SecurityTool/security.1

   1 .\"Modified from man(1) of FreeBSD, the NetBSD mdoc.template, and mdoc.samples.
   2 .\"See Also:
   3 .\"man mdoc.samples for a complete listing of options
   4 .\"man mdoc for the short list of editing options
   5 .Dd March 1, 2012        \" DATE
   6 .Dt security 1           \" Program name and manual section number
   7 .Os Darwin
   8 .Sh NAME                 \" Section Header - required - don't modify
   9 .Nm security
  10 .\" The following lines are read in generating the apropos(man -k) database. Use only key
  11 .\" words here as the database is built based on the words here and in the .ND line.
  12 .\" Use .Nm macro to designate other names for the documented program.
  13 .Nd Command line interface to keychains and Security framework
  14 .Sh SYNOPSIS             \" Section Header - required - don't modify
  15 .Nm
  16 .Op Fl hilqv             \" [-hilqv]
  17 .Op Fl p Ar prompt       \" [-p prompt]
  18 .Op Ar command           \" [command]
  19 .Op Ar command_options   \" [command_options]
  20 .Op Ar command_args      \" [command_args]
  21 .Sh DESCRIPTION          \" Section Header - required - don't modify
  22 A simple command line interface which lets you administer keychains,
  23 manipulate keys and certificates, and do just about anything the
  24 Security framework is capable of from the command line.
  25 .Pp
  26 By default
  27 .Nm
  28 will execute the
  29 .Ar command
  30 supplied and report if anything went wrong.
  31 .Pp
  32 If the
  33 .Fl i
  34 or
  35 .Fl p
  36 options are provided,
  37 .Nm
  38 will enter interactive mode and allow the user to enter multiple commands on stdin.  When EOF is read from stdin
  39 .Nm
  40 will exit.
  41 .Pp
  42 Here is a complete list of the options available:
  43 .Bl -tag -width -indent
  44 .It Fl h
  45 If no arguments are specified, show a list of all commands.  If arguments are provided, show usage for each the specified commands.  This option is essentially the same as the
  46 .Nm help
  47 command.
  48 .It Fl i
  49 Run
  50 .Nm
  51 in interactive mode.  A prompt
  52 .Po
  53 .Li security>
  54 by default
  55 .Pc
  56 will be displayed and the user will be able to type commands on stdin until an EOF is encountered.
  57 .It Fl l
  58 Before
  59 .Nm
  60 exits, run
  61 .Dl "/usr/bin/leaks -nocontext"
  62 on itself to see if the command(s) you executed had any leaks.
  63 .It Fl p Ar prompt
  64 This option implies the
  65 .Fl i
  66 option but changes the default prompt to the argument specified instead.
  67 .It Fl q
  68 Will make
  69 .Nm
  70 less verbose.
  71 .It Fl v
  72 Will make
  73 .Nm
  74 more verbose.
  75 .El                      \" Ends the list
  76 .Pp
  77 .Sh "SECURITY COMMAND SUMMARY"
  78 .Nm
  79 provides a rich variety of commands
  80 .Po Ar command
  81 in the
  82 .Sx SYNOPSIS Pc Ns
  83 , each of which often has a wealth of options, to allow access to
  84 the broad functionality provided by the Security framework.  However,
  85 you don't have to master every detail for
  86 .Nm
  87 to be useful to you.
  88 .Pp
  89 Here are brief descriptions of all the
  90 .Nm
  91 commands:
  92 .Pp
  93 .Bl -tag -width user-trust-settings-enable -compact
  94 .It Nm help
  95 Show all commands, or show usage for a command.
  96 .It Nm list-keychains
  97 Display or manipulate the keychain search list.
  98 .It Nm default-keychain
  99 Display or set the default keychain.
 100 .It Nm login-keychain
 101 Display or set the login keychain.
 102 .It Nm create-keychain
 103 Create keychains.
 104 .It Nm delete-keychain
 105 Delete keychains and remove them from the search list.
 106 .It Nm lock-keychain
 107 Lock the specified keychain.
 108 .It Nm unlock-keychain
 109 Unlock the specified keychain.
 110 .It Nm set-keychain-settings
 111 Set settings for a keychain.
 112 .It Nm set-keychain-password
 113 Set password for a keychain.
 114 .It Nm show-keychain-info
 115 Show the settings for keychain.
 116 .It Nm dump-keychain
 117 Dump the contents of one or more keychains.
 118 .It Nm create-keypair
 119 Create an asymmetric key pair.
 120 .It Nm add-generic-password
 121 Add a generic password item.
 122 .It Nm add-internet-password
 123 Add an internet password item.
 124 .It Nm add-certificates
 125 Add certificates to a keychain.
 126 .It Nm find-generic-password
 127 Find a generic password item.
 128 .It Nm delete-generic-password
 129 Delete a generic password item.
 130 .It Nm set-generic-password-partition-list
 131 Set the partition list of a generic password item.
 132 .It Nm find-internet-password
 133 Find an internet password item.
 134 .It Nm delete-internet-password
 135 Delete an internet password item.
 136 .It Nm set-internet-password-partition-list
 137 Set the partition list of a internet password item.
 138 .It Nm find-key
 139 Find keys in the keychain
 140 .It Nm set-key-partition-list
 141 Set the partition list of a key.
 142 .It Nm find-certificate
 143 Find a certificate item.
 144 .It Nm find-identity
 145 Find an identity (certificate + private key).
 146 .It Nm delete-certificate
 147 Delete a certificate from a keychain.
 148 .It Nm set-identity-preference
 149 Set the preferred identity to use for a service.
 150 .It Nm get-identity-preference
 151 Get the preferred identity to use for a service.
 152 .It Nm create-db
 153 Create a db using the DL.
 154 .It Nm export
 155 Export items from a keychain.
 156 .It Nm import
 157 Import items into a keychain.
 158 .It Nm cms
 159 Encode or decode CMS messages.
 160 .It Nm install-mds
 161 Install (or re-install) the MDS database.
 162 .It Nm add-trusted-cert
 163 Add trusted certificate(s).
 164 .It Nm remove-trusted-cert
 165 Remove trusted certificate(s).
 166 .It Nm dump-trust-settings
 167 Display contents of trust settings.
 168 .It Nm user-trust-settings-enable
 169 Display or manipulate user-level trust settings.
 170 .It Nm trust-settings-export
 171 Export trust settings.
 172 .It Nm trust-settings-import
 173 Import trust settings.
 174 .It Nm verify-cert
 175 Verify certificate(s).
 176 .It Nm authorize
 177 Perform authorization operations.
 178 .It Nm authorizationdb
 179 Make changes to the authorization policy database.
 180 .It Nm execute-with-privileges
 181 Execute tool with privileges.
 182 .It Nm leaks
 183 Run
 184 .Pa /usr/bin/leaks
 185 on this process.
 186 .It Nm error
 187 Display a descriptive message for the given error code(s).
 188 .El
 189 .Sh "COMMON COMMAND OPTIONS"
 190 This section describes the
 191 .Ar command_options
 192 that are available across all
 193 .Nm
 194 commands.
 195 .Bl -tag -width -indent
 196 .It Fl h
 197 Show a usage message for the specified command.  This option is
 198 essentially the same as the
 199 .Ar help
 200 command.
 201 .El
 202 .Sh "SECURITY COMMANDS"
 203 Here (finally) are details on all the
 204 .Nm
 205 commands and the options each accepts.
