{"record":{"id":"c9929a127d2e3ffe","repo":"moonD4rk/HackBrowserData","slug":"security-command-w-likely-keychain-access-denie","errorCode":null,"errorMessage":"security command: %w (likely keychain access denied or wrong password)","messagePattern":"security command: %w \\(likely keychain access denied or wrong password\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_darwin.go","lineNumber":146,"sourceCode":"\nfunc (r *SecurityCmdRetriever) retrieveKeyOnce(storage string) ([]byte, error) {\n\tctx, cancel := context.WithTimeout(context.Background(), securityCmdTimeout)\n\tdefer cancel()\n\n\tvar stdout, stderr bytes.Buffer\n\tcmd := exec.CommandContext(ctx, \"security\", \"find-generic-password\", \"-wa\", strings.TrimSpace(storage)) //nolint:gosec\n\tcmd.Stdout = &stdout\n\tcmd.Stderr = &stderr\n\n\tif err := cmd.Run(); err != nil {\n\t\tif errors.Is(ctx.Err(), context.DeadlineExceeded) {\n\t\t\treturn nil, fmt.Errorf(\"security command timed out after %s\", securityCmdTimeout)\n\t\t}\n\t\t// `security` exits non-zero with empty stderr when the user denies the prompt or mistypes;\n\t\t// surface that instead of the cryptic \"exit status 128 ()\".\n\t\tstderrStr := strings.TrimSpace(stderr.String())\n\t\tif stderrStr == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"security command: %w (likely keychain access denied or wrong password)\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"security command: %w (%s)\", err, stderrStr)\n\t}\n\tif stderr.Len() > 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: %s\", strings.TrimSpace(stderr.String()))\n\t}\n\n\tsecret := bytes.TrimSpace(stdout.Bytes())\n\tif len(secret) == 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: empty secret for %s\", storage)\n\t}\n\n\treturn darwinParams.deriveKey(secret), nil\n}\n\n// DefaultRetrievers wires the macOS V10 chain (the only tier Chromium uses here), first success wins:\n//  1. GcoredumpRetriever        — CVE-2025-24204 exploit (root only)\n//  2. KeychainPasswordRetriever — direct unlock, skipped when password is empty","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_darwin.go#L128-L164","documentation":"The `security` command exited non-zero with an empty stderr, which typically means the user denied the keychain-access prompt or mistyped their password; the raw exec error (e.g. \"exit status 128\") is wrapped as \"security command: %w (likely keychain access denied or wrong password)\" to make the cause clear.","triggerScenarios":"cmd.Run() returns an error, ctx.Err() is not DeadlineExceeded, and stderr.String() trims to empty — the classic deny-the-prompt or wrong-password case of the `security` CLI.","commonSituations":"User clicked \"Deny\" on the keychain access dialog, headless automation auto-denies prompts, or the keychain is locked and passwordless access fails silently.","solutions":["Re-run and click \"Always Allow\" on the keychain access prompt","Pre-authorize the binary in Keychain Access > login > Access Control","Ensure the keychain is unlocked (`security unlock-keychain`) before running","Switch to KeychainPasswordRetriever with the login password to avoid prompts entirely"],"exampleFix":"// before\n// relying on security CLI prompt\ncmd := exec.CommandContext(ctx, \"security\", \"find-generic-password\", \"-wa\", storage)\n// after\n// use direct keychain unlock, no interactive prompt\nr := &masterkey.KeychainPasswordRetriever{Password: loginPassword}\nkey, err := r.RetrieveKey(hints)","handlingStrategy":"try-catch","validationCode":"cmd := exec.Command(\"security\", \"show-keychain-info\")\nif err := cmd.Run(); err != nil {\n\treturn errors.New(\"keychain is locked; unlock before retrieval\")\n}","typeGuard":"func isAccessDenied(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"likely keychain access denied\")\n}","tryCatchPattern":"key, err := r.RetrieveKey(hints)\nif err != nil && strings.Contains(err.Error(), \"access denied or wrong password\") {\n\treturn nil, fmt.Errorf(\"user denied keychain prompt: %w\", err)\n}","preventionTips":["Add the binary to keychain Access Control so prompts are auto-approved","Avoid running unattended with the security CLI retriever","Unlock the keychain programmatically before calling the retriever"],"tags":["macos","keychain","subprocess","permission-denied","security-cli"],"backgroundTag":"permission-denied","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}