SecurityTool/security.1

   1 .\"Modified from man(1) of FreeBSD, the NetBSD mdoc.template, and mdoc.samples.
   2 .\"See Also:
   3 .\"man mdoc.samples for a complete listing of options
   4 .\"man mdoc for the short list of editing options
   5 .Dd March 1, 2012        \" DATE
   6 .Dt security 1           \" Program name and manual section number
   7 .Os Darwin
   8 .Sh NAME                 \" Section Header - required - don't modify
   9 .Nm security
  10 .\" The following lines are read in generating the apropos(man -k) database. Use only key
  11 .\" words here as the database is built based on the words here and in the .ND line.
  12 .\" Use .Nm macro to designate other names for the documented program.
  13 .Nd Command line interface to keychains and Security framework
  14 .Sh SYNOPSIS             \" Section Header - required - don't modify
  15 .Nm
  16 .Op Fl hilqv             \" [-hilqv]
  17 .Op Fl p Ar prompt       \" [-p prompt]
  18 .Op Ar command           \" [command]
  19 .Op Ar command_options   \" [command_options]
  20 .Op Ar command_args      \" [command_args]
  21 .Sh DESCRIPTION          \" Section Header - required - don't modify
  22 A simple command line interface which lets you administer keychains,
  23 manipulate keys and certificates, and do just about anything the
  24 Security framework is capable of from the command line.
  25 .Pp
  26 By default
  27 .Nm
  28 will execute the
  29 .Ar command
  30 supplied and report if anything went wrong.
  31 .Pp
  32 If the
  33 .Fl i
  34 or
  35 .Fl p
  36 options are provided,
  37 .Nm
  38 will enter interactive mode and allow the user to enter multiple commands on stdin.  When EOF is read from stdin
  39 .Nm
  40 will exit.
  41 .Pp
  42 Here is a complete list of the options available:
  43 .Bl -tag -width -indent
  44 .It Fl h
  45 If no arguments are specified, show a list of all commands.  If arguments are provided, show usage for each the specified commands.  This option is essentially the same as the
  46 .Nm help
  47 command.
  48 .It Fl i
  49 Run
  50 .Nm
  51 in interactive mode.  A prompt
  52 .Po
  53 .Li security>
  54 by default
  55 .Pc
  56 will be displayed and the user will be able to type commands on stdin until an EOF is encountered.
  57 .It Fl l
  58 Before
  59 .Nm
  60 exits, run
  61 .Dl "/usr/bin/leaks -nocontext"
  62 on itself to see if the command(s) you executed had any leaks.
  63 .It Fl p Ar prompt
  64 This option implies the
  65 .Fl i
  66 option but changes the default prompt to the argument specified instead.
  67 .It Fl q
  68 Will make
  69 .Nm
  70 less verbose.
  71 .It Fl v
  72 Will make
  73 .Nm
  74 more verbose.
  75 .El                      \" Ends the list
  76 .Pp
  77 .Sh "SECURITY COMMAND SUMMARY"
  78 .Nm
  79 provides a rich variety of commands
  80 .Po Ar command
  81 in the
  82 .Sx SYNOPSIS Pc Ns
  83 , each of which often has a wealth of options, to allow access to
  84 the broad functionality provided by the Security framework.  However,
  85 you don't have to master every detail for
  86 .Nm
  87 to be useful to you.
  88 .Pp
  89 Here are brief descriptions of all the
  90 .Nm
  91 commands:
  92 .Pp
  93 .Bl -tag -width user-trust-settings-enable -compact
  94 .It Nm help
  95 Show all commands, or show usage for a command.
  96 .It Nm list-keychains
  97 Display or manipulate the keychain search list.
  98 .It Nm default-keychain
  99 Display or set the default keychain.
 100 .It Nm login-keychain
 101 Display or set the login keychain.
 102 .It Nm create-keychain
 103 Create keychains.
 104 .It Nm delete-keychain
 105 Delete keychains and remove them from the search list.
 106 .It Nm lock-keychain
 107 Lock the specified keychain.
 108 .It Nm unlock-keychain
 109 Unlock the specified keychain.
 110 .It Nm set-keychain-settings
 111 Set settings for a keychain.
 112 .It Nm set-keychain-password
 113 Set password for a keychain.
 114 .It Nm show-keychain-info
 115 Show the settings for keychain.
 116 .It Nm dump-keychain
 117 Dump the contents of one or more keychains.
 118 .It Nm create-keypair
 119 Create an asymmetric key pair.
 120 .It Nm add-generic-password
 121 Add a generic password item.
 122 .It Nm add-internet-password
 123 Add an internet password item.
 124 .It Nm add-certificates
 125 Add certificates to a keychain.
 126 .It Nm find-generic-password
 127 Find a generic password item.
 128 .It Nm delete-generic-password
 129 Delete a generic password item.
 130 .It Nm find-internet-password
 131 Find an internet password item.
 132 .It Nm delete-internet-password
 133 Delete an internet password item.
 134 .It Nm find-certificate
 135 Find a certificate item.
 136 .It Nm find-identity
 137 Find an identity (certificate + private key).
 138 .It Nm delete-certificate
 139 Delete a certificate from a keychain.
 140 .It Nm set-identity-preference
 141 Set the preferred identity to use for a service.
 142 .It Nm get-identity-preference
 143 Get the preferred identity to use for a service.
 144 .It Nm create-db
 145 Create a db using the DL.
 146 .It Nm export
 147 Export items from a keychain.
 148 .It Nm import
 149 Import items into a keychain.
 150 .It Nm cms
 151 Encode or decode CMS messages.
 152 .It Nm install-mds
 153 Install (or re-install) the MDS database.
 154 .It Nm add-trusted-cert
 155 Add trusted certificate(s).
 156 .It Nm remove-trusted-cert
 157 Remove trusted certificate(s).
 158 .It Nm dump-trust-settings
 159 Display contents of trust settings.
 160 .It Nm user-trust-settings-enable
 161 Display or manipulate user-level trust settings.
 162 .It Nm trust-settings-export
 163 Export trust settings.
 164 .It Nm trust-settings-import
 165 Import trust settings.
 166 .It Nm verify-cert
 167 Verify certificate(s).
 168 .It Nm authorize
 169 Perform authorization operations.
 170 .It Nm authorizationdb
 171 Make changes to the authorization policy database.
 172 .It Nm execute-with-privileges
 173 Execute tool with privileges.
 174 .It Nm leaks
 175 Run
 176 .Pa /usr/bin/leaks
 177 on this process.
 178 .It Nm error
 179 Display a descriptive message for the given error code(s).
 180 .El
 181 .Sh "COMMON COMMAND OPTIONS"
 182 This section describes the
 183 .Ar command_options
 184 that are available across all
 185 .Nm
 186 commands.
