1  /*
  2   * Copyright (c) 2017 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   *
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   *
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   *
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  #import "SFKeychainServer.h"
 25  #import <TargetConditionals.h>
 26  
 27  #if !TARGET_OS_BRIDGE
 28  #if __OBJC2__
 29  
 30  #import "SecCDKeychain.h"
 31  #import "SecFileLocations.h"
 32  #import "debugging.h"
 33  #import "CloudKitCategories.h"
 34  #import "SecAKSWrappers.h"
 35  #include "securityd_client.h"
 36  #import "server_entitlement_helpers.h"
 37  #import "SecTask.h"
 38  #import "keychain/categories/NSError+UsefulConstructors.h"
 39  #import "SecEntitlements.h"
 40  #import <Security/SecXPCHelper.h>
 41  #import <SecurityFoundation/SFKeychain.h>
 42  #import <SecurityFoundation/SFCredential_Private.h>
 43  #import <SecurityFoundation/SFCredentialStore_Private.h>
 44  #import <Foundation/NSKeyedArchiver_Private.h>
 45  #import <Foundation/NSXPCConnection_Private.h>
 46  
 47  static NSString* const SFKeychainItemAttributeLocalizedLabel = @"label";
 48  static NSString* const SFKeychainItemAttributeLocalizedDescription = @"description";
 49  
 50  static NSString* const SFCredentialAttributeUsername = @"username";
 51  static NSString* const SFCredentialAttributePrimaryServiceIdentifier = @"primaryServiceID";
 52  static NSString* const SFCredentialAttributeSupplementaryServiceIdentifiers = @"supplementaryServiceIDs";
 53  static NSString* const SFCredentialAttributeCreationDate = @"creationDate";
 54  static NSString* const SFCredentialAttributeModificationDate = @"modificationDate";
 55  static NSString* const SFCredentialAttributeCustom = @"customAttributes";
 56  static NSString* const SFCredentialSecretPassword = @"password";
 57  
 58  @interface SFCredential (securityd_only)
 59  
 60  - (instancetype)_initWithUsername:(NSString*)username primaryServiceIdentifier:(SFServiceIdentifier*)primaryServiceIdentifier supplementaryServiceIdentifiers:(nullable NSArray<SFServiceIdentifier*>*)supplementaryServiceIdentifiers;
 61  
 62  @end
 63  
 64  @interface SFKeychainServerConnection ()
 65  
 66  - (instancetype)initWithKeychain:(SecCDKeychain*)keychain xpcConnection:(NSXPCConnection*)connection;
 67  
 68  @end
 69  
 70  @implementation SecCDKeychainItemTypeCredential
 71  
 72  + (instancetype)itemType
 73  {
 74      static SecCDKeychainItemTypeCredential* itemType = nil;
 75      static dispatch_once_t onceToken;
 76      dispatch_once(&onceToken, ^{
 77          itemType = [[self alloc] _initWithName:@"Credential" version:1 primaryKeys:@[SFCredentialAttributeUsername, SFCredentialAttributePrimaryServiceIdentifier] syncableKeys:nil];
 78      });
 79  
 80      return itemType;
 81  }
 82  
 83  @end
 84  
 85  @implementation SFKeychainServer {
 86      SecCDKeychain* _keychain;
 87  }
 88  
 89  - (instancetype)initWithStorageURL:(NSURL*)persistentStoreURL modelURL:(NSURL*)managedObjectURL encryptDatabase:(bool)encryptDatabase
 90  {
 91      if (self = [super init]) {
 92          _keychain = [[SecCDKeychain alloc] initWithStorageURL:persistentStoreURL modelURL:managedObjectURL encryptDatabase:encryptDatabase];
 93      }
 94  
 95      return self;
 96  }
 97  
 98  - (BOOL)listener:(NSXPCListener*)listener shouldAcceptNewConnection:(NSXPCConnection*)newConnection
 99  {
100      NSNumber* keychainDenyEntitlement = [newConnection valueForEntitlement:(__bridge NSString*)kSecEntitlementKeychainDeny];
101      if ([keychainDenyEntitlement isKindOfClass:[NSNumber class]] && keychainDenyEntitlement.boolValue == YES) {
102          secerror("SFKeychainServer: connection denied due to entitlement %@", kSecEntitlementKeychainDeny);
103          return NO;
104      }
105  
106      // wait a bit for shared function from SecurityFoundation to get to SDK, then addopt that
107      NSXPCInterface* interface = [NSXPCInterface interfaceWithProtocol:@protocol(SFKeychainServerProtocol)];
