Skip to content

Commit ccc8643

Browse files
moonD4rkmoonD4rk
authored
feat: add interactive terminal password prompt for keychain unlock (#558)
* feat(darwin): add interactive terminal password prompt for keychain unlock (#556) * test: add unit tests for keyretriever and address review feedback - Add errStorageNotFound sentinel error for precise error matching - Non-TTY TerminalPasswordRetriever returns nil silently (review #558) - Add darwin tests: findStorageKey, empty password, non-TTY skip - Add linux tests: FallbackRetriever peanuts key, DefaultRetriever chain * fix: add nolint:unused for errStorageNotFound on Windows, clean up error message errStorageNotFound is only used on darwin/linux; Windows lint flagged it as unused. Also simplify error format to avoid "storage" duplication. * fix: add nolint:unused for errStorageNotFound, simplify error message errStorageNotFound is only referenced on darwin and linux; Windows lint flags it as unused. Also remove redundant "storage" prefix from the error format string.
1 parent 4c3dd97 commit ccc8643

8 files changed

Lines changed: 180 additions & 26 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ updates:
1111
versions: [">=1.32.0"] # v1.32+ requires Go 1.21, project is pinned to Go 1.20
1212
- dependency-name: "golang.org/x/text" # indirect dep, newer versions may require Go 1.21+
1313
- dependency-name: "golang.org/x/sys" # newer versions require Go 1.21+
14+
- dependency-name: "golang.org/x/term"
15+
versions: [">=0.30.0"] # v0.30.0+ requires Go 1.23, project is pinned to Go 1.20
1416
- package-ecosystem: "github-actions"
1517
directory: "/"
1618
schedule:

‎crypto/keyretriever/keyretriever.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@ import (
55
"fmt"
66
)
77

8+
// errStorageNotFound is returned when the requested browser storage
9+
// account is not found in the credential store (keychain, keyring, etc.).
10+
// Only used on darwin and linux; Windows uses DPAPI which has no storage lookup.
11+
var errStorageNotFound = errors.New("not found in credential store") //nolint:unused // only used on darwin and linux
12+
813
// KeyRetriever retrieves the master encryption key for a Chromium-based browser.
914
// Each platform has different implementations:
1015
// - macOS: Keychain access (security command) or gcoredump exploit

‎crypto/keyretriever/keyretriever_darwin.go‎

Lines changed: 68 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,14 @@ import (
88
"crypto/sha1"
99
"errors"
1010
"fmt"
11+
"os"
1112
"os/exec"
1213
"strings"
1314
"sync"
1415
"time"
1516

1617
"github.com/moond4rk/keychainbreaker"
18+
"golang.org/x/term"
1719
)
1820

1921
// https://source.chromium.org/chromium/chromium/src/+/master:components/os_crypt/os_crypt_mac.mm;l=157
@@ -55,6 +57,30 @@ func (r *GcoredumpRetriever) retrieveKeyOnce(storage string) ([]byte, error) {
5557
return darwinParams.deriveKey([]byte(secret)), nil
5658
}
5759

60+
// loadKeychainRecords opens login.keychain-db and unlocks it with the given
61+
// password, returning all generic password records.
62+
func loadKeychainRecords(password string) ([]keychainbreaker.GenericPassword, error) {
63+
kc, err := keychainbreaker.Open()
64+
if err != nil {
65+
return nil, fmt.Errorf("open keychain: %w", err)
66+
}
67+
if err := kc.Unlock(keychainbreaker.WithPassword(password)); err != nil {
68+
return nil, fmt.Errorf("unlock keychain: %w", err)
69+
}
70+
return kc.GenericPasswords()
71+
}
72+
73+
// findStorageKey searches keychain records for the given storage account
74+
// and derives the encryption key.
75+
func findStorageKey(records []keychainbreaker.GenericPassword, storage string) ([]byte, error) {
76+
for _, rec := range records {
77+
if rec.Account == storage {
78+
return darwinParams.deriveKey(rec.Password), nil
79+
}
80+
}
81+
return nil, fmt.Errorf("%q: %w", storage, errStorageNotFound)
82+
}
83+
5884
// KeychainPasswordRetriever unlocks login.keychain-db directly using the
5985
// user's macOS login password. No root privileges required.
6086
// The keychain is opened and decrypted only once; subsequent calls
@@ -67,35 +93,50 @@ type KeychainPasswordRetriever struct {
6793
err error
6894
}
6995