 206 .Bl -item
 207 .It
 208 .Nm help
 209 .Op Fl h
 210 .Bl -item -offset -indent
 211 Show all commands, or show usage for a command.
 212 .El
 213 .It
 214 .Nm list-keychains
 215 .Op Fl h
 216 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 217 .Op Fl s Op Ar keychain...
 218 .Bl -item -offset -indent
 219 Display or manipulate the keychain search list.
 220 .It
 221 .Bl -tag -compact -width -indent
 222 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 223 Use the specified preference domain.
 224 .It Fl s
 225 Set the search list to the specified keychains.
 226 .El
 227 .El
 228 .It
 229 .Nm default-keychain
 230 .Op Fl h
 231 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 232 .Op Fl s Op Ar keychain
 233 .Bl -item -offset -indent
 234 Display or set the default keychain.
 235 .It
 236 .Bl -tag -compact -width -indent
 237 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 238 Use the specified preference domain.
 239 .It Fl s
 240 Set the default keychain to the specified
 241 .Ar keychain Ns .
 242 Unset it if no keychain is specified.
 243 .El
 244 .El
 245 .It
 246 .Nm login-keychain
 247 .Op Fl h
 248 .Op Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 249 .Op Fl s Op Ar keychain
 250 .Bl -item -offset -indent
 251 Display or set the login keychain.
 252 .It
 253 .Bl -tag -compact -width -indent
 254 .It Fl d Ar user Ns | Ns Ar system Ns | Ns Ar common Ns | Ns Ar dynamic
 255 Use the specified preference domain.
 256 .It Fl s
 257 Set the login keychain to the specified
 258 .Ar keychain Ns .
 259 Unset it if no keychain is specified.
 260 .El
 261 .El
 262 .It
 263 .Nm create-keychain
 264 .Op Fl hP
 265 .Op Fl p Ar password
 266 .Op Ar keychain...
 267 .Bl -item -offset -indent
 268 Create keychains.
 269 .It
 270 .Bl -tag -compact -width -indent-indent
 271 .It Fl P
 272 Prompt the user for a password using the SecurityAgent.
 273 .It Fl p Ar password
 274 Use
 275 .Ar password
 276 as the password for the keychains being created.
 277 .El
 278 .It
 279 If neither
 280 .Fl P
 281 or
 282 .Fl p Ar password
 283 are specified, the user is prompted for a password on the command line. Use
 284 of the -p option is insecure.
 285 .El
 286 .It
 287 .Nm delete-keychain
 288 .Op Fl h
 289 .Op Ar keychain...
 290 .Bl -item -offset -indent
 291 Delete keychains and remove them from the search list.
 292 .El
 293 .It
 294 .Nm lock-keychain
 295 .Op Fl h
 296 .Op Fl a Ns | Ns Ar keychain
 297 .Bl -item -offset -indent
 298 Lock
 299 .Ar keychain Ns
 300 \&, or the default keychain if none is specified.  If the
 301 .Fl a
 302 option is specified, all keychains are locked.
 303 .El
 304 .It
 305 .Nm unlock-keychain
 306 .Op Fl hu
 307 .Op Fl p Ar password
 308 .Op Ar keychain
 309 .Bl -item -offset -indent
 310 Unlock
 311 .Ar keychain Ns
 312 \&, or the default keychain if none is specified.
 313 .El
 314 .It
 315 .Nm set-keychain-settings
 316 .Op Fl hlu
 317 .Op Fl t Ar timeout
 318 .Op Ar keychain
 319 .Bl -item -offset -indent
 320 Set settings for
 321 .Ar keychain Ns
 322 \&, or the default keychain if none is specified.
 323 .It
 324 .Bl -tag -compact -width -indent-indent
 325 .It Fl l
 326 Lock keychain when the system sleeps.
 327 .It Fl u
 328 Lock keychain after timeout interval.
 329 .It Fl t Ar timeout
 330 Specify
 331 .Ar timeout
 332 interval in seconds (omitting this option specifies "no timeout").
 333 .El
 334 .El
 335 .It
 336 .Nm set-keychain-password
 337 .Op Fl h
 338 .Op Fl o Ar oldPassword
 339 .Op Fl p Ar newPassword
 340 .Op Ar keychain
 341 .Bl -item -offset -indent
 342 Set password for
 343 .Ar keychain Ns
 344 \&, or the default keychain if none is specified.
 345 .It
 346 .Bl -tag -compact -width -indent-indent
 347 .It Fl o Ar oldPassword
 348 Old keychain password (if not provided, will prompt)
 349 .It Fl p Ar newPassword
 350 New keychain password (if not provided, will prompt)
 351 .El
 352 .El
 353 .It
 354 .Nm show-keychain-info
 355 .Op Fl h
 356 .Op Ar keychain
 357 .Bl -item -offset -indent
 358 Show the settings for
 359 .Ar keychain Ns
 360 \&.
 361 .El
 362 .It
 363 .Nm dump-keychain
 364 .Op Fl adhir
 365 .Bl -item -offset -indent
 366 Dump the contents of one or more keychains.
 367 .It
 368 .Bl -tag -compact -width -indent-indent
 369 .It Fl a
 370 Dump access control list of items
 371 .It Fl d
 372 Dump (decrypted) data of items
 373 .It Fl i
 374 Interactive access control list editing mode
 375 .It Fl r
 376 Dump raw (encrypted) data of items
 377 .El
 378 .El
 379 .It
 380 .Nm create-keypair
 381 .Op Fl h
 382 .Op Fl a Ar alg
 383 .Op Fl s Ar size
 384 .Op Fl f Ar date
 385 .Op Fl t Ar date
 386 .Op Fl d Ar days
 387 .Op Fl k Ar keychain
 388 .Op Fl A Ns | Ns Fl T Ar appPath
 389 .Op Ar name
 390 .Bl -item -offset -indent
 391 Create an asymmetric key pair.
 392 .It
 393 .Bl -tag -compact -width -indent-indent
 394 .It Fl a Ar alg
 395 Use
 396 .Ar alg
 397 as the algorithm, can be rsa, dh, dsa or fee (default rsa)
 398 .It Fl s Ar size
 399 Specify the keysize in bits (default 512)
 400 .It Fl f Ar date
 401 Make a key valid from the specified date (ex: "13/11/10 3:30pm")
 402 .It Fl t Ar date
 403 Make a key valid to the specified date
 404 .It Fl d Ar days
 405 Make a key valid for the number of days specified from today
 406 .It Fl k Ar keychain
 407 Use the specified keychain rather than the default
 408 .It Fl A
 409 Allow any application to access this key without warning (insecure, not recommended!)
 410 .It Fl T Ar appPath
 411 Specify an application which may access this key (multiple
 412 .Fl T Ns
 413 \& options are allowed)
 414 .El
 415 .El
 416 .It
 417 .Nm add-generic-password
 418 .Op Fl h
 419 .Op Fl a Ar account
 420 .Op Fl s Ar service
 421 .Op Fl w Ar password
 422 .Op Ar options...
