Module acl 

Public ACL blobs, parsed and produced as structures.

Every key blob carries a public ACL between its fixed header and its encrypted region. Apple’s serialization of AclEntryPrototype is not published in a form this could be built from, so the layout here was recovered from keychains written by security add-generic-password -A.

What is established, by parsing samples whose item names are 1, 4, 5, 8, 9, 11 and 12 bytes long and re-serializing them byte for byte, is the shape:

blob  := owner entry, entry count, count x entry
entry := kind word, subject words, name, authorization group
name  := bytes, NUL terminator, padding to a 4-byte boundary

The owner entry has one fewer subject word than the others and no authorization group. Field meanings are not guessed at: the words whose purpose is unknown are carried in Subject::Unknown and reproduced as they were read, and the constants this code writes are the ones macOS writes. Authorization names only the two tag sets that appear.

Structs

AclBlob

A public ACL blob.

AclEntry

One ACL entry.

TrustedApplication

One application an ACL entry trusts.

Enums

Authorization

The authorization tag sets that appear in keychain item ACLs.

EntryKind

Which of the two roles an entry plays in the blob.

Subject

Who an ACL entry grants access to.

Functions

database_public_acl

The public ACL of the database blob itself, which is the same in every keychain macOS writes and does not follow the entry layout above.

item_public_acl

The public ACL for an item’s key, naming the item.