108  
109      NSSet<Class> *errorClasses = [SecXPCHelper safeErrorClasses];
110  
111      [interface setClasses:errorClasses forSelector:@selector(rpcAddCredential:withAccessPolicy:reply:) argumentIndex:1 ofReply:YES];
112      [interface setClasses:errorClasses forSelector:@selector(rpcFetchPasswordCredentialForPersistentIdentifier:reply:) argumentIndex:2 ofReply:YES];
113      [interface setClasses:errorClasses forSelector:@selector(rpcLookupCredentialsForServiceIdentifiers:reply:) argumentIndex:1 ofReply:YES];
114      [interface setClasses:errorClasses forSelector:@selector(rpcRemoveCredentialWithPersistentIdentifier:reply:) argumentIndex:1 ofReply:YES];
115      [interface setClasses:errorClasses forSelector:@selector(rpcReplaceOldCredential:withNewCredential:reply:) argumentIndex:1 ofReply:YES];
116      [interface setClasses:errorClasses forSelector:@selector(rpcReplaceCredential:withNewCredential:reply:) argumentIndex:1 ofReply:YES];
117  
118      [interface setClasses:[NSSet setWithObjects:[NSArray class], [SFServiceIdentifier class], nil] forSelector:@selector(rpcLookupCredentialsForServiceIdentifiers:reply:) argumentIndex:0 ofReply:NO];
119      [interface setClasses:[NSSet setWithObjects:[NSArray class], [SFPasswordCredential class], nil] forSelector:@selector(rpcLookupCredentialsForServiceIdentifiers:reply:) argumentIndex:0 ofReply:YES];
120      newConnection.exportedInterface = interface;
121      newConnection.exportedObject = [[SFKeychainServerConnection alloc] initWithKeychain:_keychain xpcConnection:newConnection];
122      [newConnection resume];
123      return YES;
124  }
125  
126  - (SecCDKeychain*)_keychain
127  {
128      return _keychain;
129  }
130  
131  @end
132  
133  @implementation SFKeychainServerConnection {
134      SecCDKeychain* _keychain;
135      NSArray* _clientAccessGroups;
136  }
137  
138  @synthesize clientAccessGroups = _clientAccessGroups;
139  
140  - (instancetype)initWithKeychain:(SecCDKeychain*)keychain xpcConnection:(NSXPCConnection*)connection
141  {
142      if (self = [super init]) {
143          _keychain = keychain;
144          
145          SecTaskRef task = SecTaskCreateWithAuditToken(NULL, connection.auditToken);
146          if (task) {
147              _clientAccessGroups = (__bridge_transfer NSArray*)SecTaskCopyAccessGroups(task);
148          }
149          CFReleaseNull(task);
150      }
151      
152      return self;
153  }
154  
155  - (keyclass_t)keyclassForAccessPolicy:(SFAccessPolicy*)accessPolicy
156  {
157      if (accessPolicy.accessibility.mode == SFAccessibleAfterFirstUnlock) {
158          if (accessPolicy.sharingPolicy == SFSharingPolicyThisDeviceOnly) {
159              return key_class_cku;
160          }
161          else {
162              return key_class_ck;
163          }
164      }
165      else {
166          if (accessPolicy.sharingPolicy == SFSharingPolicyThisDeviceOnly) {
167              return key_class_aku;
168          }
169          else {
170              return key_class_ak;
171          }
172      }
173  }
174  
175  - (void)rpcAddCredential:(SFCredential*)credential withAccessPolicy:(SFAccessPolicy*)accessPolicy reply:(void (^)(NSString* persistentIdentifier, NSError* error))reply
176  {
177      if (![credential isKindOfClass:[SFPasswordCredential class]]) {
178          reply(nil, [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorInvalidParameter userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"attempt to add credential to SFCredentialStore that is not a password credential: %@", credential]}]);
179          return;
180      }
181  
182      NSString* accessGroup = accessPolicy.accessGroup;
183      if (!accessGroup) {
184          NSError* error = nil;
185          accessGroup = self.clientAccessGroups.firstObject;
186          if (!accessGroup) {