 423 .Op Ar keychain
 424 .Bl -item -offset -indent
 425 Add a generic password item.
 426 .It
 427 .Bl -tag -compact -width -indent-indent
 428 .It Fl a Ar account
 429 Specify account name (required)
 430 .It Fl c Ar creator
 431 Specify item creator (optional four-character code)
 432 .It Fl C Ar type
 433 Specify item type (optional four-character code)
 434 .It Fl D Ar kind
 435 Specify kind (default is "application password")
 436 .It Fl G Ar value
 437 Specify generic attribute value (optional)
 438 .It Fl j Ar comment
 439 Specify comment string (optional)
 440 .It Fl l Ar label
 441 Specify label (if omitted, service name is used as default label)
 442 .It Fl s Ar service
 443 Specify service name (required)
 444 .It Fl p Ar password
 445 Specify password to be added (legacy option, equivalent to
 446 .Fl w Ns
 447 \&)
 448 .It Fl w Ar password
 449 Specify password to be added. Put at end of command to be prompted (recommended)
 450 .It Fl A
 451 Allow any application to access this item without warning (insecure, not recommended!)
 452 .It Fl T Ar appPath
 453 Specify an application which may access this item (multiple
 454 .Fl T Ns
 455 \& options are allowed)
 456 .It Fl U
 457 Update item if it already exists (if omitted, the item cannot already exist)
 458 .El
 459 .It
 460 .Bl -item
 461 By default, the application which creates an item is trusted to access its data without warning.  You can remove this default access by explicitly specifying an empty app pathname:
 462 .Fl T Ns
 463 \& "". If no keychain is specified, the password is added to the default keychain.
 464 .El
 465 .El
 466 .It
 467 .Nm add-internet-password
 468 .Op Fl h
 469 .Op Fl a Ar account
 470 .Op Fl s Ar server
 471 .Op Fl w Ar password
 472 .Op Ar options...
 473 .Op Ar keychain
 474 .Bl -item -offset -indent
 475 Add an internet password item.
 476 .It
 477 .Bl -tag -compact -width -indent-indent
 478 .It Fl a Ar account
 479 Specify account name (required)
 480 .It Fl c Ar creator
 481 Specify item creator (optional four-character code)
 482 .It Fl C Ar type
 483 Specify item type (optional four-character code)
 484 .It Fl d Ar domain
 485 Specify security domain string (optional)
 486 .It Fl D Ar kind
 487 Specify kind (default is "application password")
 488 .It Fl j Ar comment
 489 Specify comment string (optional)
 490 .It Fl l Ar label
 491 Specify label (if omitted, service name is used as default label)
 492 .It Fl p Ar path
 493 Specify path string (optional)
 494 .It Fl P Ar port
 495 Specify port number (optional)
 496 .It Fl r Ar protocol
 497 Specify protocol (optional four-character SecProtocolType, e.g. "http", "ftp ")
 498 .It Fl s Ar server
 499 Specify server name (required)
 500 .It Fl t Ar authenticationType
 501 Specify authentication type (as a four-character SecAuthenticationType, default is "dflt")
 502 .It Fl w Ar password
 503 Specify password to be added. Put at end of command to be prompted (recommended)
 504 .It Fl A
 505 Allow any application to access this item without warning (insecure, not recommended!)
 506 .It Fl T Ar appPath
 507 Specify an application which may access this item (multiple
 508 .Fl T Ns
 509 \& options are allowed)
 510 .It Fl U
 511 Update item if it already exists (if omitted, the item cannot already exist)
 512 .El
 513 .It
 514 .Bl -item
 515 By default, the application which creates an item is trusted to access its data without warning.  You can remove this default access by explicitly specifying an empty app pathname:
 516 .Fl T Ns
 517 \& "". If no keychain is specified, the password is added to the default keychain.
 518 .El
 519 .El
 520 .It
 521 .Nm add-certificates
 522 .Op Fl h
 523 .Op Fl k Ar keychain
 524 .Ar file...
 525 .Bl -item -offset -indent
 526 Add certficates contained in the specified
 527 .Ar files
 528 to the default keychain.  The files must contain one DER encoded X509 certificate each.
 529 .Bl -tag -compact -width -indent-indent
 530 .It Fl k Ar keychain
 531 Use
 532 .Ar keychain
 533 rather than the default keychain.
 534 .El
 535 .El
 536 .It
 537 .Nm find-generic-password
 538 .Op Fl h
 539 .Op Fl a Ar account
 540 .Op Fl s Ar service
 541 .Op Fl Ar options...
 542 .Op Fl g
 543 .Op Fl Ar keychain...
 544 .Bl -item -offset -indent
 545 Find a generic password item.
 546 .It
 547 .Bl -tag -compact -width -indent-indent
 548 .It Fl a Ar account
 549 Match account string
 550 .It Fl c Ar creator
 551 Match creator (four-character code)
 552 .It Fl C Ar type
 553 Match type (four-character code)
 554 .It Fl D Ar kind
 555 Match kind string
 556 .It Fl G Ar value
 557 Match value string (generic attribute)
 558 .It Fl j Ar comment
 559 Match comment string
 560 .It Fl l Ar label
 561 Match label string
 562 .It Fl s Ar service
 563 Match service string
 564 .It Fl g
 565 Display the password for the item found
 566 .It Fl w
 567 Display the password(only) for the item found
 568 .El
 569 .El
 570 .It
 571 .Nm delete-generic-password
 572 .Op Fl h
 573 .Op Fl a Ar account
 574 .Op Fl s Ar service
 575 .Op Fl Ar options...
 576 .Op Fl Ar keychain...
 577 .Bl -item -offset -indent
 578 Delete a generic password item.
 579 .It
 580 .Bl -tag -compact -width -indent-indent
 581 .It Fl a Ar account
 582 Match account string
 583 .It Fl c Ar creator
 584 Match creator (four-character code)
 585 .It Fl C Ar type
 586 Match type (four-character code)
 587 .It Fl D Ar kind
 588 Match kind string
 589 .It Fl G Ar value
 590 Match value string (generic attribute)
 591 .It Fl j Ar comment
 592 Match comment string
 593 .It Fl l Ar label
 594 Match label string
 595 .It Fl s Ar service
 596 Match service string
 597 .El
 598 .El
 599 .It
 600 .Nm delete-internet-password
 601 .Op Fl h
 602 .Op Fl a Ar account
 603 .Op Fl s Ar server
 604 .Op Ar options...
 605 .Op Ar keychain...
 606 .Bl -item -offset -indent
 607 Delete an internet password item.
 608 .It
 609 .Bl -tag -compact -width -indent-indent
 610 .It Fl a Ar account
 611 Match account string
 612 .It Fl c Ar creator
 613 Match creator (four-character code)
 614 .It Fl C Ar type
 615 Match type (four-character code)
 616 .It Fl d Ar securityDomain
 617 Match securityDomain string
 618 .It Fl D Ar kind
 619 Match kind string
 620 .It Fl j Ar comment
 621 Match comment string
 622 .It Fl l Ar label
 623 Match label string
 624 .It Fl p Ar path
 625 Match path string
 626 .It Fl P Ar port
 627 Match port number
 628 .It Fl r Ar protocol
 629 Match protocol (four-character code)
 630 .It Fl s Ar server
 631 Match server string
 632 .It Fl t Ar authenticationType
 633 Match authenticationType (four-character code)
 634 .El
 635 .El
 636 .It
 637 .Nm find-internet-password
 638 .Op Fl h
 639 .Op Fl a Ar account
 640 .Op Fl s Ar server
 641 .Op Ar options...
 642 .Op Fl g
 643 .Op Ar keychain...
