ios - iOS 上的默认文件保护是什么以及如何更改它

Question

阅读这里:(https://developer.apple.com/library/content/documentation/IDEs/Conceptual/AppDistributionGuide/AddingCapabilities/AddingCapabilities.html)

Enabling Data Protection (iOS, WatchKit Extension, tvOS)

Data protection adds a level of security to files stored on disk by your app in the app’s container. Data protection uses the built-in encryption hardware present on specific devices to store files in an encrypted format on disk. Your app needs to be provisioned to use data protection.

To enable data protection

In the Capabilities pane, if Data Protection isn’t enabled, click the switch in the Data Protection section.

The default level of protection is complete protection, in which files are encrypted and inaccessible when the device is locked. You can programmatically set the level of protection for files created by your app, as described in Protecting Data Using On-Disk Encryption in App Programming Guide for iOS. For files stored in shared containers (described in Configuring App Groups), set the level of protection programmatically.

似乎默认保护是 NSFileProtectionComplete，但我不认为这是真的，如果你不启用它，我认为默认是 NSFileProtectionCompleteUntilFirstUserAuthentication。

问题 #1:应用程序写入的文件的默认文件保护是什么？

问题#2:
我可以更改所有文件的默认设置吗？

在权利文件中启用“数据保护”并将其设置为 NSFileProtectionComplete 是否意味着在应用程序中创建/存储的所有文件都使用 NSFileProtectionComplete 规则加密，而无需执行任何其他操作。 IE 是否需要启用它并为每个要以编程方式保护的文件设置文件保护？

我试过测试这个。我已打开数据保护(权利)和供应/应用程序。我通过 xcode 将应用程序部署到设备并抓取数据库文件以检查其 NSFileProtectionKey:

NSURL *database = [NSPersistentStore MR_urlForStoreName:@"app.sqlite"]id fileProtectionValue = [[[NSFileManager defaultManager] attributesOfItemAtPath:[数据库路径] error:NULL] valueForKey:NSFileProtectionKey];NSLog(@"文件保护值:%@", fileProtectionValue);

然而，这仍然会吐出“NSFileProtectionCompleteUntilFirstUserAuthentication”。

我已尝试删除该应用程序并重新安装。还验证了所有配置文件都已重新下载。

打开数据保护是否真的会更改应用内所有文件的文件保护 key 。 IE 这是一个有效的测试吗？

如果没有，我如何测试文件是否已正确加密？

Answer 1

Question #1: What is the default file protection for files written by the app?

根据 Apple's docs (第 16 页)，它是 NSFileProtectionCompleteUntilFirstUserAuthentication ( new docs here )

This is the default class for all third-party app data not otherwise assigned to a Data Protection class.

和

Question #2: Can I change the default for all files?

是的，在 Apple 开发者中心的配置文件/应用程序 ID 的权利中。

Remember that file protection is inherited at creation time, so if you want an entire file system hierarchy to use this mode you can set it on the root directory of that hierarchy when you created it and everything inside will pick it up from there.

通过https://forums.developer.apple.com/thread/91557#276303

如果需要，您还可以指定文件特定的属性。

---

有关测试的其他信息:https://stackoverflow.com/a/40044841/308315