187              error = [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorMissingAccessGroup userInfo:@{NSLocalizedDescriptionKey : @"no keychain access group found; ensure that your process has the keychain-access-groups entitlement"}];
188              reply(nil, error);
189              return;
190          }
191      }
192  
193      SFPasswordCredential* passwordCredential = (SFPasswordCredential*)credential;
194  
195      NSError* error = nil;
196      NSData* primaryServiceIdentifierData = [NSKeyedArchiver archivedDataWithRootObject:passwordCredential.primaryServiceIdentifier requiringSecureCoding:YES error:&error];
197      if (!primaryServiceIdentifierData) {
198          dispatch_async(dispatch_get_global_queue(QOS_CLASS_DEFAULT, 0), ^{
199              reply(nil, [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorSaveFailed userInfo:@{ NSLocalizedDescriptionKey : @"failed to serialize primary service identifier", NSUnderlyingErrorKey : error }]);
200          });
201          return;
202      }
203  
204      NSMutableArray* serializedSupplementaryServiceIdentifiers = [[NSMutableArray alloc] initWithCapacity:passwordCredential.supplementaryServiceIdentifiers.count];
205      for (SFServiceIdentifier* serviceIdentifier in passwordCredential.supplementaryServiceIdentifiers) {
206          NSData* serviceIdentifierData = [NSKeyedArchiver archivedDataWithRootObject:serviceIdentifier requiringSecureCoding:YES error:&error];
207          if (serviceIdentifierData) {
208              [serializedSupplementaryServiceIdentifiers addObject:serviceIdentifierData];
209          }
210          else {
211              dispatch_async(dispatch_get_global_queue(QOS_CLASS_DEFAULT, 0), ^{
212                  reply(nil, [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorSaveFailed userInfo:@{ NSLocalizedDescriptionKey : @"failed to serialize supplementary service identifier", NSUnderlyingErrorKey : error }]);
213              });
214              return;
215          }
216      }
217  
218      NSDictionary* attributes = @{ SFCredentialAttributeUsername : passwordCredential.username,
219                                    SFCredentialAttributePrimaryServiceIdentifier : primaryServiceIdentifierData,
220                                    SFCredentialAttributeSupplementaryServiceIdentifiers : serializedSupplementaryServiceIdentifiers,
221                                    SFCredentialAttributeCreationDate : [NSDate date],
222                                    SFCredentialAttributeModificationDate : [NSDate date],
223                                    SFKeychainItemAttributeLocalizedLabel : passwordCredential.localizedLabel,
224                                    SFKeychainItemAttributeLocalizedDescription : passwordCredential.localizedDescription,
225                                    SFCredentialAttributeCustom : passwordCredential.customAttributes ?: [NSDictionary dictionary] };
226      
227      NSDictionary* secrets = @{ SFCredentialSecretPassword : passwordCredential.password };
228      NSUUID* persistentID = [NSUUID UUID];
229  
230      // lookup attributes:
231      // 1. primaryServiceIdentifier (always)
232      // 2. username (always)
233      // 3. label (if present)
234      // 4. description (if present)
235      // 5. each of the service identifiers by type, e.g. "domain"
236      // 6. any custom attributes that fit the requirements (key is string, and value is plist type)
237  
238      SecCDKeychainLookupTuple* primaryServiceIdentifierLookup = [SecCDKeychainLookupTuple lookupTupleWithKey:SFCredentialAttributePrimaryServiceIdentifier value:primaryServiceIdentifierData];
239      SecCDKeychainLookupTuple* usernameLookup = [SecCDKeychainLookupTuple lookupTupleWithKey:SFCredentialAttributeUsername value:passwordCredential.username];
240      SecCDKeychainLookupTuple* labelLookup = [SecCDKeychainLookupTuple lookupTupleWithKey:SFKeychainItemAttributeLocalizedLabel value:passwordCredential.localizedLabel];
241      SecCDKeychainLookupTuple* descriptionLookup = [SecCDKeychainLookupTuple lookupTupleWithKey:SFKeychainItemAttributeLocalizedDescription value:passwordCredential.localizedDescription];
