SecurityTool/security.1

   1 .\"Modified from man(1) of FreeBSD, the NetBSD mdoc.template, and mdoc.samples.
   2 .\"See Also:
   3 .\"man mdoc.samples for a complete listing of options
   4 .\"man mdoc for the short list of editing options
   5 .Dd March 1, 2012        \" DATE
   6 .Dt security 1           \" Program name and manual section number
   7 .Os Darwin
   8 .Sh NAME                 \" Section Header - required - don't modify
   9 .Nm security
  10 .\" The following lines are read in generating the apropos(man -k) database. Use only key
  11 .\" words here as the database is built based on the words here and in the .ND line.
  12 .\" Use .Nm macro to designate other names for the documented program.
  13 .Nd Command line interface to keychains and Security framework
  14 .Sh SYNOPSIS             \" Section Header - required - don't modify
  15 .Nm
  16 .Op Fl hilqv             \" [-hilqv]
  17 .Op Fl p Ar prompt       \" [-p prompt]
  18 .Op Ar command           \" [command]
  19 .Op Ar command_options   \" [command_options]
  20 .Op Ar command_args      \" [command_args]
  21 .Sh DESCRIPTION          \" Section Header - required - don't modify
  22 A simple command line interface which lets you administer keychains,
  23 manipulate keys and certificates, and do just about anything the
  24 Security framework is capable of from the command line.
  25 .Pp
  26 By default
  27 .Nm
  28 will execute the
  29 .Ar command
  30 supplied and report if anything went wrong.
  31 .Pp
  32 If the
  33 .Fl i
  34 or
  35 .Fl p
  36 options are provided,
  37 .Nm
  38 will enter interactive mode and allow the user to enter multiple commands on stdin.  When EOF is read from stdin
  39 .Nm
  40 will exit.
  41 .Pp
  42 Here is a complete list of the options available:
  43 .Bl -tag -width -indent
  44 .It Fl h
  45 If no arguments are specified, show a list of all commands.  If arguments are provided, show usage for each the specified commands.  This option is essentially the same as the
  46 .Nm help
  47 command.
  48 .It Fl i
  49 Run
  50 .Nm
  51 in interactive mode.  A prompt
  52 .Po
  53 .Li security>
  54 by default
  55 .Pc
  56 will be displayed and the user will be able to type commands on stdin until an EOF is encountered.
  57 .It Fl l
  58 Before
  59 .Nm
  60 exits, run
  61 .Dl "/usr/bin/leaks -nocontext"
  62 on itself to see if the command(s) you executed had any leaks.
  63 .It Fl p Ar prompt
  64 This option implies the
  65 .Fl i
  66 option but changes the default prompt to the argument specified instead.
  67 .It Fl q
  68 Will make
  69 .Nm
  70 less verbose.
  71 .It Fl v
  72 Will make
  73 .Nm
  74 more verbose.
  75 .El                      \" Ends the list
  76 .Pp
  77 .Sh "SECURITY COMMAND SUMMARY"
  78 .Nm
  79 provides a rich variety of commands
  80 .Po Ar command
  81 in the
  82 .Sx SYNOPSIS Pc Ns
  83 , each of which often has a wealth of options, to allow access to
  84 the broad functionality provided by the Security framework.  However,
  85 you don't have to master every detail for
  86 .Nm
  87 to be useful to you.
  88 .Pp
  89 Here are brief descriptions of all the
  90 .Nm
  91 commands:
  92 .Pp
  93 .Bl -tag -width user-trust-settings-enable -compact
  94 .It Nm help
  95 Show all commands, or show usage for a command.
  96 .It Nm list-keychains
  97 Display or manipulate the keychain search list.
  98 .It Nm default-keychain
  99 Display or set the default keychain.
 100 .It Nm login-keychain
 101 Display or set the login keychain.
 102 .It Nm create-keychain
 103 Create keychains.
 104 .It Nm delete-keychain
 105 Delete keychains and remove them from the search list.
 106 .It Nm lock-keychain
 107 Lock the specified keychain.
 108 .It Nm unlock-keychain
 109 Unlock the specified keychain.
 110 .It Nm set-keychain-settings
 111 Set settings for a keychain.
 112 .It Nm set-keychain-password
 113 Set password for a keychain.
 114 .It Nm show-keychain-info
 115 Show the settings for keychain.
 116 .It Nm dump-keychain
 117 Dump the contents of one or more keychains.
 118 .It Nm create-keypair
 119 Create an asymmetric key pair.
 120 .It Nm add-generic-password
 121 Add a generic password item.
 122 .It Nm add-internet-password
 123 Add an internet password item.
 124 .It Nm add-certificates
 125 Add certificates to a keychain.
 126 .It Nm find-generic-password
 127 Find a generic password item.
 128 .It Nm delete-generic-password
 129 Delete a generic password item.
 130 .It Nm find-internet-password
 131 Find an internet password item.
 132 .It Nm delete-internet-password
 133 Delete an internet password item.
 134 .It Nm find-certificate
 135 Find a certificate item.
 136 .It Nm find-identity
 137 Find an identity (certificate + private key).
 138 .It Nm delete-certificate
 139 Delete a certificate from a keychain.
 140 .It Nm set-identity-preference
 141 Set the preferred identity to use for a service.
 142 .It Nm get-identity-preference
 143 Get the preferred identity to use for a service.
 144 .It Nm create-db
 145 Create a db using the DL.
 146 .It Nm export
 147 Export items from a keychain.
 148 .It Nm import
 149 Import items into a keychain.
 150 .It Nm cms
 151 Encode or decode CMS messages.
 152 .It Nm install-mds
 153 Install (or re-install) the MDS database.
 154 .It Nm add-trusted-cert
 155 Add trusted certificate(s).
 156 .It Nm remove-trusted-cert
 157 Remove trusted certificate(s).
 158 .It Nm dump-trust-settings
 159 Display contents of trust settings.
 160 .It Nm user-trust-settings-enable
 161 Display or manipulate user-level trust settings.
 162 .It Nm trust-settings-export
 163 Export trust settings.
 164 .It Nm trust-settings-import
 165 Import trust settings.
 166 .It Nm verify-cert
 167 Verify certificate(s).
 168 .It Nm authorize
 169 Perform authorization operations.
 170 .It Nm authorizationdb
 171 Make changes to the authorization policy database.
 172 .It Nm execute-with-privileges
 173 Execute tool with privileges.
 174 .It Nm leaks
 175 Run
 176 .Pa /usr/bin/leaks
 177 on this process.