 187 .Bl -tag -width -indent
 188 .It Fl h
 189 Show a usage message for the specified command.  This option is
 190 essentially the same as the
 191 .Ar help
 192 command.
 193 .El
 194 .Sh "SECURITY COMMANDS"
 195 Here (finally) are details on all the
 196 .Nm
 197 commands and the options each accepts.
 198 .Bl -item
 199 .It
 200 .Nm help
 201 .Op Fl h
 202 .Bl -item -offset -indent
 203 Show all commands, or show usage for a command.
 204 .El
 205 .It
 206 .Nm list-keychains
 207 .Op Fl h
 208 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 209 .Op Fl s Op Ar keychain...
 210 .Bl -item -offset -indent
 211 Display or manipulate the keychain search list.
 212 .It
 213 .Bl -tag -compact -width -indent
 214 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 215 Use the specified preference domain.
 216 .It Fl s
 217 Set the search list to the specified keychains.
 218 .El
 219 .El
 220 .It
 221 .Nm default-keychain
 222 .Op Fl h
 223 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 224 .Op Fl s Op Ar keychain
 225 .Bl -item -offset -indent
 226 Display or set the default keychain.
 227 .It
 228 .Bl -tag -compact -width -indent
 229 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 230 Use the specified preference domain.
 231 .It Fl s
 232 Set the default keychain to the specified
 233 .Ar keychain Ns .
 234 Unset it if no keychain is specified.
 235 .El
 236 .El
 237 .It
 238 .Nm login-keychain
 239 .Op Fl h
 240 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 241 .Op Fl s Op Ar keychain
 242 .Bl -item -offset -indent
 243 Display or set the login keychain.
 244 .It
 245 .Bl -tag -compact -width -indent
 246 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 247 Use the specified preference domain.
 248 .It Fl s
 249 Set the login keychain to the specified
 250 .Ar keychain Ns .
 251 Unset it if no keychain is specified.
 252 .El
 253 .El
 254 .It
 255 .Nm create-keychain
 256 .Op Fl hP
 257 .Op Fl p Ar password
 258 .Op Ar keychain...
 259 .Bl -item -offset -indent
 260 Create keychains.
 261 .It
 262 .Bl -tag -compact -width -indent-indent
 263 .It Fl P
 264 Prompt the user for a password using the SecurityAgent.
 265 .It Fl p Ar password
 266 Use
 267 .Ar password
 268 as the password for the keychains being created.
 269 .El
 270 .It
 271 If neither
 272 .Fl P
 273 or
 274 .Fl p Ar password
 275 are specified, the user is prompted for a password on the command line. Use
 276 of the -p option is insecure.
 277 .El
 278 .It
 279 .Nm delete-keychain
 280 .Op Fl h
 281 .Op Ar keychain...
 282 .Bl -item -offset -indent
 283 Delete keychains and remove them from the search list.
 284 .El
 285 .It
 286 .Nm lock-keychain
 287 .Op Fl h
 288 .Op Fl a Ns | Ns Ar keychain
 289 .Bl -item -offset -indent
 290 Lock
 291 .Ar keychain Ns
 292 \&, or the default keychain if none is specified.  If the
 293 .Fl a
 294 option is specified, all keychains are locked.
 295 .El
 296 .It
 297 .Nm unlock-keychain
 298 .Op Fl hu
 299 .Op Fl p Ar password
 300 .Op Ar keychain
 301 .Bl -item -offset -indent
 302 Unlock
 303 .Ar keychain Ns
 304 \&, or the default keychain if none is specified.
 305 .El
 306 .It
 307 .Nm set-keychain-settings
 308 .Op Fl hlu
 309 .Op Fl t Ar timeout
 310 .Op Ar keychain
 311 .Bl -item -offset -indent
 312 Set settings for
 313 .Ar keychain Ns
 314 \&, or the default keychain if none is specified.
 315 .It
 316 .Bl -tag -compact -width -indent-indent
 317 .It Fl l
 318 Lock keychain when the system sleeps.
 319 .It Fl u
 320 Lock keychain after timeout interval.
 321 .It Fl t Ar timeout
 322 Specify
 323 .Ar timeout
 324 interval in seconds (omitting this option specifies "no timeout").
 325 .El
 326 .El
 327 .It
 328 .Nm set-keychain-password
 329 .Op Fl h
 330 .Op Fl o Ar oldPassword
 331 .Op Fl p Ar newPassword
 332 .Op Ar keychain
 333 .Bl -item -offset -indent
 334 Set password for
 335 .Ar keychain Ns
 336 \&, or the default keychain if none is specified.
 337 .It
 338 .Bl -tag -compact -width -indent-indent
 339 .It Fl o Ar oldPassword
 340 Old keychain password (if not provided, will prompt)
 341 .It Fl p Ar newPassword
 342 New keychain password (if not provided, will prompt)
 343 .El
 344 .El
 345 .It
 346 .Nm show-keychain-info
 347 .Op Fl h
 348 .Op Ar keychain
 349 .Bl -item -offset -indent
 350 Show the settings for
 351 .Ar keychain Ns
 352 \&.
 353 .El
 354 .It
 355 .Nm dump-keychain
 356 .Op Fl adhir
 357 .Bl -item -offset -indent
 358 Dump the contents of one or more keychains.
 359 .It
 360 .Bl -tag -compact -width -indent-indent
 361 .It Fl a
 362 Dump access control list of items
 363 .It Fl d
 364 Dump (decrypted) data of items
 365 .It Fl i
 366 Interactive access control list editing mode
 367 .It Fl r
 368 Dump raw (encrypted) data of items
 369 .El
 370 .El
 371 .It
 372 .Nm create-keypair
 373 .Op Fl h
 374 .Op Fl a Ar alg
 375 .Op Fl s Ar size
 376 .Op Fl f Ar date
 377 .Op Fl t Ar date
 378 .Op Fl d Ar days
 379 .Op Fl k Ar keychain
 380 .Op Fl A Ns | Ns Fl T Ar appPath
 381 .Op Ar name
 382 .Bl -item -offset -indent
 383 Create an asymmetric key pair.
 384 .It
 385 .Bl -tag -compact -width -indent-indent
 386 .It Fl a Ar alg
 387 Use
 388 .Ar alg
 389 as the algorithm, can be rsa, dh, dsa or fee (default rsa)
 390 .It Fl s Ar size
 391 Specify the keysize in bits (default 512)
 392 .It Fl f Ar date
 393 Make a key valid from the specified date (ex: "13/11/10 3:30pm")
 394 .It Fl t Ar date
 395 Make a key valid to the specified date
 396 .It Fl d Ar days
 397 Make a key valid for the number of days specified from today
 398 .It Fl k Ar keychain
 399 Use the specified keychain rather than the default
 400 .It Fl A
 401 Allow any application to access this key without warning (insecure, not recommended!)
 402 .It Fl T Ar appPath
 403 Specify an application which may access this key (multiple
 404 .Fl T Ns
 405 \& options are allowed)
 406 .El
 407 .El
 408 .It
 409 .Nm add-generic-password
 410 .Op Fl h
 411 .Op Fl a Ar account
 412 .Op Fl s Ar service
 413 .Op Fl w Ar password
 414 .Op Ar options...