70-
func (r *KeychainPasswordRetriever) loadRecords() {
71-
kc, err := keychainbreaker.Open()
72-
if err != nil {
73-
r.err = fmt.Errorf("open keychain: %w", err)
74-
return
75-
}
76-
if err := kc.Unlock(keychainbreaker.WithPassword(r.Password)); err != nil {
77-
r.err = fmt.Errorf("unlock keychain: %w", err)
78-
return
79-
}
80-
r.records, r.err = kc.GenericPasswords()
81-
}
82-
8396
func (r *KeychainPasswordRetriever) RetrieveKey(storage, _ string) ([]byte, error) {
8497
if r.Password == "" {
8598
return nil, fmt.Errorf("keychain password not provided")
8699
}
87100

88-
r.once.Do(r.loadRecords)
101+
r.once.Do(func() {
102+
r.records, r.err = loadKeychainRecords(r.Password)
103+
})
89104
if r.err != nil {
90105
return nil, r.err
91106
}
92107

93-
for _, rec := range r.records {
94-
if rec.Account == storage {
95-
return darwinParams.deriveKey(rec.Password), nil
108+
return findStorageKey(r.records, storage)
109+
}
110+
111+
// TerminalPasswordRetriever prompts for the keychain password interactively
112+
// via the terminal using golang.org/x/term (with echo disabled).
113+
// Automatically skipped when stdin is not a TTY.
114+
type TerminalPasswordRetriever struct {
115+
once sync.Once
116+
records []keychainbreaker.GenericPassword
117+
err error
118+
}
119+
120+
func (r *TerminalPasswordRetriever) RetrieveKey(storage, _ string) ([]byte, error) {
121+
if !term.IsTerminal(int(os.Stdin.Fd())) {
122+
return nil, nil
123+
}
124+
125+
r.once.Do(func() {
126+
fmt.Fprintf(os.Stderr, "Enter macOS login password for %s: ", storage)
127+
pwd, err := term.ReadPassword(int(os.Stdin.Fd()))
128+
fmt.Fprintln(os.Stderr)
129+
if err != nil {
130+
r.err = fmt.Errorf("terminal: read password: %w", err)
131+
return
96132
}
133+
r.records, r.err = loadKeychainRecords(string(pwd))
134+
})
135+
if r.err != nil {
136+
return nil, r.err
97137
}
98-
return nil, fmt.Errorf("storage %q not found in keychain", storage)
138+
139+
return findStorageKey(r.records, storage)
99140
}
100141

101142
// SecurityCmdRetriever uses macOS `security` CLI to query Keychain.
@@ -143,14 +184,21 @@ func (r *SecurityCmdRetriever) retrieveKeyOnce(storage string) ([]byte, error) {
143184
}
144185

145186
// DefaultRetriever returns the macOS retriever chain.
146-
// If keychainPassword is provided, the password-based retriever is included.
187+
// The chain tries each method in order until one succeeds:
188+
// 1. GcoredumpRetriever — CVE-2025-24204 exploit (root only, non-interactive)
189+
// 2. KeychainPasswordRetriever — direct unlock with --keychain-pw flag
190+
// 3. TerminalPasswordRetriever — interactive password prompt via terminal
191+
// 4. SecurityCmdRetriever — security CLI fallback (may trigger system dialog)
147192
func DefaultRetriever(keychainPassword string) KeyRetriever {
148193
retrievers := []KeyRetriever{
149194
&GcoredumpRetriever{},
150195
}
151196
if keychainPassword != "" {
152197
retrievers = append(retrievers, &KeychainPasswordRetriever{Password: keychainPassword})
153198
}
154-
retrievers = append(retrievers, &SecurityCmdRetriever{})
199+
retrievers = append(retrievers,
200+
&TerminalPasswordRetriever{},
201+
&SecurityCmdRetriever{},
202+
)
155203
return NewChain(retrievers...)
156204
}

