How to revoke “Always allow” privileges from an application

command linekeychainpermissionSecurityterminal

The application I have in mind is the security command line tool bundled with Macos. The man page describes it as:

security -- Command line interface to keychains and Security framework

At some point recently I wanted to get a password from my keychain using the command-line. Which is done using the following command:

matt@laptop ~ $ security find-generic-password -a 'foobar'

The first time I ran it I saw the usual Always Allow, Deny, and Allow dialogue. I (foolishly) picked Always Allow and now I can't find how/where to undo that.

I've looked using Keychain Access to see if the security tool appears there but it doesn't. The closest thing I could find was an entry for CommCenter but it was last modified before I ever used the security command.

Best Answer

Launch the Keychain Access Utility and find the entry you used that password:

Right click it to bring up its info window
Click the Access Control Tab and there you will see a list of applications that have "Always allow access" enabled
Highlight the application in the list that you want remove and click the [-] button to remove it from Always allowed access.

Related Solutions

MacOS – Keychain won’t let copy passwords after 10.11.1 update

Third-party utilities such as Alfred, TextExpander, or MagicPrefs might appear to take "control" of the window as far as the OS is concerned. You can find the culprit by disabling them all, and turning them on one by one until you find one (or more) which affects Keychain in that manner.

You can add the offending program to the list of approved apps ( System Preferences -> Security & Privacy -> Accessibility ) and this issue will go away. (hat tip to @elmigranto for this addenda)

MacOS – security command gives out passwords without prompting for the keychain password

I bumped into this same issue, and it seems its all about removing the default access when creating the new password, this is described on help of the command:

security add-generic-password -h

At the bottom you will see:

By default, the application which creates an item is trusted to access its data without warning. You can remove this default access by explicitly specifying an empty app pathname: -T "" If no keychain is specified, the password is added to the default keychain.

So essentially you create the password with the -T "" setting:

security add-generic-password -a YOURUSER -s SERVICENAME -w YOURPASSWORD -T ""

Best Answer

Related Solutions

MacOS – Keychain won’t let copy passwords after 10.11.1 update

MacOS – security command gives out passwords without prompting for the keychain password

Related Question