#import <Foundation/Foundation.h>

#include <Security/Security.h>

SecAccessRef createAccess(NSString *accessLabel)

{

    OSStatus err;

    SecAccessRef access=nil;

    NSArray *trustedApplications=nil;

    //Make an exception list of trusted applications; that is,

    // applications that are allowed to access the item without

    // requiring user confirmation:

    SecTrustedApplicationRef myself, someOther;

    //Create trusted application references; see SecTrustedApplications.h:

    err = SecTrustedApplicationCreateFromPath(NULL, &myself);

    err = err ?: SecTrustedApplicationCreateFromPath("/Applications/Mail.app",

                                                            &someOther);

    if (err == noErr) {

        trustedApplications = [NSArray arrayWithObjects:(__bridge_transfer id)myself,

                                                    (__bridge_transfer id)someOther, nil];

    }

    //Create an access object:

    err = err ?: SecAccessCreate((__bridge CFStringRef)accessLabel,

                            (__bridge CFArrayRef)trustedApplications, &access);

    if (err) return nil;

    return access;

}

OSStatus addInternetPassword(NSString *password, NSString *account,

                    NSString *server, NSString *itemLabel, NSString *path,

                    SecProtocolType protocol, int port)

{

    OSStatus err;

    SecKeychainItemRef item = nil;

    const char *pathUTF8 = [path UTF8String];

    const char *serverUTF8 = [server UTF8String];

    const char *accountUTF8 = [account UTF8String];

    const char *passwordUTF8 = [password UTF8String];

    const char *itemLabelUTF8 = [itemLabel UTF8String];

    //Create initial access control settings for the item:

    SecAccessRef access = createAccess(itemLabel);

    //Following is the lower-level equivalent to the

    // SecKeychainAddInternetPassword function:

    assert(strlen(itemLabelUTF8) <= 0xffffffff);

    assert(strlen(accountUTF8) <= 0xffffffff);

    assert(strlen(serverUTF8) <= 0xffffffff);

    assert(strlen(pathUTF8) <= 0xffffffff);

    //Set up the attribute vector (each attribute consists

    // of {tag, length, pointer}):

    SecKeychainAttribute attrs[] = {

        { kSecLabelItemAttr, (UInt32)strlen(itemLabelUTF8), (char *)itemLabelUTF8 },

        { kSecAccountItemAttr, (UInt32)strlen(accountUTF8), (char *)accountUTF8 },

        { kSecServerItemAttr, (UInt32)strlen(serverUTF8), (char *)serverUTF8 },

        { kSecPortItemAttr, sizeof(int), (int *)&port },

        { kSecProtocolItemAttr, sizeof(SecProtocolType),

                                        (SecProtocolType *)&protocol },

        { kSecPathItemAttr, (UInt32)strlen(pathUTF8), (char *)pathUTF8 }

    };

    SecKeychainAttributeList attributes = { sizeof(attrs) / sizeof(attrs[0]),

                                            attrs };

    assert(strlen(passwordUTF8) <= 0xffffffff);

    err = SecKeychainItemCreateFromContent(

        kSecInternetPasswordItemClass,

        &attributes,

        (UInt32)strlen(passwordUTF8),

        passwordUTF8,

        NULL, // use the default keychain

        access,

        &item);

    if (access) CFRelease(access);

    if (item) CFRelease(item);

    return err;

}

int tryAdd(void)

{

         //Add an example password to the keychain:

    return addInternetPassword(@"sample password", @"sample account",

            @"samplehost.apple.com", @"sampleName", @"cgi-bin/bogus/testpath",

                                                kSecProtocolTypeHTTP, 8080);

}

#include <CoreFoundation/CoreFoundation.h>

#include <Security/Security.h>

#include <CoreServices/CoreServices.h>

//Get an ACL out of a CFArray:

SecACLRef GetACL (CFIndex numACLs, CFArrayRef ACLList,

                CFArrayRef *applicationList, CFStringRef *description,

                SecKeychainPromptSelector *promptSelector)

{

    OSStatus status;

    //Because we limited our search to ACLs used for decryption, we

    // expect only one ACL for this item. Therefore, we extract the

    // application list from the first ACL in the array.

    const SecACLRef acl = (SecACLRef) CFArrayGetValueAtIndex(ACLList, 0);

    status = SecACLCopyContents (

        acl,                    // the ACL from which to extract

                                //  the list of trusted apps

        applicationList,        // the list of trusted apps

        description,            // the description string

        promptSelector          // the value of the prompt selector flag

                                        );

    if (status == noErr) {

        return acl;

    } else {

        return NULL;

    }

}

int modifyTheACL(void)

{

    OSStatus status;

    SecKeychainSearchRef searchReference = NULL;

    SecKeychainItemRef itemRef = NULL;

    SecAccessRef itemAccess = NULL;

    SecACLRef oldACL = NULL, newACL = NULL;

    CFIndex arrayCount;

    CFRange arrayRange;

    SecTrustedApplicationRef trustedAppArray[10];