242      NSMutableArray* lookupAttributes = [[NSMutableArray alloc] initWithObjects:primaryServiceIdentifierLookup, usernameLookup, nil];
243      if (labelLookup) {
244          [lookupAttributes addObject:labelLookup];
245      }
246      if (descriptionLookup) {
247          [lookupAttributes addObject:descriptionLookup];
248      }
249  
250      SFServiceIdentifier* primaryServiceIdentifier = credential.primaryServiceIdentifier;
251      [lookupAttributes addObject:[SecCDKeychainLookupTuple lookupTupleWithKey:primaryServiceIdentifier.lookupKey value:primaryServiceIdentifier.serviceID]];
252      for (SFServiceIdentifier* serviceIdentifier in credential.supplementaryServiceIdentifiers) {
253          [lookupAttributes addObject:[SecCDKeychainLookupTuple lookupTupleWithKey:serviceIdentifier.lookupKey value:serviceIdentifier.serviceID]];
254      }
255  
256      [passwordCredential.customAttributes enumerateKeysAndObjectsUsingBlock:^(NSString* customKey, id value, BOOL* stop) {
257          if ([customKey isKindOfClass:[NSString class]]) {
258              SecCDKeychainLookupTuple* lookupTuple = [SecCDKeychainLookupTuple lookupTupleWithKey:customKey value:value];
259              if (lookupTuple) {
260                  [lookupAttributes addObject:lookupTuple];
261              }
262              else {
263                  // TODO: an error here?
264              }
265          }
266      }];
267  
268      SecCDKeychainAccessControlEntity* owner = [SecCDKeychainAccessControlEntity accessControlEntityWithType:SecCDKeychainAccessControlEntityTypeAccessGroup stringRepresentation:accessGroup];
269      keyclass_t keyclass = [self keyclassForAccessPolicy:accessPolicy];
270      SecCDKeychainItem* item = [[SecCDKeychainItem alloc] initItemType:[SecCDKeychainItemTypeCredential itemType] withPersistentID:persistentID attributes:attributes lookupAttributes:lookupAttributes secrets:secrets owner:owner keyclass:keyclass];
271      [_keychain insertItems:@[item] withConnection:self completionHandler:^(bool success, NSError* insertError) {
272          if (success && !insertError) {
273              reply(persistentID.UUIDString, nil);
274          }
275          else {
276              reply(nil, insertError);
277          }
278      }];
279  }
280  
281  - (void)rpcFetchPasswordCredentialForPersistentIdentifier:(NSString*)persistentIdentifier reply:(void (^)(SFPasswordCredential* credential, NSString* password, NSError* error))reply
282  {
283      // TODO: negative testing
284      NSUUID* persistentID = [[NSUUID alloc] initWithUUIDString:persistentIdentifier];
285      if (!persistentID) {
286          secerror("SFKeychainServer: attempt to fetch credential with invalid persistent identifier; %@", persistentIdentifier);
287          reply(nil, nil, [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorInvalidPersistentIdentifier userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"invalid persistent identifier: %@", persistentIdentifier]}]);
288          return;
289      }
290  
291      [_keychain fetchItemForPersistentID:persistentID withConnection:self completionHandler:^(SecCDKeychainItem* item, NSError* error) {
292          NSError* localError = error;
293          SFPasswordCredential* credential = nil;
294          if (item && !error) {
295              credential = [self passwordCredentialForItem:item error:&localError];
296          }
297          
298          if (credential) {
299              reply(credential, credential.password, nil);
300          }
301          else {
302              reply(nil, nil, localError);
303          }
304      }];
305  }
306  
307  - (void)rpcLookupCredentialsForServiceIdentifiers:(nullable NSArray<SFServiceIdentifier*>*)serviceIdentifiers reply:(void (^)(NSArray<SFCredential*>* _Nullable results, NSError* _Nullable error))reply
308  {