 644 .Bl -item -offset -indent
 645 Find an internet password item.
 646 .It
 647 .Bl -tag -compact -width -indent-indent
 648 .It Fl a Ar account
 649 Match account string
 650 .It Fl c Ar creator
 651 Match creator (four-character code)
 652 .It Fl C Ar type
 653 Match type (four-character code)
 654 .It Fl d Ar securityDomain
 655 Match securityDomain string
 656 .It Fl D Ar kind
 657 Match kind string
 658 .It Fl j Ar comment
 659 Match comment string
 660 .It Fl l Ar label
 661 Match label string
 662 .It Fl p Ar path
 663 Match path string
 664 .It Fl P Ar port
 665 Match port number
 666 .It Fl r Ar protocol
 667 Match protocol (four-character code)
 668 .It Fl s Ar server
 669 Match server string
 670 .It Fl t Ar authenticationType
 671 Match authenticationType (four-character code)
 672 .It Fl g
 673 Display the password for the item found
 674 .It Fl w
 675 Display the password(only) for the item found
 676 .El
 677 .El
 678 .It
 679 .Nm find-key
 680 .Op Ar options...
 681 .Op Ar keychain...
 682 .Bl -item -offset -indent
 683 Search the keychain for keys.
 684 .It
 685 .Bl -tag -compact -width -indent-indent
 686 .It Fl a Ar application-label
 687 Match "application label" string
 688 .It Fl c Ar creator
 689 Match creator (four-character code)
 690 .It Fl d
 691 Match keys that can decrypt
 692 .It Fl D Ar description
 693 Match "description" string
 694 .It Fl e
 695 Match keys that can encrypt
 696 .It Fl j Ar comment
 697 Match comment string
 698 .It Fl l Ar label
 699 Match label string
 700 .It Fl r
 701 Match keys that can derive
 702 .It Fl s
 703 Match keys that can sign
 704 .It Fl t Ar type
 705 Type of key to find: one of "symmetric", "public", or "private"
 706 .It Fl u
 707 Match keys that can unwrap
 708 .It Fl v
 709 Match keys that can verify
 710 .It Fl w
 711 Match keys that can wrap
 712 .El
 713 .El
 714 .It
 715 .Nm set-generic-password-partition-list
 716 .Op Fl a Ar account
 717 .Op Fl s Ar service
 718 .Op Fl S Ar <partition list (comma separated)>
 719 .Op Fl k Ar <keychain password>
 720 .Op Ar options...
 721 .Op Ar keychain
 722 .Bl -item -offset -indent
 723 Sets the "partition list" for a generic password. The "partition list" is an extra parameter in the ACL which limits access to the item based on an application's code signature. You must present the keychain's password to change a partition list.
 724 .It
 725 .Bl -tag -compact -width -indent-indent
 726 .It Fl S Ar partition-list
 727 Comma-separated partition list. See output of "security dump-keychain" for examples.
 728 .It Fl k Ar password
 729 Password for keychain
 730 .It Fl a Ar account
 731 Match account string
 732 .It Fl c Ar creator
 733 Match creator (four-character code)
 734 .It Fl C Ar type
 735 Match type (four-character code)
 736 .It Fl D Ar kind
 737 Match kind string
 738 .It Fl G Ar value
 739 Match value string (generic attribute)
 740 .It Fl j Ar comment
 741 Match comment string
 742 .It Fl l Ar label
 743 Match label string
 744 .It Fl s Ar service
 745 Match service string
 746 .El
 747 .El
 748 .It
 749 .Nm set-internet-password-partition-list
 750 .Op Fl a Ar account
 751 .Op Fl s Ar server
 752 .Op Fl S Ar <partition list (comma separated)>
 753 .Op Fl k Ar <keychain password>
 754 .Op Ar options...
 755 .Op Ar keychain
 756 .Bl -item -offset -indent
 757 Sets the "partition list" for an internet password. The "partition list" is an extra parameter in the ACL which limits access to the item based on an application's code signature. You must present the keychain's password to change a partition list.
 758 .It
 759 .Bl -tag -compact -width -indent-indent
 760 .It Fl S Ar partition-list
 761 Comma-separated partition list. See output of "security dump-keychain" for examples.
 762 .It Fl k Ar password
 763 Password for keychain
 764 .It Fl a Ar account
 765 Match account string
 766 .It Fl c Ar creator
 767 Match creator (four-character code)
 768 .It Fl C Ar type
 769 Match type (four-character code)
 770 .It Fl d Ar securityDomain
 771 Match securityDomain string
 772 .It Fl D Ar kind
 773 Match kind string
 774 .It Fl j Ar comment
 775 Match comment string
 776 .It Fl l Ar label
 777 Match label string
 778 .It Fl p Ar path
 779 Match path string
 780 .It Fl P Ar port
 781 Match port number
 782 .It Fl r Ar protocol
 783 Match protocol (four-character code)
 784 .It Fl s Ar server
 785 Match server string
 786 .It Fl t Ar authenticationType
 787 Match authenticationType (four-character code)
 788 .El
 789 .El
 790 .It
 791 .Nm set-key-partition-list
 792 .Op Fl S Ar <partition list (comma separated)>
 793 .Op Fl k Ar <keychain password>
 794 .Op Ar options...
 795 .Op Ar keychain
 796 .Bl -item -offset -indent
 797 Sets the "partition list" for a key. The "partition list" is an extra parameter in the ACL which limits access to the key based on an application's code signature. You must present the keychain's password to change a partition list. If you'd like to run /usr/bin/codesign with the key, "apple:" must be an element of the partition list.
 798 .It
 799 .Bl -tag -compact -width -indent-indent
 800 .It Fl S Ar partition-list
 801 Comma-separated partition list. See output of "security dump-keychain" for examples.
 802 .It Fl k Ar password
 803 Password for keychain
 804 .It Fl a Ar application-label
 805 Match "application label" string
 806 .It Fl c Ar creator
 807 Match creator (four-character code)
 808 .It Fl d
 809 Match keys that can decrypt
 810 .It Fl D Ar description
 811 Match "description" string
 812 .It Fl e
 813 Match keys that can encrypt
 814 .It Fl j Ar comment
 815 Match comment string
 816 .It Fl l Ar label
 817 Match label string
 818 .It Fl r
 819 Match keys that can derive
 820 .It Fl s
 821 Match keys that can sign
 822 .It Fl t Ar type
 823 Type of key to find: one of "symmetric", "public", or "private"
 824 .It Fl u
 825 Match keys that can unwrap
 826 .It Fl v
 827 Match keys that can verify
 828 .It Fl w
 829 Match keys that can wrap
 830 .El
 831 .El
 832 .It
 833 .Nm find-certificate
 834 .Op Fl h
 835 .Op Fl a
 836 .Op Fl c Ar name
 837 .Op Fl e Ar emailAddress
 838 .Op Fl m
 839 .Op Fl p
 840 .Op Fl Z
 841 .Op Ar keychain...
 842 .Bl -item -offset -indent
 843 Find a certificate item.  If no
 844 .Ar keychain Ns
 845 \& arguments are provided, the default search list is used.
 846 .It
 847 Options:
 848 .Bl -tag -compact -width -indent-indent
 849 .It Fl a
 850 Find all matching certificates, not just the first one
 851 .It Fl c Ar name
 852 Match on
 853 .Ar name Ns
 854 \& when searching (optional)
 855 .It Fl e Ar emailAddress
 856 Match on
 857 .Ar emailAddress Ns
 858 \& when searching (optional)
 859 .It Fl m
 860 Show the email addresses in the certificate
 861 .It Fl p
 862 Output certificate in pem format.  Default is to dump the attributes and keychain the cert is in.
 863 .It Fl Z
 864 Print SHA-1 hash of the certificate
 865 .El
 866 .It
 867 .Sy Examples
 868 .Bl -tag -width -indent
 869 .It security> find-certificate -a -p > allcerts.pem
 870 Exports all certificates from all keychains into a pem file called allcerts.pem.
 871 .It security> find-certificate -a -e me@foo.com -p > certs.pem
 872 Exports all certificates from all keychains with the email address
 873 me@foo.com into a pem file called certs.pem.
