./AppleWWDRCAG3.cer -t cert -k "${SYSTEM_KEYCHAIN}"