 415 .Op Ar keychain
 416 .Bl -item -offset -indent
 417 Add a generic password item.
 418 .It
 419 .Bl -tag -compact -width -indent-indent
 420 .It Fl a Ar account
 421 Specify account name (required)
 422 .It Fl c Ar creator
 423 Specify item creator (optional four-character code)
 424 .It Fl C Ar type
 425 Specify item type (optional four-character code)
 426 .It Fl D Ar kind
 427 Specify kind (default is "application password")
 428 .It Fl G Ar value
 429 Specify generic attribute value (optional)
 430 .It Fl j Ar comment
 431 Specify comment string (optional)
 432 .It Fl l Ar label
 433 Specify label (if omitted, service name is used as default label)
 434 .It Fl s Ar service
 435 Specify service name (required)
 436 .It Fl p Ar password
 437 Specify password to be added (legacy option, equivalent to
 438 .Fl w Ns
 439 \&)
 440 .It Fl w Ar password
 441 Specify password to be added. Put at end of command to be prompted (recommended)
 442 .It Fl A
 443 Allow any application to access this item without warning (insecure, not recommended!)
 444 .It Fl T Ar appPath
 445 Specify an application which may access this item (multiple
 446 .Fl T Ns
 447 \& options are allowed)
 448 .It Fl U
 449 Update item if it already exists (if omitted, the item cannot already exist)
 450 .El
 451 .It
 452 .Bl -item
 453 By default, the application which creates an item is trusted to access its data without warning.  You can remove this default access by explicitly specifying an empty app pathname:
 454 .Fl T Ns
 455 \& "". If no keychain is specified, the password is added to the default keychain.
 456 .El
 457 .El
 458 .It
 459 .Nm add-internet-password
 460 .Op Fl h
 461 .Op Fl a Ar account
 462 .Op Fl s Ar server
 463 .Op Fl w Ar password
 464 .Op Ar options...
 465 .Op Ar keychain
 466 .Bl -item -offset -indent
 467 Add an internet password item.
 468 .It
 469 .Bl -tag -compact -width -indent-indent
 470 .It Fl a Ar account
 471 Specify account name (required)
 472 .It Fl c Ar creator
 473 Specify item creator (optional four-character code)
 474 .It Fl C Ar type
 475 Specify item type (optional four-character code)
 476 .It Fl d Ar domain
 477 Specify security domain string (optional)
 478 .It Fl D Ar kind
 479 Specify kind (default is "application password")
 480 .It Fl j Ar comment
 481 Specify comment string (optional)
 482 .It Fl l Ar label
 483 Specify label (if omitted, service name is used as default label)
 484 .It Fl p Ar path
 485 Specify path string (optional)
 486 .It Fl P Ar port
 487 Specify port number (optional)
 488 .It Fl r Ar protocol
 489 Specify protocol (optional four-character SecProtocolType, e.g. "http", "ftp ")
 490 .It Fl s Ar server
 491 Specify server name (required)
 492 .It Fl t Ar authenticationType
 493 Specify authentication type (as a four-character SecAuthenticationType, default is "dflt")
 494 .It Fl w Ar password
 495 Specify password to be added. Put at end of command to be prompted (recommended)
 496 .It Fl A
 497 Allow any application to access this item without warning (insecure, not recommended!)
 498 .It Fl T Ar appPath
 499 Specify an application which may access this item (multiple
 500 .Fl T Ns
 501 \& options are allowed)
 502 .It Fl U
 503 Update item if it already exists (if omitted, the item cannot already exist)
 504 .El
 505 .It
 506 .Bl -item
 507 By default, the application which creates an item is trusted to access its data without warning.  You can remove this default access by explicitly specifying an empty app pathname:
 508 .Fl T Ns
 509 \& "". If no keychain is specified, the password is added to the default keychain.
 510 .El
 511 .El
 512 .It
 513 .Nm add-certificates
 514 .Op Fl h
 515 .Op Fl k Ar keychain
 516 .Ar file...
 517 .Bl -item -offset -indent
 518 Add certficates contained in the specified
 519 .Ar files
 520 to the default keychain.  The files must contain one DER encoded X509 certificate each.
 521 .Bl -tag -compact -width -indent-indent
 522 .It Fl k Ar keychain
 523 Use
 524 .Ar keychain
 525 rather than the default keychain.
 526 .El
 527 .El
 528 .It
 529 .Nm find-generic-password
 530 .Op Fl h
 531 .Op Fl a Ar account
 532 .Op Fl s Ar service
 533 .Op Fl Ar options...
 534 .Op Fl g
 535 .Op Fl Ar keychain...
 536 .Bl -item -offset -indent
 537 Find a generic password item.
 538 .It
 539 .Bl -tag -compact -width -indent-indent
 540 .It Fl a Ar account
 541 Match account string
 542 .It Fl c Ar creator
 543 Match creator (four-character code)
 544 .It Fl C Ar type
 545 Match type (four-character code)
 546 .It Fl D Ar kind
 547 Match kind string
 548 .It Fl G Ar value
 549 Match value string (generic attribute)
 550 .It Fl j Ar comment
 551 Match comment string
 552 .It Fl l Ar label
 553 Match label string
 554 .It Fl s Ar service
 555 Match service string
 556 .It Fl g
 557 Display the password for the item found
 558 .It Fl w
 559 Display the password(only) for the item found
 560 .El
 561 .El
 562 .It
 563 .Nm delete-generic-password
 564 .Op Fl h
 565 .Op Fl a Ar account
 566 .Op Fl s Ar service
 567 .Op Fl Ar options...
 568 .Op Fl Ar keychain...
 569 .Bl -item -offset -indent
 570 Delete a generic password item.
 571 .It
 572 .Bl -tag -compact -width -indent-indent
 573 .It Fl a Ar account
 574 Match account string
 575 .It Fl c Ar creator
 576 Match creator (four-character code)
 577 .It Fl C Ar type
 578 Match type (four-character code)
 579 .It Fl D Ar kind
 580 Match kind string
 581 .It Fl G Ar value
 582 Match value string (generic attribute)
 583 .It Fl j Ar comment
 584 Match comment string
 585 .It Fl l Ar label
 586 Match label string
 587 .It Fl s Ar service
 588 Match service string
 589 .El
 590 .El
 591 .It
 592 .Nm delete-internet-password
 593 .Op Fl h
 594 .Op Fl a Ar account
 595 .Op Fl s Ar server
 596 .Op Ar options...
