SMJobBless更新后无法访问钥匙串项目

We have a problem with updating a helper tool with SMJobBless that has been puzzling us for days now.

我们在使用SMJobBless更新帮助工具时遇到了问题，这种工具一直困扰着我们好几天。

We are developing an application for which at some point we need to perform administrative tasks (loading/unloading a kext). We are also using the keychain to store account information for our application.

我们正在开发一个应用程序，在某些时候我们需要执行管理任务（加载/卸载kext）。我们还使用钥匙串存储我们的应用程序的帐户信息。

For the administrative tasks, we use a helper tool that is installed using SMJobBless with which we communicate using DO over Mach ports (with NSConnection).

对于管理任务，我们使用一个使用SMJobBless安装的辅助工具，我们使用DO over Mach端口（使用NSConnection）进行通信。

In the helper tool:

在帮助工具中：

// use our bundle id as our service name
NSString* name = [[NSBundle mainBundle] bundleIdentifier];

launch_data_t checkinRequest = launch_data_new_string(LAUNCH_KEY_CHECKIN);
launch_data_t checkinResponse = launch_msg(checkinRequest);
launch_data_t machServicesDict = launch_data_dict_lookup(checkinResponse, LAUNCH_JOBKEY_MACHSERVICES);
launch_data_t machPort = launch_data_dict_lookup(machServicesDict, [name UTF8String]);

mach_port_t mp = launch_data_get_machport(machPort);

launch_data_free(checkinResponse);
launch_data_free(checkinRequest);

NSMachPort *receivePort = [[NSMachPort alloc] initWithMachPort:mp];
NSConnection *server = [NSConnection connectionWithReceivePort:receivePort sendPort:nil];        

In the app:

在应用程序中：

NSConnection *conn = [NSConnection connectionWithRegisteredName:HELPER_BUNDLE_IDENTIFIER host:nil];

id proxyServerObject = [conn rootProxy];

if(conn && proxyServerObject) {
    return [proxyServerObject someMethod];
}
return NO;

We sign both the application and the helper tool using a codesign certificate from Thawte. So far, everything works like a charm. The helper tool is installed and we can communicate with it using DO; our kext is loaded and unloaded successfully.

我们使用Thawte的代码签名证书对应用程序和帮助工具进行签名。到目前为止，一切都像一个魅力。帮助工具已安装，我们可以使用DO与它通信;我们的kext已成功加载和卸载。

The problem starts when we try to update our helper tool. We use the info dictionary of the installed tool and the bundled tool in our app bundle to check whether an update of the tool is required and call SMJobBless again to perform the update.

当我们尝试更新我们的帮助工具时，问题就出现了。我们使用已安装工具的信息字典和我们的应用程序包中的捆绑工具来检查是否需要更新工具并再次调用SMJobBless来执行更新。

After the SMJobBless call, the following lines appear in the Console:

在SMJobBless调用之后，控制台中将显示以下行：

6/19/12 10:31:24.000 AM kernel: CODE SIGNING: cs_invalid_page(0x104e17000): p=74362[OURAPP] clearing CS_VALID
6/19/12 10:31:24.000 AM kernel: CODE SIGNING: cs_invalid_page(0x10d0de000): p=74364[OURAPPHELPER] clearing CS_VALID

After this, the application is unable to read the application password from our keychain item, the function SecKeychainItemCopyContent returns errSecAuthFailed (-25293). However, no error is reported if we manually verify the code signature of our installed helper tool or application bundle using codesign -vvvv PATH_TO_TOOL_OR_BUNDLE. The tool and application are signed outside of the Xcode environment and the contents are not altered after the signing process.

此后，应用程序无法从我们的钥匙串项读取应用程序密码，SecKeychainItemCopyContent函数返回errSecAuthFailed（-25293）。但是，如果我们使用codesign -vvvv PATH_TO_TOOL_OR_BUNDLE手动验证已安装的帮助工具或应用程序包的代码签名，则不会报告错误。该工具和应用程序在Xcode环境之外签名，签名过程后内容不会更改。

We have found one other post that describes a similar situation, but that question is still unanswered. A related issue might be SMJobBless returning error 4098.

我们发现了另一篇描述类似情况的帖子，但这个问题仍然没有答案。相关问题可能是SMJobBless返回错误4098。

We are testing on OSX 10.7.4.

我们正在测试OSX 10.7.4。

Anyone faced similar issues or is there something obvious that we are doing wrong?

任何人都面临类似的问题，或者有什么明显的事情我们做错了吗？

1 个解决方案

#1

This is due to a bug related to how SMJobBless replaces the helper tool on disk. In particular, it modifies the binary in place rather than taking the common approach of writing to a temporary file and then renaming it over top of the destination. The effect of this is that if the binary is in memory, the modifications to the file change the memory pages backing the file, invalidating their code signature. I've written up a bug report about this as rdar://problem/13514523. I'd encourage you to file your own if you've not done so already.

这是由于与SMJobBless如何替换磁盘上的帮助工具有关的错误。特别是，它修改了二进制文件，而不是采用写入临时文件的常用方法，然后将其重命名为目标之上。这样做的结果是，如果二进制文件在内存中，对文件的修改会更改支持文件的内存页，从而使其代码签名无效。我已经写了一个关于这个的错误报告，如rdar：// problem / 13514523。如果你还没有这样做，我建议你自己提交。

A possible workaround may be to have your application ask the helper tool to remove itself from disk before you use SMJobBless to upgrade it. This should result in SMJobBless copying to a new file on disk, bypassing the issue.

可能的解决方法可能是让您的应用程序要求帮助程序工具在使用SMJobBless进行升级之前将其自身从磁盘中删除。这应该导致SMJobBless复制到磁盘上的新文件，绕过该问题。