309      __block NSMutableDictionary* resultsDict = [[NSMutableDictionary alloc] init];
310      __block NSError* resultError = nil;
311      
312      void (^processFetchedItems)(NSArray*) = ^(NSArray* fetchedItems) {
313          for (SecCDKeychainItemMetadata* item in fetchedItems) {
314              if ([item.itemType isKindOfClass:[SecCDKeychainItemTypeCredential class]]) {
315                  SFPasswordCredential* credential = [self passwordCredentialForItemMetadata:item error:&resultError];
316                  if (credential) {
317                      resultsDict[item.persistentID] = credential;
318                  }
319                  else {
320                      resultsDict = nil; // got an error
321                  }
322              }
323          }
324      };
325  
326      if (!serviceIdentifiers) {
327          // TODO: lookup everything
328      }
329      else {
330          for (SFServiceIdentifier* serviceIdentifier in serviceIdentifiers) {
331              dispatch_semaphore_t semaphore = dispatch_semaphore_create(0);
332              // TODO: this is lamé; make fetchItemsWithValue take an array and get rid of the semaphore crap
333              [_keychain fetchItemsWithValue:serviceIdentifier.serviceID forLookupKey:serviceIdentifier.lookupKey ofType:SecCDKeychainLookupValueTypeString withConnection:self completionHandler:^(NSArray<SecCDKeychainItemMetadata*>* items, NSError* error) {
334                  if (items && !error) {
335                      processFetchedItems(items);
336                  }
337                  else {
338                      resultsDict = nil;
339                      resultError = error;
340                  }
341  
342                  dispatch_semaphore_signal(semaphore);
343              }];
344              dispatch_semaphore_wait(semaphore, DISPATCH_TIME_FOREVER);
345          }
346      }
347  
348      reply(resultsDict.allValues, resultError);
349  }
350  
351  - (void)rpcRemoveCredentialWithPersistentIdentifier:(NSString*)persistentIdentifier reply:(void (^)(BOOL success, NSError* _Nullable error))reply
352  {
353      NSUUID* persistentID = [[NSUUID alloc] initWithUUIDString:persistentIdentifier];
354      if (!persistentID) {
355          secerror("SFKeychainServer: attempt to remove credential with invalid persistent identifier; %@", persistentIdentifier);
356          reply(false, [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorInvalidPersistentIdentifier userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"invalid persistent identifier: %@", persistentIdentifier]}]);
357          return;
358      }
359      
360      [_keychain deleteItemWithPersistentID:persistentID withConnection:self completionHandler:^(bool success, NSError* error) {
361          reply(success, error);
362      }];
363  }
364  
365  - (void)rpcReplaceOldCredential:(SFCredential*)oldCredential withNewCredential:(SFCredential*)newCredential reply:(void (^)(NSString* newPersistentIdentifier, NSError* _Nullable error))reply
366  {
367      // TODO: implement
368      reply(nil, nil);
369  }
370  
371  - (SFPasswordCredential*)passwordCredentialForItem:(SecCDKeychainItem*)item error:(NSError**)error
372  {
373      SFPasswordCredential* credential = [self passwordCredentialForItemMetadata:item.metadata error:error];
374      if (credential) {
375          credential.password = item.secrets[SFCredentialSecretPassword];
376          if (!credential.password) {
377              if (error) {
378                  *error = [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorSecureDecodeFailed userInfo:@{NSLocalizedDescriptionKey : @"failed to get password for SFCredential"}];
379              }
380              return nil;
381          }
382      }
383  
384      return credential;
385  }
386  
387  - (SFPasswordCredential*)passwordCredentialForItemMetadata:(SecCDKeychainItemMetadata*)metadata error:(NSError**)error
388  {
389      NSDictionary* attributes = metadata.attributes;
