ios - kSecAttrAccessibleAfterFirstUnlock 即使在首次解锁 iOS 后也不允许访问

Question

所以我有一个旧的敏感访问 key ，当前具有 kSecAttrAccessible WhenUnlocked 的可访问性，我想将其更新为 kSecAttrAccessibleAfterFirstUnlock。

我正在使用 Lockbox 并调用它:

[Lockbox setString:accessKey forKey:self.accessKeyName accessibility:kSecAttrAccessibleAfterFirstUnlock];

这又称为:

-(BOOL)setObject:(NSString *)obj forKey:(NSString *)key accessibility:(CFTypeRef)accessibility
{
    OSStatus status;

    NSString *hierKey = [self _hierarchicalKey:key];

    // If the object is nil, delete the item
    if (!obj) {
        NSMutableDictionary *query = [self _query];
        [query setObject:hierKey forKey:(LOCKBOX_ID)kSecAttrService];
        status = SecItemDelete((LOCKBOX_DICTREF)query);
        return (status == errSecSuccess);
    }

    NSMutableDictionary *dict = [self _service];
    [dict setObject: hierKey forKey: (LOCKBOX_ID) kSecAttrService];
    [dict setObject: (LOCKBOX_ID)(accessibility) forKey: (LOCKBOX_ID) kSecAttrAccessible];
    [dict setObject: [obj dataUsingEncoding:NSUTF8StringEncoding] forKey: (LOCKBOX_ID) kSecValueData];

    status = SecItemAdd ((LOCKBOX_DICTREF) dict, NULL);
    if (status == errSecDuplicateItem) {
        NSMutableDictionary *query = [self _query];
        [query setObject:hierKey forKey:(LOCKBOX_ID)kSecAttrService];
        status = SecItemDelete((LOCKBOX_DICTREF)query);
        if (status == errSecSuccess)
            status = SecItemAdd((LOCKBOX_DICTREF) dict, NULL);
    }
    if (status != errSecSuccess)
        DLog(@"SecItemAdd failed for key %@: %d", hierKey, (int)status);

    return (status == errSecSuccess);
}

正如您在上面所看到的，密码箱代码似乎会在存在重复项目时尝试添加该项目。我在那里放置了一个断点，可以确认它确实有效。

但是有时还是报错:

<Error>:  SecOSStatusWith error:[-25308] The operation couldn’t be completed. (OSStatus error -25308 - Remote error : The operation couldn‚Äôt be completed. (OSStatus error -25308 - ks_crypt: e00002e2 failed to unwrap item (class 6, bag: 0) Access to item attempted while keychain is locked.))

我不明白为什么我会得到这个 - 我已经解锁了我的手机，它应该可以正常工作。有什么想法吗？

我还应该补充一点，当应用程序被杀死并通过区域监控更新在后台恢复时，我需要访问它。

Answer 1

我必须先清除旧 key ，然后再清除新 key 。您可以这样做，也可以使用新的 kSecAccessibility 值创建一个具有不同名称的新 key 。