 597 .Op Ar keychain...
 598 .Bl -item -offset -indent
 599 Delete an internet password item.
 600 .It
 601 .Bl -tag -compact -width -indent-indent
 602 .It Fl a Ar account
 603 Match account string
 604 .It Fl c Ar creator
 605 Match creator (four-character code)
 606 .It Fl C Ar type
 607 Match type (four-character code)
 608 .It Fl d Ar securityDomain
 609 Match securityDomain string
 610 .It Fl D Ar kind
 611 Match kind string
 612 .It Fl j Ar comment
 613 Match comment string
 614 .It Fl l Ar label
 615 Match label string
 616 .It Fl p Ar path
 617 Match path string
 618 .It Fl P Ar port
 619 Match port number
 620 .It Fl r Ar protocol
 621 Match protocol (four-character code)
 622 .It Fl s Ar server
 623 Match server string
 624 .It Fl t Ar authenticationType
 625 Match authenticationType (four-character code)
 626 .El
 627 .El
 628 .It
 629 .Nm find-internet-password
 630 .Op Fl h
 631 .Op Fl a Ar account
 632 .Op Fl s Ar server
 633 .Op Ar options...
 634 .Op Fl g
 635 .Op Ar keychain...
 636 .Bl -item -offset -indent
 637 Find an internet password item.
 638 .It
 639 .Bl -tag -compact -width -indent-indent
 640 .It Fl a Ar account
 641 Match account string
 642 .It Fl c Ar creator
 643 Match creator (four-character code)
 644 .It Fl C Ar type
 645 Match type (four-character code)
 646 .It Fl d Ar securityDomain
 647 Match securityDomain string
 648 .It Fl D Ar kind
 649 Match kind string
 650 .It Fl j Ar comment
 651 Match comment string
 652 .It Fl l Ar label
 653 Match label string
 654 .It Fl p Ar path
 655 Match path string
 656 .It Fl P Ar port
 657 Match port number
 658 .It Fl r Ar protocol
 659 Match protocol (four-character code)
 660 .It Fl s Ar server
 661 Match server string
 662 .It Fl t Ar authenticationType
 663 Match authenticationType (four-character code)
 664 .It Fl g
 665 Display the password for the item found
 666 .It Fl w
 667 Display the password(only) for the item found
 668 .El
 669 .El
 670 .It
 671 .Nm find-certificate
 672 .Op Fl h
 673 .Op Fl a
 674 .Op Fl c Ar name
 675 .Op Fl e Ar emailAddress
 676 .Op Fl m
 677 .Op Fl p
 678 .Op Fl Z
 679 .Op Ar keychain...
 680 .Bl -item -offset -indent
 681 Find a certificate item.  If no
 682 .Ar keychain Ns
 683 \& arguments are provided, the default search list is used.
 684 .It
 685 Options:
 686 .Bl -tag -compact -width -indent-indent
 687 .It Fl a
 688 Find all matching certificates, not just the first one
 689 .It Fl c Ar name
 690 Match on
 691 .Ar name Ns
 692 \& when searching (optional)
 693 .It Fl e Ar emailAddress
 694 Match on
 695 .Ar emailAddress Ns
 696 \& when searching (optional)
 697 .It Fl m
 698 Show the email addresses in the certificate
 699 .It Fl p
 700 Output certificate in pem format.  Default is to dump the attributes and keychain the cert is in.
 701 .It Fl Z
 702 Print SHA-1 hash of the certificate
 703 .El
 704 .It
 705 .Sy Examples
 706 .Bl -tag -width -indent
 707 .It security> find-certificate -a -p > allcerts.pem
 708 Exports all certificates from all keychains into a pem file called allcerts.pem.
 709 .It security> find-certificate -a -e me@foo.com -p > certs.pem
 710 Exports all certificates from all keychains with the email address
 711 me@foo.com into a pem file called certs.pem.
 712 .It security> find-certificate -a -c MyName -Z login.keychain | grep ^SHA-1
 713 Print the SHA-1 hash of every certificate in 'login.keychain' whose common name includes 'MyName'
 714 .El
 715 .El
 716 .It
 717 .Nm find-identity
 718 .Op Fl h
 719 .Op Fl p Ar policy
 720 .Op Fl s Ar string
 721 .Op Fl v
 722 .Op Ar keychain...
 723 .Bl -item -offset -indent
 724 Find an identity (certificate + private key) satisfying a given policy. If no
 725 .Ar policy Ns
 726 \& arguments are provided, the X.509 basic policy is assumed. If no
 727 .Ar keychain Ns
 728 \& arguments are provided, the default search list is used.
 729 .It
 730 Options:
 731 .Bl -tag -compact -width -indent-indent
 732 .It Fl p Ar policy
 733 Specify
 734 .Ar policy Ns
 735 \& to evaluate (multiple -p options are allowed). Supported policies:
 736 basic, ssl-client, ssl-server, smime, eap, ipsec, ichat, codesigning,
 737 sys-default, sys-kerberos-kdc
 738 .It Fl s Ar string
 739 Specify optional policy-specific
 740 .Ar string Ns
 741 \& (e.g. a DNS hostname for SSL, or RFC822 email address for S/MIME)
 742 .It Fl v
 743 Show valid identities only (default is to show all identities)
 744 .El
 745 .It
 746 .Sy Examples
 747 .Bl -tag -width -indent
 748 .It security> find-identity -v -p ssl-client
 749 Display valid identities that can be used for SSL client authentication
 750 .It security> find-identity -p ssl-server -s www.domain.com
 751 Display identities for a SSL server running on the host 'www.domain.com'
 752 .It security> find-identity -p smime -s user@domain.com
 753 Display identities that can be used to sign a message from 'user@domain.com'
 754 .El
 755 .El
 756 .It
 757 .Nm delete-certificate
 758 .Op Fl h
 759 .Op Fl c Ar name
 760 .Op Fl Z Ar hash
 761 .Op Fl t
 762 .Op Ar keychain...
 763 .Bl -item -offset -indent
 764 Delete a certificate from a keychain.  If no
 765 .Ar keychain Ns
 766 \& arguments are provided, the default search list is used.
 767 .It
 768 .Bl -tag -compact -width -indent-indent
 769 .It Fl c Ar name
 770 Specify certificate to delete by its common name
 771 .It Fl Z Ar hash
 772 Specify certificate to delete by its SHA-1 hash
 773 .It Fl t
 774 Also delete user trust settings for this certificate
 775 .El
 776 .It
 777 The certificate to be deleted must be uniquely specified either by a
 778 string found in its common name, or by its SHA-1 hash.