 874 .It security> find-certificate -a -c MyName -Z login.keychain | grep ^SHA-1
 875 Print the SHA-1 hash of every certificate in 'login.keychain' whose common name includes 'MyName'
 876 .El
 877 .El
 878 .It
 879 .Nm find-identity
 880 .Op Fl h
 881 .Op Fl p Ar policy
 882 .Op Fl s Ar string
 883 .Op Fl v
 884 .Op Ar keychain...
 885 .Bl -item -offset -indent
 886 Find an identity (certificate + private key) satisfying a given policy. If no
 887 .Ar policy Ns
 888 \& arguments are provided, the X.509 basic policy is assumed. If no
 889 .Ar keychain Ns
 890 \& arguments are provided, the default search list is used.
 891 .It
 892 Options:
 893 .Bl -tag -compact -width -indent-indent
 894 .It Fl p Ar policy
 895 Specify
 896 .Ar policy Ns
 897 \& to evaluate (multiple -p options are allowed). Supported policies:
 898 basic, ssl-client, ssl-server, smime, eap, ipsec, ichat, codesigning,
 899 sys-default, sys-kerberos-kdc
 900 .It Fl s Ar string
 901 Specify optional policy-specific
 902 .Ar string Ns
 903 \& (e.g. a DNS hostname for SSL, or RFC822 email address for S/MIME)
 904 .It Fl v
 905 Show valid identities only (default is to show all identities)
 906 .El
 907 .It
 908 .Sy Examples
 909 .Bl -tag -width -indent
 910 .It security> find-identity -v -p ssl-client
 911 Display valid identities that can be used for SSL client authentication
 912 .It security> find-identity -p ssl-server -s www.domain.com
 913 Display identities for a SSL server running on the host 'www.domain.com'
 914 .It security> find-identity -p smime -s user@domain.com
 915 Display identities that can be used to sign a message from 'user@domain.com'
 916 .El
 917 .El
 918 .It
 919 .Nm delete-certificate
 920 .Op Fl h
 921 .Op Fl c Ar name
 922 .Op Fl Z Ar hash
 923 .Op Fl t
 924 .Op Ar keychain...
 925 .Bl -item -offset -indent
 926 Delete a certificate from a keychain.  If no
 927 .Ar keychain Ns
 928 \& arguments are provided, the default search list is used.
 929 .It
 930 .Bl -tag -compact -width -indent-indent
 931 .It Fl c Ar name
 932 Specify certificate to delete by its common name
 933 .It Fl Z Ar hash
 934 Specify certificate to delete by its SHA-1 hash
 935 .It Fl t
 936 Also delete user trust settings for this certificate
 937 .El
 938 .It
 939 The certificate to be deleted must be uniquely specified either by a
 940 string found in its common name, or by its SHA-1 hash.
 941 .El
 942 .It
 943 .Nm set-identity-preference
 944 .Op Fl h
 945 .Op Fl n
 946 .Op Fl c Ar identity
 947 .Op Fl s Ar service
 948 .Op Fl u Ar keyUsage
 949 .Op Fl Z Ar hash
 950 .Op Ar keychain...
 951 .Bl -item -offset -indent
 952 Set the preferred identity to use for a service.
 953 .It
 954 .Bl -tag -compact -width -indent-indent
 955 .It Fl n
 956 Specify no identity (clears existing preference for the given service)
 957 .It Fl c Ar identity
 958 Specify identity by common name of the certificate
 959 .It Fl s Ar service
 960 Specify service (may be a URL, RFC822 email address, DNS host, or other name) for which this identity is to be preferred
 961 .It Fl u Ar keyUsage
 962 Specify key usage (optional)
 963 .It Fl Z Ar hash
 964 Specify identity by SHA-1 hash of certificate (optional)
 965 .El
 966 .It
 967 The identity is located by searching the specified keychain(s) for a certificate whose common name contains
 968 the given identity string. If no keychains are specified to search, the default search list is used. Different
 969 identity preferences can be set for individual key usages. You can differentiate between two identities which contain
 970 the same string by providing a SHA-1 hash of the certificate (in addition to, or instead of, the name.)
 971 .It
 972 .Sy PARTIAL PATHS AND WILDCARDS
 973 .It
 974 Prior to 10.5.4, identity preferences for SSL/TLS client authentication could only be set on a per-URL basis. The
 975 URL being visited had to match the service name exactly for the preference to be in effect.
 976 .It
 977 In 10.5.4, it became possible to specify identity preferences on a per-server basis, by using
 978 a service name with a partial path URL to match more specific paths on the same server. For
 979 example, if an identity preference for "https://www.apache-ssl.org/" exists, it will be in effect for
 980 "https://www.apache-ssl.org/cgi/cert-export", and so on. Note that partial path URLs must end with a trailing
 981 slash character.
 982 .It
 983 Starting with 10.6, it is possible to specify identity preferences on a per-domain
 984 basis, by using the wildcard character '*' as the leftmost component of the service name. Unlike SSL wildcards,
 985 an identity preference wildcard can match more than one subdomain. For example, an identity preference for
 986 the name "*.army.mil" will match "server1.subdomain1.army.mil" or "server2.subdomain2.army.mil". Likewise,
 987 a preference for "*.mil" will match both "server.army.mil" and "server.navy.mil".
 988 .It
 989 .Sy KEY USAGE CODES
 990 .It
 991 .Bl -tag -width -indent
 992      0 - preference is in effect for all possible key usages (default)
 993      1 - encryption only
 994      2 - decryption only
 995      4 - signing only
 996      8 - signature verification only
 997     16 - signing with message recovery only
 998     32 - signature verification with message recovery only
 999     64 - key wrapping only
1000    128 - key unwrapping only
1001    256 - key derivation only
1002 .It  To specify more than one usage, add values together.
1003 .El
1004 .El
1005 .It
1006 .Nm get-identity-preference
1007 .Op Fl h
1008 .Op Fl s Ar service
1009 .Op Fl u Ar keyUsage
1010 .Op Fl p
1011 .Op Fl c
1012 .Op Fl Z
1013 .Bl -item -offset -indent
1014 Get the preferred identity to use for a service.
1015 .It
1016 .Bl -tag -compact -width -indent-indent
1017 .It Fl s Ar service
1018 Specify service (may be a URL, RFC822 email address, DNS host, or other name)
1019 .It Fl u Ar keyUsage
1020 Specify key usage (optional)
1021 .It Fl p
1022 Output identity certificate in pem format
1023 .It Fl c
1024 Print common name of the preferred identity certificate
1025 .It Fl Z
1026 Print SHA-1 hash of the preferred identity certificate
1027 .El
1028 .El
1029 .It
1030 .Nm create-db
1031 .Op Fl aho0
1032 .Op Fl g Ar dl Ns | Ns Ar cspdl
1033 .Op Fl m Ar mode
1034 .Op Ar name
1035 .Bl -item -offset -indent
1036 Create a db using the DL.  If
1037 .Ar name
1038 isn't provided
1039 .Nm
1040 will prompt the user to type a name.
1041 .It
1042 Options:
1043 .Bl -tag -compact -width -indent-indent
1044 .It Fl a
1045 Turn off autocommit
1046 .It Fl g Ar dl Ns | Ns Ar cspdl
1047 Use the AppleDL (default) or AppleCspDL
1048 .It Fl m Ar mode
1049 Set the file permissions to
1050 .Ar mode Ns
1051 \&.