 178 .It Nm error
 179 Display a descriptive message for the given error code(s).
 180 .El
 181 .Sh "COMMON COMMAND OPTIONS"
 182 This section describes the
 183 .Ar command_options
 184 that are available across all
 185 .Nm
 186 commands.
 187 .Bl -tag -width -indent
 188 .It Fl h
 189 Show a usage message for the specified command.  This option is
 190 essentially the same as the
 191 .Ar help
 192 command.
 193 .El
 194 .Sh "SECURITY COMMANDS"
 195 Here (finally) are details on all the
 196 .Nm
 197 commands and the options each accepts.
 198 .Bl -item
 199 .It
 200 .Nm help
 201 .Op Fl h
 202 .Bl -item -offset -indent
 203 Show all commands, or show usage for a command.
 204 .El
 205 .It
 206 .Nm list-keychains
 207 .Op Fl h
 208 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 209 .Op Fl s Op Ar keychain...
 210 .Bl -item -offset -indent
 211 Display or manipulate the keychain search list.
 212 .It
 213 .Bl -tag -compact -width -indent
 214 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 215 Use the specified preference domain.
 216 .It Fl s
 217 Set the search list to the specified keychains.
 218 .El
 219 .El
 220 .It
 221 .Nm default-keychain
 222 .Op Fl h
 223 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 224 .Op Fl s Op Ar keychain
 225 .Bl -item -offset -indent
 226 Display or set the default keychain.
 227 .It
 228 .Bl -tag -compact -width -indent
 229 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 230 Use the specified preference domain.
 231 .It Fl s
 232 Set the default keychain to the specified
 233 .Ar keychain Ns .
 234 Unset it if no keychain is specified.
 235 .El
 236 .El
 237 .It
 238 .Nm login-keychain
 239 .Op Fl h
 240 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 241 .Op Fl s Op Ar keychain
 242 .Bl -item -offset -indent
 243 Display or set the login keychain.
 244 .It
 245 .Bl -tag -compact -width -indent
 246 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 247 Use the specified preference domain.
 248 .It Fl s
 249 Set the login keychain to the specified
 250 .Ar keychain Ns .
 251 Unset it if no keychain is specified.
 252 .El
 253 .El
 254 .It
 255 .Nm create-keychain
 256 .Op Fl hP
 257 .Op Fl p Ar password
 258 .Op Ar keychain...
 259 .Bl -item -offset -indent
 260 Create keychains.
 261 .It
 262 .Bl -tag -compact -width -indent-indent
 263 .It Fl P
 264 Prompt the user for a password using the SecurityAgent.
 265 .It Fl p Ar password
 266 Use
 267 .Ar password
 268 as the password for the keychains being created.
 269 .El
 270 .It
 271 If neither
 272 .Fl P
 273 or
 274 .Fl p Ar password
 275 are specified, the user is prompted for a password on the command line.
 276 .El
 277 .It
 278 .Nm delete-keychain
 279 .Op Fl h
 280 .Op Ar keychain...
 281 .Bl -item -offset -indent
 282 Delete keychains and remove them from the search list.
 283 .El
 284 .It
 285 .Nm lock-keychain
 286 .Op Fl h
 287 .Op Fl a Ns | Ns Ar keychain
 288 .Bl -item -offset -indent
 289 Lock
 290 .Ar keychain Ns
 291 \&, or the default keychain if none is specified.  If the
 292 .Fl a
 293 option is specified, all keychains are locked.
 294 .El
 295 .It
 296 .Nm unlock-keychain
 297 .Op Fl hu
 298 .Op Fl p Ar password
 299 .Op Ar keychain
 300 .Bl -item -offset -indent
 301 Unlock
 302 .Ar keychain Ns
 303 \&, or the default keychain if none is specified.
 304 .El
 305 .It
 306 .Nm set-keychain-settings
 307 .Op Fl hlu
 308 .Op Fl t Ar timeout
 309 .Op Ar keychain
 310 .Bl -item -offset -indent
 311 Set settings for
 312 .Ar keychain Ns
 313 \&, or the default keychain if none is specified.
 314 .It
 315 .Bl -tag -compact -width -indent-indent
 316 .It Fl l
 317 Lock keychain when the system sleeps.
 318 .It Fl u
 319 Lock keychain after timeout interval.
 320 .It Fl t Ar timeout
 321 Specify
 322 .Ar timeout
 323 interval in seconds (omitting this option specifies "no timeout").
 324 .El
 325 .El
 326 .It
 327 .Nm set-keychain-password
 328 .Op Fl h
 329 .Op Fl o Ar oldPassword
 330 .Op Fl p Ar newPassword
 331 .Op Ar keychain
 332 .Bl -item -offset -indent
 333 Set password for
 334 .Ar keychain Ns
 335 \&, or the default keychain if none is specified.
 336 .It
 337 .Bl -tag -compact -width -indent-indent
 338 .It Fl o Ar oldPassword
 339 Old keychain password (if not provided, will prompt)
 340 .It Fl p Ar newPassword
 341 New keychain password (if not provided, will prompt)
 342 .El
 343 .El
 344 .It
 345 .Nm show-keychain-info
 346 .Op Fl h
 347 .Op Ar keychain
 348 .Bl -item -offset -indent
 349 Show the settings for
 350 .Ar keychain Ns
 351 \&.
 352 .El
 353 .It
 354 .Nm dump-keychain
 355 .Op Fl adhir
 356 .Bl -item -offset -indent
 357 Dump the contents of one or more keychains.
 358 .It
 359 .Bl -tag -compact -width -indent-indent
 360 .It Fl a
 361 Dump access control list of items
 362 .It Fl d
 363 Dump (decrypted) data of items
 364 .It Fl i
 365 Interactive access control list editing mode
 366 .It Fl r
 367 Dump raw (encrypted) data of items
 368 .El
 369 .El
 370 .It
 371 .Nm create-keypair
 372 .Op Fl h
 373 .Op Fl a Ar alg
 374 .Op Fl s Ar size
 375 .Op Fl f Ar date
 376 .Op Fl t Ar date
 377 .Op Fl d Ar days
 378 .Op Fl k Ar keychain
 379 .Op Fl A Ns | Ns Fl T Ar appPath
 380 .Op Ar name
 381 .Bl -item -offset -indent
 382 Create an asymmetric key pair.
 383 .It
 384 .Bl -tag -compact -width -indent-indent
 385 .It Fl a Ar alg
 386 Use
 387 .Ar alg
 388 as the algorithm, can be rsa, dh, dsa or fee (default rsa)
 389 .It Fl s Ar size
 390 Specify the keysize in bits (default 512)
 391 .It Fl f Ar date
 392 Make a key valid from the specified date (ex: "13/11/10 3:30pm")
 393 .It Fl t Ar date
 394 Make a key valid to the specified date
 395 .It Fl d Ar days
 396 Make a key valid for the number of days specified from today
 397 .It Fl k Ar keychain
 398 Use the specified keychain rather than the default
 399 .It Fl A
 400 Allow any application to access this key without warning (insecure, not recommended!)
 401 .It Fl T Ar appPath
 402 Specify an application which may access this key (multiple
 403 .Fl T Ns
 404 \& options are allowed)
 405 .El
 406 .El
 407 .It
 408 .Nm add-generic-password
 409 .Op Fl h
 410 .Op Fl a Ar account
 411 .Op Fl s Ar service
 412 .Op Fl w Ar password
 413 .Op Ar options...