    SecKeychainPromptSelector promptSelector;

    CFStringRef description = NULL;

    CFArrayRef newTrustedAppArray = NULL;

    const char *path = "/Applications/Mail.app";       //path to

                                        // trusted app to add to ACL

    SecTrustedApplicationRef trustedApp = NULL;

    /* Construct a search dictionary to find the desired item. */

    const void *keys[] = {

    	kSecAttrLabel,

        kSecReturnRef, /* return the item. */

        NULL

    };

    const void *values[] = {

        /* kSecAttrLabel => */ CFSTR("www.TestItem.com"),

        /* kSecReturnRef => */ kCFBooleanTrue,

        NULL

    };

    CFDictionaryRef searchDict = CFDictionaryCreate(kCFAllocatorDefault,

        keys,

        values,

        sizeof(keys) / sizeof(keys[0]),

        &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);

     CFArrayRef aclList = NULL;

     CFIndex numACLs = 0;

     CFArrayRef applicationList;

     CFTypeRef authorizationTag =

        kSecACLAuthorizationDecrypt;  // the authorization tag

                                        //  to search for.

     // Find the keychain item and obtain a keychain item reference object.

    // This returns a SecKeychainItemRef, which we must release when

    //  we're finished using it.

    status = SecItemCopyMatching(searchDict, (CFTypeRef *)&itemRef);

    if (status == noErr)

        {

        // Obtain the access reference object for the keychain item.

        // This returns a SecAccessRef, which we must release when

        //  we're finished using it.

        status = SecKeychainItemCopyAccess (itemRef, &itemAccess);

        // Obtain an array of ACL entry objects for the access object.

        // Limit the search to ACL entries with the specified

        //  authorization tag.

        aclList = SecAccessCopyMatchingACLList(itemAccess,

                                     authorizationTag);

        numACLs = CFArrayGetCount (aclList);

        // Extract the ACL entry object from the array of ACL entries,

        //  along with the ACL entry's list of trusted applications,

        //  its description, and its prompt selector flag setting.

        // This returns a SecACLRef and a CFArrayRef, which we must

        //  release we're finished using them.

        oldACL = GetACL (numACLs, aclList, &applicationList,

                                    &description, &promptSelector);

        if (oldACL) { CFRetain(oldACL); }

        arrayCount = CFArrayGetCount (applicationList);

        //  The application list is a CFArray.  Extract the list of

        //  applications from the CFArray.

        arrayRange.location = (CFIndex) 0;

        arrayRange.length = arrayCount;

        CFArrayGetValues (applicationList, arrayRange,

                                            (void *) trustedAppArray);

        // Create a new trusted application reference object for

        //  the application to be added to the list.

        status = status ?: SecTrustedApplicationCreateFromPath (path, &trustedApp);

        if (status == noErr)   // the function fails if the application is

                                // not found.

        {

            // Append the new application to the array and create a

            //  new CFArray.

            trustedAppArray[arrayCount] = trustedApp;

            newTrustedAppArray = CFArrayCreate (NULL,

                                (void *)trustedAppArray, arrayCount+1,

                                                &kCFTypeArrayCallBacks);

            // Get the authorizations from the old ACL.

            CFArrayRef authorizations = SecACLCopyAuthorizations(oldACL);

            // Delete the old ACL from the access object. The user is

            // prompted for permission to alter the keychain item.

            status = status ?: SecACLRemove (oldACL);

            // Create a new ACL with the same attributes as the old

            // one, except use the new CFArray of trusted applications.

            status = status ?: SecACLCreateWithSimpleContents (itemAccess,

                        newTrustedAppArray, description, promptSelector,

                                                            &newACL);

            // Set the authorizations for the new ACL to be the same as

            //  those for the old ACL.

            status = status ?: SecACLUpdateAuthorizations (newACL, authorizations);

            // Replace the access object in the keychain item with the

            //  new access object. The user is prompted for permission

            //  to alter the keychain item.

            status = status ?: SecKeychainItemSetAccess (itemRef, itemAccess);

            CFRelease(authorizations);

        }

        else {

            // Handle the error if the application was not found.

            // ...

        }

    // Release the objects we allocated or retrieved

    if (searchReference)

        CFRelease(searchReference);     //SecKeychainSearchRef

    if (itemRef)

        CFRelease(itemRef);             //SecKeychainItemRef

    if (itemAccess)

        CFRelease(itemAccess);          //SecAccessRef

    if (oldACL)

        CFRelease(oldACL);              //SecACLRef

    if (newACL)

        CFRelease(newACL);              //SecACLRef

    if (description)

        CFRelease(description);         //CFStringRef

    if (newTrustedAppArray)

        CFRelease(newTrustedAppArray);  //CFArrayRef

    if (trustedApp)

        CFRelease(trustedApp);          //SecTrustedApplicationRef

    if (aclList)

        CFRelease(aclList);             //CFArrayRef

    if (applicationList)

        CFRelease(applicationList);     //CFArrayRef

    }

    return (status);

}