1052 .It Fl o
1053 Force using openparams argument
1054 .It Fl 0
1055 Force using version 0 openparams
1056 .El
1057 .It
1058 .Sy Examples
1059 .Bl -tag -width -indent
1060 .It security> create-db -m 0644 test.db
1061 .It security> create-db -g cspdl -a test2.db
1062 .El
1063 .\"new import/export commands.
1064 .El
1065 .It
1066 .Nm export
1067 .Op Fl k Ar keychain
1068 .Op Fl t Ar type
1069 .Op Fl f Ar format
1070 .Op Fl w
1071 .Op Fl p Ar format
1072 .Op Fl P Ar passphrase
1073 .Op Fl o Ar outfile
1074 .Bl -item -offset -indent
1075 Export one or more items from a keychain to one of a number of external representations.  If
1076 .Ar keychain
1077 isn't provided, items will be exported from the user's default keychain.
1078 .It
1079 Options:
1080 .Bl -tag -compact -width -indent-indent
1081 .It Fl k Ar keychain
1082 Specify keychain from which item(s) will be exported.
1083 .It Fl t Ar type
1084 Specify the type of items to export. Possible types are certs, allKeys, pubKeys, privKeys, identities, and all. The default is all. An identity consists of both a certificate and the corresponding private key.
1085 .It Fl f Ar format
1086 Specify the format of the exported data. Possible formats are openssl, bsafe, pkcs7, pkcs8, pkcs12, x509, openssh1, openssh2, and pemseq. The default is pemseq if more than one item is being exported. The default is openssl if one key is being exported. The default is x509 if one certificate is being exported.
1087 .It Fl w
1088 Specifies that private keys are to be wrapped on export.
1089 .It Fl p
1090 Specifies that PEM armour is to be applied to the output data.
1091 .It Fl P Ar passphrase
1092 Specify the wrapping passphrase immediately. The default is to obtain a secure passphrase via GUI.
1093 .It Fl o Ar outfile
1094 Write the output data to
1095 .Ar outfile Ns
1096 \&. Default is to write data to stdout.
1097 .El
1098 .It
1099 .Sy Examples
1100 .Bl -tag -width -indent
1101 .It security> export -k login.keychain -t certs -o /tmp/certs.pem
1102 .It security> export -k newcert.keychain -t identities -f pkcs12 -o /tmp/mycerts.p12
1103 .El
1104 .\"marker.
1105 .El
1106 .It
1107 .Nm import
1108 inputfile
1109 .Op Fl k Ar keychain
1110 .Op Fl t Ar type
1111 .Op Fl f Ar format
1112 .Op Fl w
1113 .Op Fl P Ar passphrase
1114 .Op Ar options...
1115 .Bl -item -offset -indent
1116 Import one or more items from
1117 .Ar inputfile Ns
1118 \& into a keychain. If
1119 .Ar keychain
1120 isn't provided, items will be imported into the user's default keychain.
1121 .It
1122 Options:
1123 .Bl -tag -compact -width -indent-indent
1124 .It Fl k Ar keychain
1125 Specify keychain into which item(s) will be imported.
1126 .It Fl t Ar type
1127 Specify the type of items to import. Possible types are cert, pub, priv, session, cert, and agg. Pub, priv, and session refer to keys; agg is one of the aggregate types (pkcs12 and PEM sequence). The command can often figure out what item_type an item contains based in the filename and/or item_format.
1128 .It Fl f Ar format
1129 Specify the format of the exported data. Possible formats are openssl, bsafe, raw, pkcs7, pkcs8, pkcs12, x509, openssh1, openssh2, and pemseq. The command can often figure out what format an item is in based in the filename and/or item_type.
1130 .It Fl w
1131 Specify that private keys are wrapped and must be unwrapped on import.
1132 .It Fl x
1133 Specify that private keys are non-extractable after being imported.
1134 .It Fl P Ar passphrase
1135 Specify the unwrapping passphrase immediately. The default is to obtain a secure passphrase via GUI.
1136 .It Fl a Ar attrName Ar attrValue
1137 Specify optional extended attribute name and value. Can be used multiple times. This is only valid when importing keys.
1138 .It Fl A
1139 Allow any application to access the imported key without warning (insecure, not recommended!)
1140 .It Fl T Ar appPath
1141 Specify an application which may access the imported key (multiple
1142 .Fl T Ns
1143 \& options are allowed)
1144 .El
1145 .It
1146 .Sy Examples
1147 .Bl -tag -width -indent
1148 .It security> import /tmp/certs.pem -k
1149 .It security> import /tmp/mycerts.p12 -t agg -k newcert.keychain
1150 .It security> import /tmp/mycerts.p12 -f pkcs12 -k newcert.keychain
1151 .El
1152 .\"end of new import/export commands.
1153 .El
1154 .It
1155 .Nm cms
1156 .Op Fl C Ns | Ns Fl D Ns | Ns Fl E Ns | Ns Fl S
1157 .Op Ar options...
1158 .Bl -item -offset -indent
1159 Encode or decode CMS messages.
1160 .Bl -tag -compact -width -indent-indent
1161 .It Fl C
1162 create a CMS encrypted message
1163 .It Fl D
1164 decode a CMS message
1165 .It Fl E
1166 create a CMS enveloped message
1167 .It Fl S
1168 create a CMS signed message
1169 .El
1170 .It
1171 Decoding options:
1172 .Bl -tag -compact -width -indent-indent
1173 .It Fl c Ar content
1174 use this detached content file
1175 .It Fl h Ar level
1176 generate email headers with info about CMS message (output
1177 .Ar level Ns
1178 \& >= 0)
1179 .It Fl n
1180 suppress output of content
1181 .El
1182 .It
1183 Encoding options:
1184 .Bl -tag -compact -width -indent-indent
1185 .It Fl r Ar id,...
1186 create envelope for comma-delimited list of recipients, where id can be a certificate nickname or email address
1187 .It Fl G
1188 include a signing time attribute
1189 .It Fl H Ar hash
1190 hash = MD2|MD4|MD5|SHA1|SHA256|SHA384|SHA512 (default: SHA1)
1191 .It Fl N Ar nick
1192 use certificate named "nick" for signing
1193 .It Fl P
1194 include a SMIMECapabilities attribute
1195 .It Fl T
1196 do not include content in CMS message
1197 .It Fl Y Ar nick
1198 include an EncryptionKeyPreference attribute with certificate (use "NONE" to omit)
1199 .It Fl Z Ar hash
1200 find a certificate by subject key ID
1201 .El
1202 .It
1203 Common options:
1204 .Bl -tag -compact -width -indent-indent
1205 .It Fl e Ar envelope
1206 specify envelope file (valid with
1207 .Fl D Ns
1208 \& or
1209 .Fl E Ns
1210 \&)
1211 .It Fl k Ar keychain
1212 specify keychain to use
1213 .It Fl i Ar infile
1214 use infile as source of data (default: stdin)
1215 .It Fl o Ar outfile
1216 use outfile as destination of data (default: stdout)
1217 .It Fl p Ar password
1218 use password as key db password (default: prompt)
1219 .It Fl s
1220 pass data a single byte at a time to CMS
1221 .It Fl u Ar certusage
1222 set type of certificate usage (default: certUsageEmailSigner)
1223 .It Fl v
1224 print debugging information
1225 .El
1226 .It
1227 Cert usage codes:
1228                   0 - certUsageSSLClient
1229                   1 - certUsageSSLServer
1230                   2 - certUsageSSLServerWithStepUp
1231                   3 - certUsageSSLCA
1232                   4 - certUsageEmailSigner
1233                   5 - certUsageEmailRecipient
1234                   6 - certUsageObjectSigner
1235                   7 - certUsageUserCertImport
1236                   8 - certUsageVerifyCA
1237                   9 - certUsageProtectedObjectSigner
1238                  10 - certUsageStatusResponder
1239                  11 - certUsageAnyCA
1240 .It
1241 .El
1242 .It
1243 .Nm install-mds
1244 .Bl -item -offset -indent
1245 Install (or re-install) the Module Directory Services (MDS) database. This is a system tool which is not normally used by users. There are no options.