 414 .Op Ar keychain
 415 .Bl -item -offset -indent
 416 Add a generic password item.
 417 .It
 418 .Bl -tag -compact -width -indent-indent
 419 .It Fl a Ar account
 420 Specify account name (required)
 421 .It Fl c Ar creator
 422 Specify item creator (optional four-character code)
 423 .It Fl C Ar type
 424 Specify item type (optional four-character code)
 425 .It Fl D Ar kind
 426 Specify kind (default is "application password")
 427 .It Fl G Ar value
 428 Specify generic attribute value (optional)
 429 .It Fl j Ar comment
 430 Specify comment string (optional)
 431 .It Fl l Ar label
 432 Specify label (if omitted, service name is used as default label)
 433 .It Fl s Ar service
 434 Specify service name (required)
 435 .It Fl p Ar password
 436 Specify password to be added (legacy option, equivalent to
 437 .Fl w Ns
 438 \&)
 439 .It Fl w Ar password
 440 Specify password to be added
 441 .It Fl A
 442 Allow any application to access this item without warning (insecure, not recommended!)
 443 .It Fl T Ar appPath
 444 Specify an application which may access this item (multiple
 445 .Fl T Ns
 446 \& options are allowed)
 447 .It Fl U
 448 Update item if it already exists (if omitted, the item cannot already exist)
 449 .El
 450 .It
 451 .Bl -item
 452 By default, the application which creates an item is trusted to access its data without warning.  You can remove this default access by explicitly specifying an empty app pathname:
 453 .Fl T Ns
 454 \& "". If no keychain is specified, the password is added to the default keychain.
 455 .El
 456 .El
 457 .It
 458 .Nm add-internet-password
 459 .Op Fl h
 460 .Op Fl a Ar account
 461 .Op Fl s Ar server
 462 .Op Fl w Ar password
 463 .Op Ar options...
 464 .Op Ar keychain
 465 .Bl -item -offset -indent
 466 Add an internet password item.
 467 .It
 468 .Bl -tag -compact -width -indent-indent
 469 .It Fl a Ar account
 470 Specify account name (required)
 471 .It Fl c Ar creator
 472 Specify item creator (optional four-character code)
 473 .It Fl C Ar type
 474 Specify item type (optional four-character code)
 475 .It Fl d Ar domain
 476 Specify security domain string (optional)
 477 .It Fl D Ar kind
 478 Specify kind (default is "application password")
 479 .It Fl j Ar comment
 480 Specify comment string (optional)
 481 .It Fl l Ar label
 482 Specify label (if omitted, service name is used as default label)
 483 .It Fl p Ar path
 484 Specify path string (optional)
 485 .It Fl P Ar port
 486 Specify port number (optional)
 487 .It Fl r Ar protocol
 488 Specify protocol (optional four-character SecProtocolType, e.g. "http", "ftp ")
 489 .It Fl s Ar server
 490 Specify server name (required)
 491 .It Fl t Ar authenticationType
 492 Specify authentication type (as a four-character SecAuthenticationType, default is "dflt")
 493 .It Fl w Ar password
 494 Specify password to be added
 495 .It Fl A
 496 Allow any application to access this item without warning (insecure, not recommended!)
 497 .It Fl T Ar appPath
 498 Specify an application which may access this item (multiple
 499 .Fl T Ns
 500 \& options are allowed)
 501 .It Fl U
 502 Update item if it already exists (if omitted, the item cannot already exist)
 503 .El
 504 .It
 505 .Bl -item
 506 By default, the application which creates an item is trusted to access its data without warning.  You can remove this default access by explicitly specifying an empty app pathname:
 507 .Fl T Ns
 508 \& "". If no keychain is specified, the password is added to the default keychain.
 509 .El
 510 .El
 511 .It
 512 .Nm add-certificates
 513 .Op Fl h
 514 .Op Fl k Ar keychain
 515 .Ar file...
 516 .Bl -item -offset -indent
 517 Add certficates contained in the specified
 518 .Ar files
 519 to the default keychain.  The files must contain one DER encoded X509 certificate each.
 520 .Bl -tag -compact -width -indent-indent
 521 .It Fl k Ar keychain
 522 Use
 523 .Ar keychain
 524 rather than the default keychain.
 525 .El
 526 .El
 527 .It
 528 .Nm find-generic-password
 529 .Op Fl h
 530 .Op Fl a Ar account
 531 .Op Fl s Ar service
 532 .Op Fl Ar options...
 533 .Op Fl g
 534 .Op Fl Ar keychain...
 535 .Bl -item -offset -indent
 536 Find a generic password item.
 537 .It
 538 .Bl -tag -compact -width -indent-indent
 539 .It Fl a Ar account
 540 Match account string
 541 .It Fl c Ar creator
 542 Match creator (four-character code)
 543 .It Fl C Ar type
 544 Match type (four-character code)
 545 .It Fl D Ar kind
 546 Match kind string
 547 .It Fl G Ar value
 548 Match value string (generic attribute)
 549 .It Fl j Ar comment
 550 Match comment string
 551 .It Fl l Ar label
 552 Match label string
 553 .It Fl s Ar service
 554 Match service string
 555 .It Fl g
 556 Display the password for the item found
 557 .It Fl w
 558 Display the password(only) for the item found
 559 .El
 560 .El
 561 .It
 562 .Nm delete-generic-password
 563 .Op Fl h
 564 .Op Fl a Ar account
 565 .Op Fl s Ar service
 566 .Op Fl Ar options...
 567 .Op Fl Ar keychain...
