Failed to identify iOS OSStatus code

Question

I have really weird behavior in an iOS app. I switched from iOS 6 to iOS 7. In iOS 6, everything worked fine.

- (NSMutableDictionary *)newSearchDictionary:(NSString *)identifier { NSMutableDictionary *searchDictionary = [[NSMutableDictionary alloc] init]; [searchDictionary setObject:(__bridge id)kSecClassGenericPassword forKey:(__bridge id)kSecClass]; NSData *encodedIdentifier = [identifier dataUsingEncoding:NSUTF8StringEncoding]; [searchDictionary setObject:encodedIdentifier forKey:(__bridge id)kSecAttrGeneric]; [searchDictionary setObject:encodedIdentifier forKey:(__bridge id)kSecAttrAccount]; [searchDictionary setObject:serviceName forKey:(__bridge id)kSecAttrService]; return searchDictionary; } - (NSData *)searchKeychainCopyMatching:(NSString *)identifier { NSMutableDictionary *searchDictionary = [self newSearchDictionary:identifier]; [searchDictionary setObject:(__bridge id)kSecMatchLimitOne forKey:(__bridge id)kSecMatchLimit]; [searchDictionary setObject:(id)kCFBooleanTrue forKey:(__bridge id)kSecReturnData]; CFDataRef dataRef; OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)searchDictionary, (CFTypeRef *)&dataRef); if (status != errSecSuccess) { #ifdef DEBUG NSLog(@"%s - No OSStatus errSecSuccess. Caused by SecItemCopyMatching", __PRETTY_FUNCTION__); #endif return nil; } NSData *result = (__bridge_transfer NSData *)dataRef; return result; } 

When the application starts the function - (NSData *) searchKeychainCopyMatching: (NSString *) identifier , loads the values ​​from the keychain. Everything works fine for a while. But after about 15 successful value requests, I get an error.

OSStatus Code -34018

The SecItemCopyMatching function returns this error code. The documentation states

@result Result code. See "Security Error Codes" (SecBase.h).

But, looking in SecBase.h, only these OSStatus codes are indicated.

 enum { errSecSuccess = 0, /* No error. */ errSecUnimplemented = -4, /* Function or operation not implemented. */ errSecIO = -36, /*I/O error (bummers)*/ errSecOpWr = -49, /*file already open with with write permission*/ errSecParam = -50, /* One or more parameters passed to a function where not valid. */ errSecAllocate = -108, /* Failed to allocate memory. */ errSecUserCanceled = -128, /* User canceled the operation. */ errSecBadReq = -909, /* Bad parameter or invalid state for operation. */ errSecInternalComponent = -2070, errSecNotAvailable = -25291, /* No keychain is available. You may need to restart your computer. */ errSecDuplicateItem = -25299, /* The specified item already exists in the keychain. */ errSecItemNotFound = -25300, /* The specified item could not be found in the keychain. */ errSecInteractionNotAllowed = -25308, /* User interaction is not allowed. */ errSecDecode = -26275, /* Unable to decode the provided data. */ errSecAuthFailed = -25293, /* The user name or passphrase you entered is not correct. */ }; 

Values ​​are not redefined, already checked.

And last but not least, a search dictionary:

Edit - New Information

I was debugging all day and I found some news. I am downloading a zip file containing an executable package. This is an internal application, so do not worry about paragraphs 2.7 and 2.8 in the review guidelines. After successful download of the package, a rights error appears.

 NSBundle *bundle = nil; NSError *error = nil; bundle = [[NSBundle alloc] initWithPath:bundlePath]; if (!bundle) { return nil; } // Here i can access the keychain as usually [bundle loadAndReturnError:&error]; // Well here it suddenly doesn't work anymore // error is also nil 

Well, the package code inside does not use a keychain. Maybe this is some kind of security logic? Any clues?

Answer 1

This error indicates a problem with your application permissions. Found this : the reason is that the application identifier prefix in application rights does not match the application identifier prefix in the provisioning profile.

To check, use the codeign tool to view application permissions:

 codesign -d --entitlements - MyApp.app/ 

Then compare the application identifier prefix with the name in the provisioning profile:

 cat MyApp.app/embedded.mobileprovision