1246 .El
1247 .It
1248 .Nm add-trusted-cert
1249 .Op Fl d
1250 .Op Fl r Ar resultType
1251 .Op Fl p Ar policy
1252 .Op Fl a Ar appPath
1253 .Op Fl s Ar policyString
1254 .Op Fl e Ar allowedError
1255 .Op Fl u Ar keyUsage
1256 .Op Fl k Ar keychain
1257 .Op Fl i Ar settingsFileIn
1258 .Op Fl o Ar settingsFileOut
1259 .Op Fl D
1260 certFile
1261 .Bl -item -offset -indent
1262 Add certificate (in DER or PEM format) from
1263 .Ar certFile Ns
1264 \& to per-user or local Admin Trust Settings. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1265 .It
1266 Options:
1267 .Bl -tag -compact -width -indent-indent
1268 .It Fl d
1269 Add to admin cert store; default is user.
1270 .It Fl r Ar resultType
1271 resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
1272 .It Fl p Ar policy
1273 Specify policy constraint (ssl, smime, codeSign, IPSec, basic, swUpdate, pkgSign, eap, macappstore, appleID, timestamping).
1274 .It Fl r Ar resultType
1275 resultType = trustRoot|trustAsRoot|deny|unspecified; default is trustRoot.
1276 .It Fl a Ar appPath
1277 Specify application constraint.
1278 .It Fl s Ar policyString
1279 Specify policy-specific string.
1280 .It Fl e Ar allowedError
1281 Specify allowed error (an integer value, or one of: certExpired, hostnameMismatch)
1282 .It Fl u Ar keyUsage
1283 Specify key usage, an integer.
1284 .It Fl k Ar keychain
1285 Specify keychain to which cert is added.
1286 .It Fl i Ar settingsFileIn
1287 Input trust settings file; default is user domain.
1288 .It Fl o Ar settingsFileOut
1289 Output trust settings file; default is user domain.
1290 .It Fl D
1291 Add default setting instead of per-cert setting. No certFile is specified when using this option
1292 .El
1293 .It
1294 .Sy Key usage codes:
1295     -1 - Any
1296      1 - Sign
1297      2 - Encrypt/Decrypt Data
1298      4 - Encrypt/Decrypt Key
1299      8 - Sign certificate
1300     16 - Sign revocation
1301     32 - Key exchange
1302     To specify more than one usage, add values together (except -1 - Any).
1303 .It
1304 .Sy Examples
1305 .Bl -tag -width -indent
1306 .Dl security> add-trusted-cert /tmp/cert.der
1307 .Dl security> add-trusted-cert -d .tmp/cert.der
1308 .El
1309 .\"marker.
1310 .It
1311 .Nm remove-trusted-cert
1312 .Op Fl d
1313 .Op Fl D
1314 certFile
1315 .Bl -item -offset -indent
1316 Remove certificate (in DER or PEM format) in
1317 .Ar certFile Ns
1318 \& from per-user or local Admin Trust Settings. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1319 .It
1320 Options:
1321 .Bl -tag -compact -width -indent-indent
1322 .It Fl d
1323 Remove from admin cert store; default is user.
1324 .It Fl D
1325 Remove Default Root Cert setting instead of an actual cert setting. No certFile is specified when using this option.
1326 .El
1327 .\"marker.
1328 .El
1329 .It
1330 .Nm dump-trust-settings
1331 .Op Fl s
1332 .Op Fl d
1333 .Bl -item -offset -indent
1334 Display Trust Settings.
1335 .It
1336 Options:
1337 .Bl -tag -compact -width -indent-indent
1338 .It Fl s
1339 Display trusted system certs; default is user.
1340 .It Fl d
1341 Display trusted admin certs; default is user.
1342 .El
1343 .\"marker.
1344 .El
1345 .It
1346 .Nm user-trust-settings-enable
1347 .Op Fl d
1348 .Op Fl e
1349 .Bl -item -offset -indent
1350 Display or manipulate user-level Trust Settings. With no arguments, shows the current state of the user-level Trust Settings enable. Otherwise enables or disables user-level Trust Settings.
1351 .It
1352 Options:
1353 .Bl -tag -compact -width -indent-indent
1354 .It Fl d
1355 Disable user-level Trust Settings.
1356 .It Fl e
1357 Enable user-level Trust Settings.
1358 .El
1359 .\"marker.
1360 .El
1361 .It
1362 .Nm trust-settings-export
1363 .Op Fl s
1364 .Op Fl d
1365 settings_file
1366 .Bl -item -offset -indent
1367 Export Trust Settings to the specified file.
1368 .It
1369 Options:
1370 .Bl -tag -compact -width -indent-indent
1371 .It Fl s
1372 Export system Trust Settings; default is user.
1373 .It Fl d
1374 Export admin Trust Settings; default is user.
1375 .El
1376 .\"marker.
1377 .El
1378 .It
1379 .Nm trust-settings-import
1380 .Op Fl d
1381 settings_file
1382 .Bl -item -offset -indent
1383 Import Trust Settings from the specified file. When modifying per-user Trust Settings, user authentication is required via an authentication dialog. When modifying admin Trust Settings, the process must be running as root, or admin authentication is required.
1384 .It
1385 Options:
1386 .Bl -tag -compact -width -indent-indent
1387 .It Fl d
1388 Import admin Trust Settings; default is user.
1389 .El
1390 .\"marker.
1391 .El
1392 .It
1393 .Nm verify-cert
1394 .Op Fl c Ar certFile
1395 .Op Fl r Ar rootCertFile
1396 .Op Fl p Ar policy
1397 .Op Fl k Ar keychain
1398 .Op Fl d Ar date
1399 .Op Fl n
1400 .Op Fl L
1401 .Op Fl l
1402 .Op Fl e Ar emailAddress
1403 .Op Fl s Ar sslHost
1404 .Op Fl q
1405 .Bl -item -offset -indent
1406 Verify one or more certificates.
1407 .It
1408 Options:
1409 .Bl -tag -compact -width -indent-indent
1410 .It Fl c Ar certFile
1411 Certificate to verify, in DER or PEM format. Can be specified more than once; leaf certificate has to be specified first.
1412 .It Fl r Ar rootCertFile
1413 Root certificate, in DER or PEM format. Can be specified more than once. If not specified, the system anchor certificates are used. If one root certificate is specified, and zero (non-root) certificates are specified, the root certificate is verified against itself.
1414 .It Fl p Ar policy
1415 Specify verification policy (ssl, smime, codeSign, IPSec, basic, swUpdate, pkgSign, eap, appleID, macappstore, timestamping). Default is basic.
1416 .It Fl k Ar keychain
1417 Keychain to search for intermediate certs. Can be specified multiple times. Default is the current user's keychain search list.
