3 ms·
There is no difference between a signed and unsigned app once it has been allowed to launch the first time. The permission model is the same for both. Normally
by teilo 9y ago
There is no difference between a signed and unsigned app once it has been allowed to launch the first time. The permission model is the same for both. Normally you would have expected to see a system dialog asking if you would like to grant an app permission to access the keychain once or permanently.
EDIT: As another commenter pointed out, an app is also only granted access to one key at a time, each requiring an independent confirmation (with password). There is no way (normally) to grant cart-blanche access to the entire keychain.
- anyfoo 9y agoFalse. Signed apps can have entitlements, unsigned apps cannot. Some entitlements grant access to keychain items.
- teilo 9y agoCompletely wrong. Entitlements are for sandboxed apps, and grant a sandboxed application access to other parts of the system. Unsigned apps are by definition, not sandboxed, and have no such restrictions. They are granted access, not by a sandbox entitlement, but by the Keychain API.
- mikeash 9y agoThere are both sandbox and non-sandbox entitlements. iCloud storage and push notifications are examples of the latter.
- teilo 9y agoGranted. In any case it is not relevant in the context of this discussion. Access to the local keychain does not require an entitlement. Even the "keychain-access-groups" entitlement only applies to the iCloud keychain.