 568 .Bl -item -offset -indent
 569 Delete a generic password item.
 570 .It
 571 .Bl -tag -compact -width -indent-indent
 572 .It Fl a Ar account
 573 Match account string
 574 .It Fl c Ar creator
 575 Match creator (four-character code)
 576 .It Fl C Ar type
 577 Match type (four-character code)
 578 .It Fl D Ar kind
 579 Match kind string
 580 .It Fl G Ar value
 581 Match value string (generic attribute)
 582 .It Fl j Ar comment
 583 Match comment string
 584 .It Fl l Ar label
 585 Match label string
 586 .It Fl s Ar service
 587 Match service string
 588 .El
 589 .El
 590 .It
 591 .Nm delete-internet-password
 592 .Op Fl h
 593 .Op Fl a Ar account
 594 .Op Fl s Ar server
 595 .Op Ar options...
 596 .Op Ar keychain...
 597 .Bl -item -offset -indent
 598 Delete an internet password item.
 599 .It
 600 .Bl -tag -compact -width -indent-indent
 601 .It Fl a Ar account
 602 Match account string
 603 .It Fl c Ar creator
 604 Match creator (four-character code)
 605 .It Fl C Ar type
 606 Match type (four-character code)
 607 .It Fl d Ar securityDomain
 608 Match securityDomain string
 609 .It Fl D Ar kind
 610 Match kind string
 611 .It Fl j Ar comment
 612 Match comment string
 613 .It Fl l Ar label
 614 Match label string
 615 .It Fl p Ar path
 616 Match path string
 617 .It Fl P Ar port
 618 Match port number
 619 .It Fl r Ar protocol
 620 Match protocol (four-character code)
 621 .It Fl s Ar server
 622 Match server string
 623 .It Fl t Ar authenticationType
 624 Match authenticationType (four-character code)
 625 .El
 626 .El
 627 .It
 628 .Nm find-internet-password
 629 .Op Fl h
 630 .Op Fl a Ar account
 631 .Op Fl s Ar server
 632 .Op Ar options...
 633 .Op Fl g
 634 .Op Ar keychain...
 635 .Bl -item -offset -indent
 636 Find an internet password item.
 637 .It
 638 .Bl -tag -compact -width -indent-indent
 639 .It Fl a Ar account
 640 Match account string
 641 .It Fl c Ar creator
 642 Match creator (four-character code)
 643 .It Fl C Ar type
 644 Match type (four-character code)
 645 .It Fl d Ar securityDomain
 646 Match securityDomain string
 647 .It Fl D Ar kind
 648 Match kind string
 649 .It Fl j Ar comment
 650 Match comment string
 651 .It Fl l Ar label
 652 Match label string
 653 .It Fl p Ar path
 654 Match path string
 655 .It Fl P Ar port
 656 Match port number
 657 .It Fl r Ar protocol
 658 Match protocol (four-character code)
 659 .It Fl s Ar server
 660 Match server string
 661 .It Fl t Ar authenticationType
 662 Match authenticationType (four-character code)
 663 .It Fl g
 664 Display the password for the item found
 665 .It Fl w
 666 Display the password(only) for the item found
 667 .El
 668 .El
 669 .It
 670 .Nm find-certificate
 671 .Op Fl h
 672 .Op Fl a
 673 .Op Fl c Ar name
 674 .Op Fl e Ar emailAddress
 675 .Op Fl m
 676 .Op Fl p
 677 .Op Fl Z
 678 .Op Ar keychain...
 679 .Bl -item -offset -indent
 680 Find a certificate item.  If no
 681 .Ar keychain Ns
 682 \& arguments are provided, the default search list is used.
 683 .It
 684 Options:
 685 .Bl -tag -compact -width -indent-indent
 686 .It Fl a
 687 Find all matching certificates, not just the first one
 688 .It Fl c Ar name
 689 Match on
 690 .Ar name Ns
 691 \& when searching (optional)
 692 .It Fl e Ar emailAddress
 693 Match on
 694 .Ar emailAddress Ns
 695 \& when searching (optional)
 696 .It Fl m
 697 Show the email addresses in the certificate
 698 .It Fl p
 699 Output certificate in pem format.  Default is to dump the attributes and keychain the cert is in.
 700 .It Fl Z
 701 Print SHA-1 hash of the certificate
 702 .El
 703 .It
 704 .Sy Examples
 705 .Bl -tag -width -indent
 706 .It security> find-certificate -a -p > allcerts.pem
 707 Exports all certificates from all keychains into a pem file called allcerts.pem.
 708 .It security> find-certificate -a -e me@foo.com -p > certs.pem
 709 Exports all certificates from all keychains with the email address
 710 me@foo.com into a pem file called certs.pem.
 711 .It security> find-certificate -a -c MyName -Z login.keychain | grep ^SHA-1
 712 Print the SHA-1 hash of every certificate in 'login.keychain' whose common name includes 'MyName'
 713 .El
 714 .El
 715 .It
 716 .Nm find-identity
 717 .Op Fl h
 718 .Op Fl p Ar policy
 719 .Op Fl s Ar string
 720 .Op Fl v
 721 .Op Ar keychain...
 722 .Bl -item -offset -indent
 723 Find an identity (certificate + private key) satisfying a given policy. If no
 724 .Ar policy Ns
 725 \& arguments are provided, the X.509 basic policy is assumed. If no
 726 .Ar keychain Ns
 727 \& arguments are provided, the default search list is used.
 728 .It
 729 Options:
 730 .Bl -tag -compact -width -indent-indent
 731 .It Fl p Ar policy
 732 Specify
 733 .Ar policy Ns
 734 \& to evaluate (multiple -p options are allowed). Supported policies:
 735 basic, ssl-client, ssl-server, smime, eap, ipsec, ichat, codesigning,
 736 sys-default, sys-kerberos-kdc
 737 .It Fl s Ar string
 738 Specify optional policy-specific
 739 .Ar string Ns
 740 \& (e.g. a DNS hostname for SSL, or RFC822 email address for S/MIME)
 741 .It Fl v
 742 Show valid identities only (default is to show all identities)
 743 .El
 744 .It
 745 .Sy Examples
 746 .Bl -tag -width -indent
 747 .It security> find-identity -v -p ssl-client
 748 Display valid identities that can be used for SSL client authentication
 749 .It security> find-identity -p ssl-server -s www.domain.com
 750 Display identities for a SSL server running on the host 'www.domain.com'
 751 .It security> find-identity -p smime -s user@domain.com
 752 Display identities that can be used to sign a message from 'user@domain.com'
 753 .El
 754 .El
 755 .It
 756 .Nm delete-certificate
 757 .Op Fl h
 758 .Op Fl c Ar name
 759 .Op Fl Z Ar hash
 760 .Op Fl t
 761 .Op Ar keychain...
 762 .Bl -item -offset -indent
 763 Delete a certificate from a keychain.  If no
 764 .Ar keychain Ns
 765 \& arguments are provided, the default search list is used.