 779 .El
 780 .It
 781 .Nm set-identity-preference
 782 .Op Fl h
 783 .Op Fl n
 784 .Op Fl c Ar identity
 785 .Op Fl s Ar service
 786 .Op Fl u Ar keyUsage
 787 .Op Fl Z Ar hash
 788 .Op Ar keychain...
 789 .Bl -item -offset -indent
 790 Set the preferred identity to use for a service.
 791 .It
 792 .Bl -tag -compact -width -indent-indent
 793 .It Fl n
 794 Specify no identity (clears existing preference for the given service)
 795 .It Fl c Ar identity
 796 Specify identity by common name of the certificate
 797 .It Fl s Ar service
 798 Specify service (may be a URL, RFC822 email address, DNS host, or other name) for which this identity is to be preferred
 799 .It Fl u Ar keyUsage
 800 Specify key usage (optional)
 801 .It Fl Z Ar hash
 802 Specify identity by SHA-1 hash of certificate (optional)
 803 .El
 804 .It
 805 The identity is located by searching the specified keychain(s) for a certificate whose common name contains
 806 the given identity string. If no keychains are specified to search, the default search list is used. Different
 807 identity preferences can be set for individual key usages. You can differentiate between two identities which contain
 808 the same string by providing a SHA-1 hash of the certificate (in addition to, or instead of, the name.)
 809 .It
 810 .Sy PARTIAL PATHS AND WILDCARDS
 811 .It
 812 Prior to 10.5.4, identity preferences for SSL/TLS client authentication could only be set on a per-URL basis. The
 813 URL being visited had to match the service name exactly for the preference to be in effect.
 814 .It
 815 In 10.5.4, it became possible to specify identity preferences on a per-server basis, by using
 816 a service name with a partial path URL to match more specific paths on the same server. For
 817 example, if an identity preference for "https://www.apache-ssl.org/" exists, it will be in effect for
 818 "https://www.apache-ssl.org/cgi/cert-export", and so on. Note that partial path URLs must end with a trailing
 819 slash character.
 820 .It
 821 Starting with 10.6, it is possible to specify identity preferences on a per-domain
 822 basis, by using the wildcard character '*' as the leftmost component of the service name. Unlike SSL wildcards,
 823 an identity preference wildcard can match more than one subdomain. For example, an identity preference for
 824 the name "*.army.mil" will match "server1.subdomain1.army.mil" or "server2.subdomain2.army.mil". Likewise,
 825 a preference for "*.mil" will match both "server.army.mil" and "server.navy.mil".
 826 .It
 827 .Sy KEY USAGE CODES
 828 .It
 829 .Bl -tag -width -indent
 830      0 - preference is in effect for all possible key usages (default)
 831      1 - encryption only
 832      2 - decryption only
 833      4 - signing only
 834      8 - signature verification only
 835     16 - signing with message recovery only
 836     32 - signature verification with message recovery only
 837     64 - key wrapping only
 838    128 - key unwrapping only
 839    256 - key derivation only
 840 .It  To specify more than one usage, add values together.
 841 .El
 842 .El
 843 .It
 844 .Nm get-identity-preference
 845 .Op Fl h
 846 .Op Fl s Ar service
 847 .Op Fl u Ar keyUsage
 848 .Op Fl p
 849 .Op Fl c
 850 .Op Fl Z
 851 .Bl -item -offset -indent
 852 Get the preferred identity to use for a service.
 853 .It
 854 .Bl -tag -compact -width -indent-indent
 855 .It Fl s Ar service
 856 Specify service (may be a URL, RFC822 email address, DNS host, or other name)
 857 .It Fl u Ar keyUsage
 858 Specify key usage (optional)
 859 .It Fl p
 860 Output identity certificate in pem format
 861 .It Fl c
 862 Print common name of the preferred identity certificate
 863 .It Fl Z
 864 Print SHA-1 hash of the preferred identity certificate
 865 .El
 866 .El
 867 .It
 868 .Nm create-db
 869 .Op Fl aho0
 870 .Op Fl g Ar dl Ns | Ns Ar cspdl
 871 .Op Fl m Ar mode
 872 .Op Ar name
 873 .Bl -item -offset -indent
 874 Create a db using the DL.  If
 875 .Ar name
 876 isn't provided
 877 .Nm
 878 will prompt the user to type a name.
 879 .It
 880 Options:
 881 .Bl -tag -compact -width -indent-indent
 882 .It Fl a
 883 Turn off autocommit
 884 .It Fl g Ar dl Ns | Ns Ar cspdl
 885 Use the AppleDL (default) or AppleCspDL
 886 .It Fl m Ar mode
 887 Set the file permissions to
 888 .Ar mode Ns
 889 \&.
 890 .It Fl o
 891 Force using openparams argument
 892 .It Fl 0
 893 Force using version 0 openparams
 894 .El
 895 .It
 896 .Sy Examples
 897 .Bl -tag -width -indent
 898 .It security> create-db -m 0644 test.db
 899 .It security> create-db -g cspdl -a test2.db
 900 .El
 901 .\"new import/export commands.
 902 .El
 903 .It
 904 .Nm export
 905 .Op Fl k Ar keychain
 906 .Op Fl t Ar type
 907 .Op Fl f Ar format
 908 .Op Fl w
 909 .Op Fl p Ar format
 910 .Op Fl P Ar passphrase
 911 .Op Fl o Ar outfile
 912 .Bl -item -offset -indent
 913 Export one or more items from a keychain to one of a number of external representations.  If
 914 .Ar keychain
 915 isn't provided, items will be exported from the user's default keychain.
 916 .It
 917 Options:
 918 .Bl -tag -compact -width -indent-indent
 919 .It Fl k Ar keychain
 920 Specify keychain from which item(s) will be exported.
 921 .It Fl t Ar type
 922 Specify the type of items to export. Possible types are certs, allKeys, pubKeys, privKeys, identities, and all. The default is all. An identity consists of both a certificate and the corresponding private key.
 923 .It Fl f Ar format
 924 Specify the format of the exported data. Possible formats are openssl, bsafe, pkcs7, pkcs8, pkcs12, x509, openssh1, openssh2, and pemseq. The default is pemseq if more than one item is being exported. The default is openssl if one key is being exported. The default is x509 if one certificate is being exported.
 925 .It Fl w
 926 Specifies that private keys are to be wrapped on export.
 927 .It Fl p
 928 Specifies that PEM armour is to be applied to the output data.
 929 .It Fl P Ar passphrase
 930 Specify the wrapping passphrase immediately. The default is to obtain a secure passphrase via GUI.
 931 .It Fl o Ar outfile
 932 Write the output data to
 933 .Ar outfile Ns
 934 \&. Default is to write data to stdout.