390      NSString* username = attributes[SFCredentialAttributeUsername];
391      
392      NSError* localError = nil;
393      SFServiceIdentifier* primaryServiceIdentifier = [NSKeyedUnarchiver unarchivedObjectOfClass:[SFServiceIdentifier class] fromData:attributes[SFCredentialAttributePrimaryServiceIdentifier] error:&localError];
394      
395      NSArray* serializedSupplementaryServiceIdentifiers = attributes[SFCredentialAttributeSupplementaryServiceIdentifiers];
396      NSMutableArray* supplementaryServiceIdentifiers = [[NSMutableArray alloc] initWithCapacity:serializedSupplementaryServiceIdentifiers.count];
397      for (NSData* serializedServiceIdentifier in serializedSupplementaryServiceIdentifiers) {
398          if ([serializedServiceIdentifier isKindOfClass:[NSData class]]) {
399              SFServiceIdentifier* serviceIdentifier = [NSKeyedUnarchiver unarchivedObjectOfClass:[SFServiceIdentifier class] fromData:serializedServiceIdentifier error:&localError];
400              if (serviceIdentifier) {
401                  [supplementaryServiceIdentifiers addObject:serviceIdentifier];
402              }
403              else {
404                  supplementaryServiceIdentifiers = nil;
405                  break;
406              }
407          }
408          else {
409              supplementaryServiceIdentifiers = nil;
410              localError = [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorSecureDecodeFailed userInfo:@{NSLocalizedDescriptionKey : @"malformed supplementary service identifiers array in SecCDKeychainItem"}];
411              break;
412          }
413      }
414  
415      if (username && primaryServiceIdentifier && supplementaryServiceIdentifiers) {
416          SFPasswordCredential* credential = [[SFPasswordCredential alloc] _initWithUsername:username primaryServiceIdentifier:primaryServiceIdentifier supplementaryServiceIdentifiers:supplementaryServiceIdentifiers];
417          credential.creationDate = attributes[SFCredentialAttributeCreationDate];
418          credential.modificationDate = attributes[SFCredentialAttributeModificationDate];
419          credential.localizedLabel = attributes[SFKeychainItemAttributeLocalizedLabel];
420          credential.localizedDescription = attributes[SFKeychainItemAttributeLocalizedDescription];
421          credential.persistentIdentifier = metadata.persistentID.UUIDString;
422          credential.customAttributes = attributes[SFCredentialAttributeCustom];
423          return credential;
424      }
425      else {
426          if (error) {
427              *error = [NSError errorWithDomain:SFKeychainErrorDomain code:SFKeychainErrorSecureDecodeFailed userInfo:@{ NSLocalizedDescriptionKey : @"failed to deserialize SFCredential", NSUnderlyingErrorKey : localError }];
428          }
429          return nil;
430      }
431  }
432  
433  @end
434  
435  #endif // ___OBJC2__
436  
437  void SFKeychainServerInitialize(void)
438  {
439      static dispatch_once_t once;
440      static SFKeychainServer* server;
441      static NSXPCListener* listener;
442  
443      dispatch_once(&once, ^{
444          @autoreleasepool {
445              NSURL* persistentStoreURL = (__bridge_transfer NSURL*)SecCopyURLForFileInKeychainDirectory((__bridge CFStringRef)@"CDKeychain");
446              NSBundle* resourcesBundle = [NSBundle bundleWithPath:@"/System/Library/Keychain/KeychainResources.bundle"];
447              NSURL* managedObjectModelURL = [resourcesBundle URLForResource:@"KeychainModel" withExtension:@"momd"];
448              server = [[SFKeychainServer alloc] initWithStorageURL:persistentStoreURL modelURL:managedObjectModelURL encryptDatabase:true];
449              listener = [[NSXPCListener alloc] initWithMachServiceName:@(kSFKeychainServerServiceName)];
450              listener.delegate = server;
451              [listener resume];
452          }
453      });
454  }
455  
456  #else // !TARGET_OS_BRIDGE
457  
458  void SFKeychainServerInitialize(void) {}
459  
460  #endif
461