 766 .It
 767 .Bl -tag -compact -width -indent-indent
 768 .It Fl c Ar name
 769 Specify certificate to delete by its common name
 770 .It Fl Z Ar hash
 771 Specify certificate to delete by its SHA-1 hash
 772 .It Fl t
 773 Also delete user trust settings for this certificate
 774 .El
 775 .It
 776 The certificate to be deleted must be uniquely specified either by a
 777 string found in its common name, or by its SHA-1 hash.
 778 .El
 779 .It
 780 .Nm set-identity-preference
 781 .Op Fl h
 782 .Op Fl n
 783 .Op Fl c Ar identity
 784 .Op Fl s Ar service
 785 .Op Fl u Ar keyUsage
 786 .Op Fl Z Ar hash
 787 .Op Ar keychain...
 788 .Bl -item -offset -indent
 789 Set the preferred identity to use for a service.
 790 .It
 791 .Bl -tag -compact -width -indent-indent
 792 .It Fl n
 793 Specify no identity (clears existing preference for the given service)
 794 .It Fl c Ar identity
 795 Specify identity by common name of the certificate
 796 .It Fl s Ar service
 797 Specify service (may be a URL, RFC822 email address, DNS host, or other name) for which this identity is to be preferred
 798 .It Fl u Ar keyUsage
 799 Specify key usage (optional)
 800 .It Fl Z Ar hash
 801 Specify identity by SHA-1 hash of certificate (optional)
 802 .El
 803 .It
 804 The identity is located by searching the specified keychain(s) for a certificate whose common name contains
 805 the given identity string. If no keychains are specified to search, the default search list is used. Different
 806 identity preferences can be set for individual key usages. You can differentiate between two identities which contain
 807 the same string by providing a SHA-1 hash of the certificate (in addition to, or instead of, the name.)
 808 .It
 809 .Sy PARTIAL PATHS AND WILDCARDS
 810 .It
 811 Prior to 10.5.4, identity preferences for SSL/TLS client authentication could only be set on a per-URL basis. The
 812 URL being visited had to match the service name exactly for the preference to be in effect.
 813 .It
 814 In 10.5.4, it became possible to specify identity preferences on a per-server basis, by using
 815 a service name with a partial path URL to match more specific paths on the same server. For
 816 example, if an identity preference for "https://www.apache-ssl.org/" exists, it will be in effect for
 817 "https://www.apache-ssl.org/cgi/cert-export", and so on. Note that partial path URLs must end with a trailing
 818 slash character.
 819 .It
 820 Starting with 10.6, it is possible to specify identity preferences on a per-domain
 821 basis, by using the wildcard character '*' as the leftmost component of the service name. Unlike SSL wildcards,
 822 an identity preference wildcard can match more than one subdomain. For example, an identity preference for
 823 the name "*.army.mil" will match "server1.subdomain1.army.mil" or "server2.subdomain2.army.mil". Likewise,
 824 a preference for "*.mil" will match both "server.army.mil" and "server.navy.mil".
 825 .It
 826 .Sy KEY USAGE CODES
 827 .It
 828 .Bl -tag -width -indent
 829      0 - preference is in effect for all possible key usages (default)
 830      1 - encryption only
 831      2 - decryption only
 832      4 - signing only
 833      8 - signature verification only
 834     16 - signing with message recovery only
 835     32 - signature verification with message recovery only
 836     64 - key wrapping only
 837    128 - key unwrapping only
 838    256 - key derivation only
 839 .It  To specify more than one usage, add values together.
 840 .El
 841 .El
 842 .It
 843 .Nm get-identity-preference
 844 .Op Fl h
 845 .Op Fl s Ar service
 846 .Op Fl u Ar keyUsage
 847 .Op Fl p
 848 .Op Fl c
 849 .Op Fl Z
 850 .Bl -item -offset -indent
 851 Get the preferred identity to use for a service.
 852 .It
 853 .Bl -tag -compact -width -indent-indent
 854 .It Fl s Ar service
 855 Specify service (may be a URL, RFC822 email address, DNS host, or other name)
 856 .It Fl u Ar keyUsage
 857 Specify key usage (optional)
 858 .It Fl p
 859 Output identity certificate in pem format
 860 .It Fl c
 861 Print common name of the preferred identity certificate
 862 .It Fl Z
 863 Print SHA-1 hash of the preferred identity certificate
 864 .El
 865 .El
 866 .It
 867 .Nm create-db
 868 .Op Fl aho0
 869 .Op Fl g Ar dl Ns | Ns Ar cspdl
 870 .Op Fl m Ar mode
 871 .Op Ar name
 872 .Bl -item -offset -indent
 873 Create a db using the DL.  If
 874 .Ar name
 875 isn't provided
 876 .Nm
 877 will prompt the user to type a name.
 878 .It
 879 Options:
 880 .Bl -tag -compact -width -indent-indent
 881 .It Fl a
 882 Turn off autocommit
 883 .It Fl g Ar dl Ns | Ns Ar cspdl
 884 Use the AppleDL (default) or AppleCspDL
 885 .It Fl m Ar mode
 886 Set the file permissions to
 887 .Ar mode Ns
 888 \&.
 889 .It Fl o
 890 Force using openparams argument
 891 .It Fl 0
 892 Force using version 0 openparams
 893 .El
 894 .It
 895 .Sy Examples
 896 .Bl -tag -width -indent
 897 .It security> create-db -m 0644 test.db
 898 .It security> create-db -g cspdl -a test2.db
 899 .El
 900 .\"new import/export commands.
 901 .El
 902 .It
 903 .Nm export
 904 .Op Fl k Ar keychain
 905 .Op Fl t Ar type
 906 .Op Fl f Ar format
 907 .Op Fl w
 908 .Op Fl p Ar format
 909 .Op Fl P Ar passphrase
 910 .Op Fl o Ar outfile
 911 .Bl -item -offset -indent
 912 Export one or more items from a keychain to one of a number of external representations.  If
 913 .Ar keychain
 914 isn't provided, items will be exported from the user's default keychain.
 915 .It
 916 Options:
 917 .Bl -tag -compact -width -indent-indent
 918 .It Fl k Ar keychain
 919 Specify keychain from which item(s) will be exported.
 920 .It Fl t Ar type
 921 Specify the type of items to export. Possible types are certs, allKeys, pubKeys, privKeys, identities, and all. The default is all. An identity consists of both a certificate and the corresponding private key.
 922 .It Fl f Ar format
 923 Specify the format of the exported data. Possible formats are openssl, bsafe, pkcs7, pkcs8, pkcs12, x509, openssh1, openssh2, and pemseq. The default is pemseq if more than one item is being exported. The default is openssl if one key is being exported. The default is x509 if one certificate is being exported.