 935 .El
 936 .It
 937 .Sy Examples
 938 .Bl -tag -width -indent
 939 .It security> export -k login.keychain -t certs -o /tmp/certs.pem
 940 .It security> export -k newcert.keychain -t identities -f pkcs12 -o /tmp/mycerts.p12
 941 .El
 942 .\"marker.
 943 .El
 944 .It
 945 .Nm import
 946 inputfile
 947 .Op Fl k Ar keychain
 948 .Op Fl t Ar type
 949 .Op Fl f Ar format
 950 .Op Fl w
 951 .Op Fl P Ar passphrase
 952 .Op Ar options...
 953 .Bl -item -offset -indent
 954 Import one or more items from
 955 .Ar inputfile Ns
 956 \& into a keychain. If
 957 .Ar keychain
 958 isn't provided, items will be imported into the user's default keychain.
 959 .It
 960 Options:
 961 .Bl -tag -compact -width -indent-indent
 962 .It Fl k Ar keychain
 963 Specify keychain into which item(s) will be imported.
 964 .It Fl t Ar type
 965 Specify the type of items to import. Possible types are cert, pub, priv, session, cert, and agg. Pub, priv, and session refer to keys; agg is one of the aggregate types (pkcs12 and PEM sequence). The command can often figure out what item_type an item contains based in the filename and/or item_format.
 966 .It Fl f Ar format
 967 Specify the format of the exported data. Possible formats are openssl, bsafe, raw, pkcs7, pkcs8, pkcs12, x509, openssh1, openssh2, and pemseq. The command can often figure out what format an item is in based in the filename and/or item_type.
 968 .It Fl w
 969 Specify that private keys are wrapped and must be unwrapped on import.
 970 .It Fl x
 971 Specify that private keys are non-extractable after being imported.
 972 .It Fl P Ar passphrase
 973 Specify the unwrapping passphrase immediately. The default is to obtain a secure passphrase via GUI.
 974 .It Fl a Ar attrName Ar attrValue
 975 Specify optional extended attribute name and value. Can be used multiple times. This is only valid when importing keys.
 976 .It Fl A
 977 Allow any application to access the imported key without warning (insecure, not recommended!)
 978 .It Fl T Ar appPath
 979 Specify an application which may access the imported key (multiple
 980 .Fl T Ns
 981 \& options are allowed)
 982 .El
 983 .It
 984 .Sy Examples
 985 .Bl -tag -width -indent
 986 .It security> import /tmp/certs.pem -k
 987 .It security> import /tmp/mycerts.p12 -t agg -k newcert.keychain
 988 .It security> import /tmp/mycerts.p12 -f pkcs12 -k newcert.keychain
 989 .El
 990 .\"end of new import/export commands.
 991 .El
 992 .It
 993 .Nm cms
 994 .Op Fl C Ns | Ns Fl D Ns | Ns Fl E Ns | Ns Fl S
 995 .Op Ar options...
 996 .Bl -item -offset -indent
 997 Encode or decode CMS messages.
 998 .Bl -tag -compact -width -indent-indent
 999 .It Fl C
1000 create a CMS encrypted message
1001 .It Fl D
1002 decode a CMS message
1003 .It Fl E
1004 create a CMS enveloped message
1005 .It Fl S
1006 create a CMS signed message
1007 .El
1008 .It
1009 Decoding options:
1010 .Bl -tag -compact -width -indent-indent
1011 .It Fl c Ar content
1012 use this detached content file
1013 .It Fl h Ar level
1014 generate email headers with info about CMS message (output
1015 .Ar level Ns
1016 \& >= 0)
1017 .It Fl n
1018 suppress output of content
1019 .El
1020 .It
1021 Encoding options:
1022 .Bl -tag -compact -width -indent-indent
1023 .It Fl r Ar id,...
1024 create envelope for comma-delimited list of recipients, where id can be a certificate nickname or email address
1025 .It Fl G
1026 include a signing time attribute
1027 .It Fl H Ar hash
1028 hash = MD2|MD4|MD5|SHA1|SHA256|SHA384|SHA512 (default: SHA1)
1029 .It Fl N Ar nick
1030 use certificate named "nick" for signing
1031 .It Fl P
1032 include a SMIMECapabilities attribute
1033 .It Fl T
1034 do not include content in CMS message
1035 .It Fl Y Ar nick
1036 include an EncryptionKeyPreference attribute with certificate (use "NONE" to omit)
1037 .It Fl Z Ar hash
1038 find a certificate by subject key ID
1039 .El
1040 .It
1041 Common options:
1042 .Bl -tag -compact -width -indent-indent
1043 .It Fl e Ar envelope
1044 specify envelope file (valid with
1045 .Fl D Ns
1046 \& or
1047 .Fl E Ns
1048 \&)
1049 .It Fl k Ar keychain
1050 specify keychain to use
1051 .It Fl i Ar infile
1052 use infile as source of data (default: stdin)
1053 .It Fl o Ar outfile
1054 use outfile as destination of data (default: stdout)
1055 .It Fl p Ar password
1056 use password as key db password (default: prompt)
1057 .It Fl s
1058 pass data a single byte at a time to CMS
1059 .It Fl u Ar certusage
1060 set type of certificate usage (default: certUsageEmailSigner)
1061 .It Fl v
1062 print debugging information
1063 .El
1064 .It
1065 Cert usage codes:
1066                   0 - certUsageSSLClient
1067                   1 - certUsageSSLServer
1068                   2 - certUsageSSLServerWithStepUp
1069                   3 - certUsageSSLCA
1070                   4 - certUsageEmailSigner
1071                   5 - certUsageEmailRecipient
1072                   6 - certUsageObjectSigner
1073                   7 - certUsageUserCertImport
1074                   8 - certUsageVerifyCA
1075                   9 - certUsageProtectedObjectSigner
1076                  10 - certUsageStatusResponder
1077                  11 - certUsageAnyCA
1078 .It
1079 .El
1080 .It
1081 .Nm install-mds
1082 .Bl -item -offset -indent
1083 Install (or re-install) the Module Directory Services (MDS) database. This is a system tool which is not normally used by users. There are no options.
1084 .El
1085 .It
1086 .Nm add-trusted-cert
1087 .Op Fl d
1088 .Op Fl r Ar resultType
1089 .Op Fl p Ar policy
1090 .Op Fl a Ar appPath
1091 .Op Fl s Ar policyString
1092 .Op Fl e Ar allowedError
1093 .Op Fl u Ar keyUsage
1094 .Op Fl k Ar keychain
1095 .Op Fl i Ar settingsFileIn
1096 .Op Fl o Ar settingsFileOut
1097 .Op Fl D
1098 certFile
1099 .Bl -item -offset -indent
1100 Add certificate (in DER or PEM format) from
1101 .Ar certFile Ns
1102 \& to per-user or local Admin Trust Settings. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1103 .It
1104 Options:
1105 .Bl -tag -compact -width -indent-indent
1106 .It Fl d
1107 Add to admin cert store; default is user.
1108 .It Fl r Ar resultType
1109 resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
1110 .It Fl p Ar policy
1111 Specify policy constraint (ssl, smime, codeSign, IPSec, basic, swUpdate, pkgSign, eap, macappstore, appleID, timestamping).