1418 .It Fl d Ar date
1419 Date to set for verification. Specified in the format of YYYY-MM-DD-hh:mm:ss (time optional). e.g: 2016-04-25-15:59:59 for April 25, 2016 at 3:59:59 pm in GMT
1420 .It Fl n
1421 Avoid searching any keychains.
1422 .It Fl L
1423 Use local certificates only. If an issuing CA certificate is missing, this option will avoid accessing the network to fetch it.
1424 .It Fl l
1425 Specifies that the leaf certificate is a CA cert. By default, a leaf certificate with a Basic Constraints extension with the CA bit set fails verification.
1426 .It Fl e Ar emailAddress
1427 Specify email address for the smime policy.
1428 .It Fl s Ar sslHost
1429 Specify SSL host name for the ssl policy.
1430 .It Fl q
1431 Quiet, no stdout or stderr.
1432 .El
1433 .It
1434 .Sy Examples
1435 .Bl -tag -width -indent
1436 .It security> verify-cert -c applestore0.cer -c applestore1.cer -p ssl -s store.apple.com
1437 .It security> verify-cert -r serverbasic.crt
1438 .El
1439 .\"marker.
1440 .El
1441 .It
1442 .Nm authorize
1443 .Op Fl updPiew
1444 .Op Ar right...
1445 .Bl -item -offset -indent
1446 Authorize requested right(s).  The extend-rights flag will be passed by default.
1447 .It
1448 Options:
1449 .Bl -tag -compact -width -indent-indent
1450 .It Fl u
1451 Allow user interaction.
1452 .It Fl p
1453 Allow returning partial rights.
1454 .It Fl d
1455 Destroy acquired rights.
1456 .It Fl P
1457 Pre-authorize rights only.
1458 .It Fl l
1459 Operate authorization in least privileged mode.
1460 .It Fl i
1461 Internalize authref passed on stdin.
1462 .It Fl e
1463 Externalize authref to stdout
1464 .It Fl w
1465 Wait while holding AuthorizationRef until stdout is closed. This will allow client to read externalized AuthorizationRef from pipe.
1466 .El
1467 .It
1468 .Sy Examples
1469 .Bl -tag -width -indent
1470 .It security> security authorize -ud my-right
1471 Basic authorization of my-right.
1472 .It security> security -q authorize -uew my-right | security -q authorize -i my-right
1473 Authorizing a right and passing it to another command as a way to add authorization to shell scripts.
1474 .El
1475 .El
1476 .It
1477 .Nm authorizationdb
1478 .Ar read <right-name>
1479 .It
1480 .Nm authorizationdb
1481 .Ar write <right-name> [allow|deny|<rulename>]
1482 .It
1483 .Nm authorizationdb
1484 .Ar remove <right-name>
1485 .Bl -item -offset -indent
1486 Read/Modify authorization policy database. Without a rulename write will read a dictionary as a plist from stdin.
1487 .It
1488 .Sy Examples
1489 .Bl -tag -width -indent
1490 .It security> security authorizationdb read system.privilege.admin > /tmp/aewp-def
1491 Read definition of system.privilege.admin right.
1492 .It security> security authorizationdb write system.preferences < /tmp/aewp-def
1493 Set system.preferences to definition of system.privilege.admin right.
1494 .It security> security authorizationdb write system.preferences authenticate-admin
1495 Every change to preferences requires an Admin user to authenticate.
1496 .El
1497 .El
1498 .It
1499 .Nm execute-with-privileges
1500 .Ar <program>
1501 .Op Ar args...
1502 .Bl -item -offset -indent
1503 Execute tool with privileges.
1504 On success stdin will be read and forwarded to the tool.
1505 .El
1506 .It
1507 .Nm leaks
1508 .Op Fl h
1509 .Op Fl cycles
1510 .Op Fl nocontext
1511 .Op Fl nostacks
1512 .Op Fl exclude Ar symbol
1513 .Bl -item -offset -indent
1514 Run
1515 .Li /usr/bin/leaks
1516 on this process.  This can help find memory leaks after running
1517 certain commands.
1518 .It
1519 Options:
1520 .Bl -tag -compact -width -indent-indent
1521 .It Fl cycles
1522 Use a stricter algorithm (See
1523 .Xr leaks 1
1524 for details).
1525 .It Fl nocontext
1526 Withhold the hex dumps of the leaked memory.
1527 .It Fl nostacks
1528 Don't show stack traces of leaked memory.
1529 .It Fl exclude Ar symbol
1530 Ignore leaks called from
1531 .Ar symbol Ns .
1532 .El
1533 .El
1534 .It
1535 .Nm smartcards
1536 .Ar token
1537 .Op Fl l
1538 .Op Fl e Ar token
1539 .Op Fl d Ar token
1540 .Bl -item -offset -indent
1541 Enable, disable or list disabled smartcard tokens.
1542 .It
1543 Options:
1544 .Bl -tag -compact -width -indent-indent
1545 .It Fl l
1546 List disabled smartcard tokens.
1547 .It Fl e Ar token
1548 Enable smartcard token.
1549 .It Fl d Ar token
1550 Disable smartcard token.
1551 .El
1552 .It
1553 .Sy To list tokens available in the system
1554 .It
1555 .Bl -tag -compact -width -indent
1556 .It pluginkit -m -p com.apple.ctk-tokens
1557 .El
1558 .It
1559 .Sy Examples
1560 .It
1561 .Bl -tag -compact -width -indent
1562 .It security smartcards token -l
1563 .It security smartcards token -d com.apple.CryptoTokenKit.pivtoken
1564 .It security smartcards token -e com.apple.CryptoTokenKit.pivtoken
1565 .El
1566 .El
1567 .It
1568 .Nm error
1569 .Op Fl h
1570 .Op Ar <error code(s)...>
1571 .Bl -item -offset -indent
1572 Display an error string for the given security-related error code.
1573 The error can be in decimal or hex, e.g. 1234 or 0x1234. Multiple
1574 errors can be separated by spaces.
1575 .El
1576 .El
1577 .El
1578 .Sh ENVIRONMENT      \" May not be needed
1579 .Bl -tag -width -indent
1580 .It Ev MallocStackLogging
1581 When using the
1582 .Nm leaks
1583 command or the
1584 .Fl l
1585 option it's probably a good idea to set this environment variable before
1586 .Nm
1587 is started.  Doing so will allow leaks to display symbolic backtraces.
1588 .El
1589 .Sh FILES
1590 .Bl -tag -width -indent
1591 .It Pa ~/Library/Preferences/com.apple.security.plist
1592 .Pp
1593 Property list file containing the current user's default keychain and keychain search list.
1594 .It Pa /Library/Preferences/com.apple.security.plist
1595 .Pp
1596 Property list file containing the system default keychain and keychain search list.  This is used by processes started at boot time, or those requesting to use the system search domain, such as system daemons.
1597 .It Pa /Library/Preferences/com.apple.security-common.plist
1598 .Pp
1599 Property list file containing the common keychain search list, which is appended to every user's search list and to the system search list.
1600 .El
1601 .Sh SEE ALSO
1602 .\" List links in ascending order by section, alphabetically within a section.
1603 .\" Please do not reference files that do not exist without filing a bug report
1604 .Xr certtool 1 ,
1605 .Xr leaks 1 ,
1606 .Xr pluginkit 8
1607 .\" .Xr systemkeychain 8
1608 .Sh HISTORY
1609 .Nm
1610 was first introduced in Mac OS X version 10.3.
1611 .Sh BUGS
1612 .Nm
1613 still needs more commands before it can be considered complete.
1614 In particular, it should someday supersede both the
1615 .Li certtool
1616 and
1617 .Li systemkeychain
1618 commands.