 924 .It Fl w
 925 Specifies that private keys are to be wrapped on export.
 926 .It Fl p
 927 Specifies that PEM armour is to be applied to the output data.
 928 .It Fl P Ar passphrase
 929 Specify the wrapping passphrase immediately. The default is to obtain a secure passphrase via GUI.
 930 .It Fl o Ar outfile
 931 Write the output data to
 932 .Ar outfile Ns
 933 \&. Default is to write data to stdout.
 934 .El
 935 .It
 936 .Sy Examples
 937 .Bl -tag -width -indent
 938 .It security> export -k login.keychain -t certs -o /tmp/certs.pem
 939 .It security> export -k newcert.keychain -t identities -f pkcs12 -o /tmp/mycerts.p12
 940 .El
 941 .\"marker.
 942 .El
 943 .It
 944 .Nm import
 945 inputfile
 946 .Op Fl k Ar keychain
 947 .Op Fl t Ar type
 948 .Op Fl f Ar format
 949 .Op Fl w
 950 .Op Fl P Ar passphrase
 951 .Op Ar options...
 952 .Bl -item -offset -indent
 953 Import one or more items from
 954 .Ar inputfile Ns
 955 \& into a keychain. If
 956 .Ar keychain
 957 isn't provided, items will be imported into the user's default keychain.
 958 .It
 959 Options:
 960 .Bl -tag -compact -width -indent-indent
 961 .It Fl k Ar keychain
 962 Specify keychain into which item(s) will be imported.
 963 .It Fl t Ar type
 964 Specify the type of items to import. Possible types are cert, pub, priv, session, cert, and agg. Pub, priv, and session refer to keys; agg is one of the aggregate types (pkcs12 and PEM sequence). The command can often figure out what item_type an item contains based in the filename and/or item_format.
 965 .It Fl f Ar format
 966 Specify the format of the exported data. Possible formats are openssl, bsafe, raw, pkcs7, pkcs8, pkcs12, x509, openssh1, openssh2, and pemseq. The command can often figure out what format an item is in based in the filename and/or item_type.
 967 .It Fl w
 968 Specify that private keys are wrapped and must be unwrapped on import.
 969 .It Fl x
 970 Specify that private keys are non-extractable after being imported.
 971 .It Fl P Ar passphrase
 972 Specify the unwrapping passphrase immediately. The default is to obtain a secure passphrase via GUI.
 973 .It Fl a Ar attrName Ar attrValue
 974 Specify optional extended attribute name and value. Can be used multiple times. This is only valid when importing keys.
 975 .It Fl A
 976 Allow any application to access the imported key without warning (insecure, not recommended!)
 977 .It Fl T Ar appPath
 978 Specify an application which may access the imported key (multiple
 979 .Fl T Ns
 980 \& options are allowed)
 981 .El
 982 .It
 983 .Sy Examples
 984 .Bl -tag -width -indent
 985 .It security> import /tmp/certs.pem -k
 986 .It security> import /tmp/mycerts.p12 -t agg -k newcert.keychain
 987 .It security> import /tmp/mycerts.p12 -f pkcs12 -k newcert.keychain
 988 .El
 989 .\"end of new import/export commands.
 990 .El
 991 .It
 992 .Nm cms
 993 .Op Fl C Ns | Ns Fl D Ns | Ns Fl E Ns | Ns Fl S
 994 .Op Ar options...
 995 .Bl -item -offset -indent
 996 Encode or decode CMS messages.
 997 .Bl -tag -compact -width -indent-indent
 998 .It Fl C
 999 create a CMS encrypted message
1000 .It Fl D
1001 decode a CMS message
1002 .It Fl E
1003 create a CMS enveloped message
1004 .It Fl S
1005 create a CMS signed message
1006 .El
1007 .It
1008 Decoding options:
1009 .Bl -tag -compact -width -indent-indent
1010 .It Fl c Ar content
1011 use this detached content file
1012 .It Fl h Ar level
1013 generate email headers with info about CMS message (output
1014 .Ar level Ns
1015 \& >= 0)
1016 .It Fl n
1017 suppress output of content
1018 .El
1019 .It
1020 Encoding options:
1021 .Bl -tag -compact -width -indent-indent
1022 .It Fl r Ar id,...
1023 create envelope for comma-delimited list of recipients, where id can be a certificate nickname or email address
1024 .It Fl G
1025 include a signing time attribute
1026 .It Fl H Ar hash
1027 hash = MD2|MD4|MD5|SHA1|SHA256|SHA384|SHA512 (default: SHA1)
1028 .It Fl N Ar nick
1029 use certificate named "nick" for signing
1030 .It Fl P
1031 include a SMIMECapabilities attribute
1032 .It Fl T
1033 do not include content in CMS message
1034 .It Fl Y Ar nick
1035 include an EncryptionKeyPreference attribute with certificate (use "NONE" to omit)
1036 .It Fl Z Ar hash
1037 find a certificate by subject key ID
1038 .El
1039 .It
1040 Common options:
1041 .Bl -tag -compact -width -indent-indent
1042 .It Fl e Ar envelope
1043 specify envelope file (valid with
1044 .Fl D Ns
1045 \& or
1046 .Fl E Ns
1047 \&)
1048 .It Fl k Ar keychain
1049 specify keychain to use
1050 .It Fl i Ar infile
1051 use infile as source of data (default: stdin)
1052 .It Fl o Ar outfile
1053 use outfile as destination of data (default: stdout)
1054 .It Fl p Ar password
1055 use password as key db password (default: prompt)
1056 .It Fl s
1057 pass data a single byte at a time to CMS
1058 .It Fl u Ar certusage
1059 set type of certificate usage (default: certUsageEmailSigner)
1060 .It Fl v
1061 print debugging information
1062 .El
1063 .It
1064 Cert usage codes:
1065                   0 - certUsageSSLClient
1066                   1 - certUsageSSLServer
1067                   2 - certUsageSSLServerWithStepUp
1068                   3 - certUsageSSLCA
1069                   4 - certUsageEmailSigner
1070                   5 - certUsageEmailRecipient
1071                   6 - certUsageObjectSigner
1072                   7 - certUsageUserCertImport
1073                   8 - certUsageVerifyCA
1074                   9 - certUsageProtectedObjectSigner
1075                  10 - certUsageStatusResponder
1076                  11 - certUsageAnyCA
1077 .It
1078 .El
1079 .It
1080 .Nm install-mds
1081 .Bl -item -offset -indent
1082 Install (or re-install) the Module Directory Services (MDS) database. This is a system tool which is not normally used by users. There are no options.