1112 .It Fl r Ar resultType
1113 resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
1114 .It Fl a Ar appPath
1115 Specify application constraint.
1116 .It Fl s Ar policyString
1117 Specify policy-specific string.
1118 .It Fl e Ar allowedError
1119 Specify allowed error (an integer value, or one of: certExpired, hostnameMismatch)
1120 .It Fl u Ar keyUsage
1121 Specify key usage, an integer.
1122 .It Fl k Ar keychain
1123 Specify keychain to which cert is added.
1124 .It Fl i Ar settingsFileIn
1125 Input trust settings file; default is user domain.
1126 .It Fl o Ar settingsFileOut
1127 Output trust settings file; default is user domain.
1128 .It Fl D
1129 Add default setting instead of per-cert setting. No certFile is specified when using this option
1130 .El
1131 .It
1132 .Sy Key usage codes:
1133     -1 - Any
1134      1 - Sign
1135      2 - Encrypt/Decrypt Data
1136      4 - Encrypt/Decrypt Key
1137      8 - Sign certificate
1138     16 - Sign revocation
1139     32 - Key exchange
1140     To specify more than one usage, add values together (except -1 - Any).
1141 .It
1142 .Sy Examples
1143 .Bl -tag -width -indent
1144 .Dl security> add-trusted-cert /tmp/cert.der
1145 .Dl security> add-trusted-cert -d .tmp/cert.der
1146 .El
1147 .\"marker.
1148 .It
1149 .Nm remove-trusted-cert
1150 .Op Fl d
1151 .Op Fl D
1152 certFile
1153 .Bl -item -offset -indent
1154 Remove certificate (in DER or PEM format) in
1155 .Ar certFile Ns
1156 \& from per-user or local Admin Trust Settings. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1157 .It
1158 Options:
1159 .Bl -tag -compact -width -indent-indent
1160 .It Fl d
1161 Remove from admin cert store; default is user.
1162 .It Fl D
1163 Remove Default Root Cert setting instead of an actual cert setting. No certFile is specified when using this option.
1164 .El
1165 .\"marker.
1166 .El
1167 .It
1168 .Nm dump-trust-settings
1169 .Op Fl s
1170 .Op Fl d
1171 .Bl -item -offset -indent
1172 Display Trust Settings.
1173 .It
1174 Options:
1175 .Bl -tag -compact -width -indent-indent
1176 .It Fl s
1177 Display trusted system certs; default is user.
1178 .It Fl d
1179 Display trusted admin certs; default is user.
1180 .El
1181 .\"marker.
1182 .El
1183 .It
1184 .Nm user-trust-settings-enable
1185 .Op Fl d
1186 .Op Fl e
1187 .Bl -item -offset -indent
1188 Display or manipulate user-level Trust Settings. With no arguments, shows the current state of the user-level Trust Settings enable. Otherwise enables or disables user-level Trust Settings.
1189 .It
1190 Options:
1191 .Bl -tag -compact -width -indent-indent
1192 .It Fl d
1193 Disable user-level Trust Settings.
1194 .It Fl e
1195 Enable user-level Trust Settings.
1196 .El
1197 .\"marker.
1198 .El
1199 .It
1200 .Nm trust-settings-export
1201 .Op Fl s
1202 .Op Fl d
1203 settings_file
1204 .Bl -item -offset -indent
1205 Export Trust Settings to the specified file.
1206 .It
1207 Options:
1208 .Bl -tag -compact -width -indent-indent
1209 .It Fl s
1210 Export system Trust Settings; default is user.
1211 .It Fl d
1212 Export admin Trust Settings; default is user.
1213 .El
1214 .\"marker.
1215 .El
1216 .It
1217 .Nm trust-settings-import
1218 .Op Fl d
1219 settings_file
1220 .Bl -item -offset -indent
1221 Import Trust Settings from the specified file. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1222 .It
1223 Options:
1224 .Bl -tag -compact -width -indent-indent
1225 .It Fl d
1226 Import admin Trust Settings; default is user.
1227 .El
1228 .\"marker.
1229 .El
1230 .It
1231 .Nm verify-cert
1232 .Op Fl c Ar certFile
1233 .Op Fl r Ar rootCertFile
1234 .Op Fl p Ar policy
1235 .Op Fl k Ar keychain
1236 .Op Fl d Ar date
1237 .Op Fl n
1238 .Op Fl L
1239 .Op Fl l
1240 .Op Fl e Ar emailAddress
1241 .Op Fl s Ar sslHost
1242 .Op Fl q
1243 .Bl -item -offset -indent
1244 Verify one or more certificates.
1245 .It
1246 Options:
1247 .Bl -tag -compact -width -indent-indent
1248 .It Fl c Ar certFile
1249 Certificate to verify, in DER or PEM format. Can be specified more than once; leaf certificate has to be specified first.
1250 .It Fl r Ar rootCertFile
1251 Root certificate, in DER or PEM format. Can be specified more than once. If not specified, the system anchor certificates are used. If one root certificate is specified, and zero (non-root) certificates are specified, the root certificate is verified against itself.
1252 .It Fl p Ar policy
1253 Specify verification policy (ssl, smime, codeSign, IPSec, basic, swUpdate, pkgSign, eap, appleID, macappstore, timestamping). Default is basic.
1254 .It Fl k Ar keychain
1255 Keychain to search for intermediate certs. Can be specified multiple times. Default is the current user's keychain search list.
1256 .It Fl d Ar date
1257 Date to set for verification. Specified in the format of YYYY-MM-DD-hh:mm:ss (time optional). e.g: 2016-04-25-15:59:59 for April 25, 2016 at 3:59:59 pm in GMT
1258 .It Fl n
1259 Avoid searching any keychains.
1260 .It Fl L
1261 Use local certificates only. If an issuing CA certificate is missing, this option will avoid accessing the network to fetch it.
1262 .It Fl l
1263 Specifies that the leaf certificate is a CA cert. By default, a leaf certificate with a Basic Constraints extension with the CA bit set fails verification.
1264 .It Fl e Ar emailAddress
1265 Specify email address for the smime policy.
1266 .It Fl s Ar sslHost
1267 Specify SSL host name for the ssl policy.
1268 .It Fl q
1269 Quiet, no stdout or stderr.
1270 .El
1271 .It
1272 .Sy Examples
1273 .Bl -tag -width -indent
1274 .It security> verify-cert -c applestore0.cer -c applestore1.cer -p ssl -s store.apple.com
1275 .It security> verify-cert -r serverbasic.crt
1276 .El
1277 .\"marker.
