Secure password storage for a launchd daemon

Question

In a normal Cocoa application it's typical to store any saved passwords in the Keychain and thus avoid many pitfalls. Now I'm writing a launchd daemon that needs to store a password and will run before any user has logged in. This means I cannot use the keychain like I normally do.

I see in Keychain Access there is a "system" keychain, but I have been unable to find any documentation whatsoever on how to use it (or if this is the correct use for it).

What is the best practice for storing passwords used by launchd daemons?

Answer 1

keychains are tightly tied to the concept of User context. therefore if you need a background process that deals with a user's keychain, then you should be using the UserAgent model. because deamons are typically (if not always) root:wheel priveleged, a typical scenario where a daemon would require some kind of credentials would be covered by kerberos (file sharing on a web server, XGrid agents, things like this). by no means should a root:wheel daemon be using the credentials of a user.

Answer 2

You can create your own Keychains and use them willy-nilly. For example, you could have one inside your app bundle, if you have an app bundle.

Or you could run the daemon as a particular user (the guy who installed it) and put the key in his keychain, then just reach into his home folder when you need it.

Or you could run the daemon as root and put your key in the System keychain.

-Wil