1083 .El
1084 .It
1085 .Nm add-trusted-cert
1086 .Op Fl d
1087 .Op Fl r Ar resultType
1088 .Op Fl p Ar policy
1089 .Op Fl a Ar appPath
1090 .Op Fl s Ar policyString
1091 .Op Fl e Ar allowedError
1092 .Op Fl u Ar keyUsage
1093 .Op Fl k Ar keychain
1094 .Op Fl i Ar settingsFileIn
1095 .Op Fl o Ar settingsFileOut
1096 .Op Fl D
1097 certFile
1098 .Bl -item -offset -indent
1099 Add certificate (in DER or PEM format) from
1100 .Ar certFile Ns
1101 \& to per-user or local Admin Trust Settings. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1102 .It
1103 Options:
1104 .Bl -tag -compact -width -indent-indent
1105 .It Fl d
1106 Add to admin cert store; default is user.
1107 .It Fl r Ar resultType
1108 resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
1109 .It Fl p Ar policy
1110 Specify policy constraint (ssl, smime, codeSign, IPSec, iChat, basic, swUpdate, pkgSign, pkinitClient, pkinitServer, eap).
1111 .It Fl r Ar resultType
1112 resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
1113 .It Fl a Ar appPath
1114 Specify application constraint.
1115 .It Fl s Ar policyString
1116 Specify policy-specific string.
1117 .It Fl e Ar allowedError
1118 Specify allowed error (an integer value, or one of: certExpired, hostnameMismatch)
1119 .It Fl u Ar keyUsage
1120 Specify key usage, an integer.
1121 .It Fl k Ar keychain
1122 Specify keychain to which cert is added.
1123 .It Fl i Ar settingsFileIn
1124 Input trust settings file; default is user domain.
1125 .It Fl o Ar settingsFileOut
1126 Output trust settings file; default is user domain.
1127 .It Fl D
1128 Add default setting instead of per-cert setting. No certFile is specified when using this option
1129 .El
1130 .It
1131 .Sy Key usage codes:
1132     -1 - Any
1133      1 - Sign
1134      2 - Encrypt/Decrypt Data
1135      4 - Encrypt/Decrypt Key
1136      8 - Sign certificate
1137     16 - Sign revocation
1138     32 - Key exchange
1139     To specify more than one usage, add values together (except -1 - Any).
1140 .It
1141 .Sy Examples
1142 .Bl -tag -width -indent
1143 .Dl security> add-trusted-cert /tmp/cert.der
1144 .Dl security> add-trusted-cert -d .tmp/cert.der
1145 .El
1146 .\"marker.
1147 .It
1148 .Nm remove-trusted-cert
1149 .Op Fl d
1150 .Op Fl D
1151 certFile
1152 .Bl -item -offset -indent
1153 Remove certificate (in DER or PEM format) in
1154 .Ar certFile Ns
1155 \& from per-user or local Admin Trust Settings. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1156 .It
1157 Options:
1158 .Bl -tag -compact -width -indent-indent
1159 .It Fl d
1160 Remove from admin cert store; default is user.
1161 .It Fl D
1162 Remove Default Root Cert setting instead of an actual cert setting. No certFile is specified when using this option.
1163 .El
1164 .\"marker.
1165 .El
1166 .It
1167 .Nm dump-trust-settings
1168 .Op Fl s
1169 .Op Fl d
1170 .Bl -item -offset -indent
1171 Display Trust Settings.
1172 .It
1173 Options:
1174 .Bl -tag -compact -width -indent-indent
1175 .It Fl s
1176 Display trusted system certs; default is user.
1177 .It Fl d
1178 Display trusted admin certs; default is user.
1179 .El
1180 .\"marker.
1181 .El
1182 .It
1183 .Nm user-trust-settings-enable
1184 .Op Fl d
1185 .Op Fl e
1186 .Bl -item -offset -indent
1187 Display or manipulate user-level Trust Settings. With no arguments, shows the current state of the user-level Trust Settings enable. Otherwise enables or disables user-level Trust Settings.
1188 .It
1189 Options:
1190 .Bl -tag -compact -width -indent-indent
1191 .It Fl d
1192 Disable user-level Trust Settings.
1193 .It Fl e
1194 Enable user-level Trust Settings.
1195 .El
1196 .\"marker.
1197 .El
1198 .It
1199 .Nm trust-settings-export
1200 .Op Fl s
1201 .Op Fl d
1202 settings_file
1203 .Bl -item -offset -indent
1204 Export Trust Settings to the specified file.
1205 .It
1206 Options:
1207 .Bl -tag -compact -width -indent-indent
1208 .It Fl s
1209 Export system Trust Settings; default is user.
1210 .It Fl d
1211 Export admin Trust Settings; default is user.
1212 .El
1213 .\"marker.
1214 .El
1215 .It
1216 .Nm trust-settings-import
1217 .Op Fl d
1218 settings_file
1219 .Bl -item -offset -indent
1220 Import Trust Settings from the specified file. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1221 .It
1222 Options:
1223 .Bl -tag -compact -width -indent-indent
1224 .It Fl d
1225 Import admin Trust Settings; default is user.
1226 .El
1227 .\"marker.
1228 .El
1229 .It
1230 .Nm verify-cert
1231 .Op Fl c Ar certFile
1232 .Op Fl r Ar rootCertFile
1233 .Op Fl p Ar policy
1234 .Op Fl k Ar keychain
1235 .Op Fl d Ar date
1236 .Op Fl n
1237 .Op Fl L
1238 .Op Fl l
1239 .Op Fl e Ar emailAddress
1240 .Op Fl s Ar sslHost
1241 .Op Fl q
1242 .Bl -item -offset -indent
1243 Verify one or more certificates.
1244 .It
1245 Options:
1246 .Bl -tag -compact -width -indent-indent
1247 .It Fl c Ar certFile
1248 Certificate to verify, in DER or PEM format. Can be specified more than once; leaf certificate has to be specified first.
1249 .It Fl r Ar rootCertFile
1250 Root certificate, in DER or PEM format. Can be specified more than once. If not specified, the system anchor certificates are used. If one root certificate is specified, and zero (non-root) certificates are specified, the root certificate is verified against itself.
1251 .It Fl p Ar policy
1252 Specify verification policy (ssl, smime, codeSign, IPSec, iChat, basic, swUpdate, pkgSign, pkinitClient, pkinitServer, eap, appleID, macappstore, timestamping). Default is basic.
1253 .It Fl k Ar keychain
1254 Keychain to search for intermediate certs. Can be specified multiple times. Default is the current user's keychain search list.