1278 .El
1279 .It
1280 .Nm authorize
1281 .Op Fl updPiew
1282 .Op Ar right...
1283 .Bl -item -offset -indent
1284 Authorize requested right(s).  The extend-rights flag will be passed by default.
1285 .It
1286 Options:
1287 .Bl -tag -compact -width -indent-indent
1288 .It Fl u
1289 Allow user interaction.
1290 .It Fl p
1291 Allow returning partial rights.
1292 .It Fl d
1293 Destroy acquired rights.
1294 .It Fl P
1295 Pre-authorize rights only.
1296 .It Fl l
1297 Operate authorization in least privileged mode.
1298 .It Fl i
1299 Internalize authref passed on stdin.
1300 .It Fl e
1301 Externalize authref to stdout
1302 .It Fl w
1303 Wait while holding AuthorizationRef until stdout is closed. This will allow client to read externalized AuthorizationRef from pipe.
1304 .El
1305 .It
1306 .Sy Examples
1307 .Bl -tag -width -indent
1308 .It security> security authorize -ud my-right
1309 Basic authorization of my-right.
1310 .It security> security -q authorize -uew my-right | security -q authorize -i my-right
1311 Authorizing a right and passing it to another command as a way to add authorization to shell scripts.
1312 .El
1313 .El
1314 .It
1315 .Nm authorizationdb
1316 .Ar read <right-name>
1317 .It
1318 .Nm authorizationdb
1319 .Ar write <right-name> [allow|deny|<rulename>]
1320 .It
1321 .Nm authorizationdb
1322 .Ar remove <right-name>
1323 .Bl -item -offset -indent
1324 Read/Modify authorization policy database. Without a rulename write will read a dictionary as a plist from stdin.
1325 .It
1326 .Sy Examples
1327 .Bl -tag -width -indent
1328 .It security> security authorizationdb read system.privilege.admin > /tmp/aewp-def
1329 Read definition of system.privilege.admin right.
1330 .It security> security authorizationdb write system.preferences < /tmp/aewp-def
1331 Set system.preferences to definition of system.privilege.admin right.
1332 .It security> security authorizationdb write system.preferences authenticate-admin
1333 Every change to preferences requires an Admin user to authenticate.
1334 .El
1335 .El
1336 .It
1337 .Nm execute-with-privileges
1338 .Ar <program>
1339 .Op Ar args...
1340 .Bl -item -offset -indent
1341 Execute tool with privileges.
1342 On success stdin will be read and forwarded to the tool.
1343 .El
1344 .It
1345 .Nm leaks
1346 .Op Fl h
1347 .Op Fl cycles
1348 .Op Fl nocontext
1349 .Op Fl nostacks
1350 .Op Fl exclude Ar symbol
1351 .Bl -item -offset -indent
1352 Run
1353 .Li /usr/bin/leaks
1354 on this process.  This can help find memory leaks after running
1355 certain commands.
1356 .It
1357 Options:
1358 .Bl -tag -compact -width -indent-indent
1359 .It Fl cycles
1360 Use a stricter algorithm (See
1361 .Xr leaks 1
1362 for details).
1363 .It Fl nocontext
1364 Withhold the hex dumps of the leaked memory.
1365 .It Fl nostacks
1366 Don't show stack traces of leaked memory.
1367 .It Fl exclude Ar symbol
1368 Ignore leaks called from
1369 .Ar symbol Ns .
1370 .El
1371 .El
1372 .It
1373 .Nm smartcards
1374 .Ar token
1375 .Op Fl l
1376 .Op Fl e Ar token
1377 .Op Fl d Ar token
1378 .Bl -item -offset -indent
1379 Enable, disable or list disabled smartcard tokens.
1380 .It
1381 Options:
1382 .Bl -tag -compact -width -indent-indent
1383 .It Fl l
1384 List disabled smartcard tokens.
1385 .It Fl e Ar token
1386 Enable smartcard token.
1387 .It Fl d Ar token
1388 Disable smartcard token.
1389 .El
1390 .It
1391 .Sy To list tokens available in the system
1392 .It
1393 .Bl -tag -compact -width -indent
1394 .It pluginkit -m -p com.apple.ctk-tokens
1395 .El
1396 .It
1397 .Sy Examples
1398 .It
1399 .Bl -tag -compact -width -indent
1400 .It security smartcards token -l
1401 .It security smartcards token -d com.apple.CryptoTokenKit.pivtoken
1402 .It security smartcards token -e com.apple.CryptoTokenKit.pivtoken
1403 .El
1404 .El
1405 .It
1406 .Nm error
1407 .Op Fl h
1408 .Op Ar <error code(s)...>
1409 .Bl -item -offset -indent
1410 Display an error string for the given security-related error code.
1411 The error can be in decimal or hex, e.g. 1234 or 0x1234. Multiple
1412 errors can be separated by spaces.
1413 .El
1414 .El
1415 .El
1416 .Sh ENVIRONMENT      \" May not be needed
1417 .Bl -tag -width -indent
1418 .It Ev MallocStackLogging
1419 When using the
1420 .Nm leaks
1421 command or the
1422 .Fl l
1423 option it's probably a good idea to set this environment variable before
1424 .Nm
1425 is started.  Doing so will allow leaks to display symbolic backtraces.
1426 .El
1427 .Sh FILES
1428 .Bl -tag -width -indent
1429 .It Pa ~/Library/Preferences/com.apple.security.plist
1430 .Pp
1431 Property list file containing the current user's default keychain and keychain search list.
1432 .It Pa /Library/Preferences/com.apple.security.plist
1433 .Pp
1434 Property list file containing the system default keychain and keychain search list.  This is used by processes started at boot time, or those requesting to use the system search domain, such as system daemons.
1435 .It Pa /Library/Preferences/com.apple.security-common.plist
1436 .Pp
1437 Property list file containing the common keychain search list, which is appended to every user's search list and to the system search list.
1438 .El
1439 .Sh SEE ALSO
1440 .\" List links in ascending order by section, alphabetically within a section.
1441 .\" Please do not reference files that do not exist without filing a bug report
1442 .Xr certtool 1 ,
1443 .Xr leaks 1 ,
1444 .Xr pluginkit 8
1445 .\" .Xr systemkeychain 8
1446 .Sh HISTORY
1447 .Nm
1448 was first introduced in Mac OS X version 10.3.
1449 .Sh BUGS
1450 .Nm
1451 still needs more commands before it can be considered complete.
1452 In particular, it should someday supersede both the
1453 .Li certtool
1454 and
1455 .Li systemkeychain
1456 commands.