1255 .It Fl d Ar date
1256 Date to set for verification. Specified in the format of YYYY-MM-DD-hh:mm:ss (time optional). e.g: 2016-04-25-15:59:59 for April 25, 2016 at 3:59:59 pm in GMT
1257 .It Fl n
1258 Avoid searching any keychains.
1259 .It Fl L
1260 Use local certificates only. If an issuing CA certificate is missing, this option will avoid accessing the network to fetch it.
1261 .It Fl l
1262 Specifies that the leaf certificate is a CA cert. By default, a leaf certificate with a Basic Constraints extension with the CA bit set fails verification.
1263 .It Fl e Ar emailAddress
1264 Specify email address for the smime policy.
1265 .It Fl s Ar sslHost
1266 Specify SSL host name for the ssl policy.
1267 .It Fl q
1268 Quiet, no stdout or stderr.
1269 .El
1270 .It
1271 .Sy Examples
1272 .Bl -tag -width -indent
1273 .It security> verify-cert -c applestore0.cer -c applestore1.cer -p ssl -s store.apple.com
1274 .It security> verify-cert -r serverbasic.crt
1275 .El
1276 .\"marker.
1277 .El
1278 .It
1279 .Nm authorize
1280 .Op Fl updPiew
1281 .Op Ar right...
1282 .Bl -item -offset -indent
1283 Authorize requested right(s).  The extend-rights flag will be passed by default.
1284 .It
1285 Options:
1286 .Bl -tag -compact -width -indent-indent
1287 .It Fl u
1288 Allow user interaction.
1289 .It Fl p
1290 Allow returning partial rights.
1291 .It Fl d
1292 Destroy acquired rights.
1293 .It Fl P
1294 Pre-authorize rights only.
1295 .It Fl l
1296 Operate authorization in least privileged mode.
1297 .It Fl i
1298 Internalize authref passed on stdin.
1299 .It Fl e
1300 Externalize authref to stdout
1301 .It Fl w
1302 Wait while holding AuthorizationRef until stdout is closed. This will allow client to read externalized AuthorizationRef from pipe.
1303 .El
1304 .It
1305 .Sy Examples
1306 .Bl -tag -width -indent
1307 .It security> security authorize -ud my-right
1308 Basic authorization of my-right.
1309 .It security> security -q authorize -uew my-right | security -q authorize -i my-right
1310 Authorizing a right and passing it to another command as a way to add authorization to shell scripts.
1311 .El
1312 .El
1313 .It
1314 .Nm authorizationdb
1315 .Ar read <right-name>
1316 .It
1317 .Nm authorizationdb
1318 .Ar write <right-name> [allow|deny|<rulename>]
1319 .It
1320 .Nm authorizationdb
1321 .Ar remove <right-name>
1322 .Bl -item -offset -indent
1323 Read/Modify authorization policy database. Without a rulename write will read a dictionary as a plist from stdin.
1324 .It
1325 .Sy Examples
1326 .Bl -tag -width -indent
1327 .It security> security authorizationdb read system.privilege.admin > /tmp/aewp-def
1328 Read definition of system.privilege.admin right.
1329 .It security> security authorizationdb write system.preferences < /tmp/aewp-def
1330 Set system.preferences to definition of system.privilege.admin right.
1331 .It security> security authorizationdb write system.preferences authenticate-admin
1332 Every change to preferences requires an Admin user to authenticate.
1333 .El
1334 .El
1335 .It
1336 .Nm execute-with-privileges
1337 .Ar <program>
1338 .Op Ar args...
1339 .Bl -item -offset -indent
1340 Execute tool with privileges.
1341 On success stdin will be read and forwarded to the tool.
1342 .El
1343 .It
1344 .Nm leaks
1345 .Op Fl h
1346 .Op Fl cycles
1347 .Op Fl nocontext
1348 .Op Fl nostacks
1349 .Op Fl exclude Ar symbol
1350 .Bl -item -offset -indent
1351 Run
1352 .Li /usr/bin/leaks
1353 on this process.  This can help find memory leaks after running
1354 certain commands.
1355 .It
1356 Options:
1357 .Bl -tag -compact -width -indent-indent
1358 .It Fl cycles
1359 Use a stricter algorithm (See
1360 .Xr leaks 1
1361 for details).
1362 .It Fl nocontext
1363 Withhold the hex dumps of the leaked memory.
1364 .It Fl nostacks
1365 Don't show stack traces of leaked memory.
1366 .It Fl exclude Ar symbol
1367 Ignore leaks called from
1368 .Ar symbol Ns .
1369 .El
1370 .El
1371 .It
1372 .Nm error
1373 .Op Fl h
1374 .Op Ar <error code(s)...>
1375 .Bl -item -offset -indent
1376 Display an error string for the given security-related error code.
1377 The error can be in decimal or hex, e.g. 1234 or 0x1234. Multiple
1378 errors can be separated by spaces.
1379 .El
1380 .El
1381 .El
1382 .Sh ENVIRONMENT      \" May not be needed
1383 .Bl -tag -width -indent
1384 .It Ev MallocStackLogging
1385 When using the
1386 .Nm leaks
1387 command or the
1388 .Fl l
1389 option it's probably a good idea to set this environment variable before
1390 .Nm
1391 is started.  Doing so will allow leaks to display symbolic backtraces.
1392 .El
1393 .Sh FILES
1394 .Bl -tag -width -indent
1395 .It Pa ~/Library/Preferences/com.apple.security.plist
1396 .Pp
1397 Property list file containing the current user's default keychain and keychain search list.
1398 .It Pa /Library/Preferences/com.apple.security.plist
1399 .Pp
1400 Property list file containing the system default keychain and keychain search list.  This is used by processes started at boot time, or those requesting to use the system search domain, such as system daemons.
1401 .It Pa /Library/Preferences/com.apple.security-common.plist
1402 .Pp
1403 Property list file containing the common keychain search list, which is appended to every user's search list and to the system search list.
1404 .El
1405 .Sh SEE ALSO
1406 .\" List links in ascending order by section, alphabetically within a section.
1407 .\" Please do not reference files that do not exist without filing a bug report
1408 .Xr certtool 1 ,
1409 .Xr leaks 1
1410 .\" .Xr systemkeychain 8
1411 .Sh HISTORY
1412 .Nm
1413 was first introduced in Mac OS X version 10.3.
1414 .Sh BUGS
1415 .Nm
1416 still needs more commands before it can be considered complete.
1417 In particular, it should someday supersede both the
1418 .Li certtool
1419 and
1420 .Li systemkeychain
1421 commands.