‎crypto/keyretriever/keyretriever_darwin_test.go‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
//go:build darwin
2+
3+
package keyretriever
4+
5+
import (
6+
"testing"
7+
8+
"github.com/moond4rk/keychainbreaker"
9+
"github.com/stretchr/testify/assert"
10+
"github.com/stretchr/testify/require"
11+
)
12+
13+
func TestFindStorageKey_Found(t *testing.T) {
14+
records := []keychainbreaker.GenericPassword{
15+
{Account: "Chrome", Password: []byte("mock-secret")},
16+
{Account: "Brave", Password: []byte("brave-secret")},
17+
}
18+
19+
key, err := findStorageKey(records, "Chrome")
20+
require.NoError(t, err)
21+
assert.Equal(t, darwinParams.deriveKey([]byte("mock-secret")), key)
22+
}
23+
24+
func TestFindStorageKey_NotFound(t *testing.T) {
25+
records := []keychainbreaker.GenericPassword{
26+
{Account: "Chrome", Password: []byte("mock-secret")},
27+
}
28+
29+
key, err := findStorageKey(records, "Firefox")
30+
require.Error(t, err)
31+
assert.Nil(t, key)
32+
assert.ErrorIs(t, err, errStorageNotFound)
33+
}
34+
35+
func TestKeychainPasswordRetriever_EmptyPassword(t *testing.T) {
36+
r := &KeychainPasswordRetriever{Password: ""}
37+
key, err := r.RetrieveKey("Chrome", "")
38+
require.Error(t, err)
39+
assert.Nil(t, key)
40+
assert.Contains(t, err.Error(), "keychain password not provided")
41+
}
42+
43+
func TestTerminalPasswordRetriever_NonTTY(t *testing.T) {
44+
// In CI/test environments, stdin is not a TTY.
45+
// The retriever should silently return nil, nil to let the chain continue.
46+
r := &TerminalPasswordRetriever{}
47+
key, err := r.RetrieveKey("Chrome", "")
48+
require.NoError(t, err)
49+
assert.Nil(t, key)
50+
}

‎crypto/keyretriever/keyretriever_linux.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ func (r *DBusRetriever) RetrieveKey(storage, _ string) ([]byte, error) {
6565
}
6666
}
6767

68-
return nil, fmt.Errorf("secret %q not found in keyring", storage)
68+
return nil, fmt.Errorf("%q: %w", storage, errStorageNotFound)
6969
}
7070

7171
// FallbackRetriever uses the hardcoded "peanuts" password when D-Bus is unavailable.

‎crypto/keyretriever/keyretriever_linux_test.go‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
//go:build linux
2+
3+
package keyretriever
4+
5+
import (
6+
"testing"
7+
8+
"github.com/stretchr/testify/assert"
9+
"github.com/stretchr/testify/require"
10+
)
11+
12+
func TestFallbackRetriever(t *testing.T) {
13+
r := &FallbackRetriever{}
14+
15+
key, err := r.RetrieveKey("Chrome", "")
16+
require.NoError(t, err)
17+
assert.Equal(t, linuxParams.deriveKey([]byte("peanuts")), key)
18+
assert.Len(t, key, linuxParams.keySize)
19+
20+
// The key should not be all zeros.
21+
allZero := true
22+
for _, b := range key {
23+
if b != 0 {
24+
allZero = false
25+
break
26+
}
27+
}
28+
assert.False(t, allZero, "derived key should not be all zeros")
29+
30+
// "peanuts" is a fixed fallback password, so the result should be
31+
// the same regardless of storage name or number of calls.
32+
key2, err := r.RetrieveKey("Brave", "")
33+
require.NoError(t, err)
34+
assert.Equal(t, key, key2, "fallback key should be the same for any storage")
35+
}
36+
37+
func TestDefaultRetriever_Linux(t *testing.T) {
38+
r := DefaultRetriever("")
39+
chain, ok := r.(*ChainRetriever)
40+
require.True(t, ok, "DefaultRetriever should return a *ChainRetriever")
41+
42+
assert.Len(t, chain.retrievers, 2, "chain should have 2 retrievers")
43+
assert.IsType(t, &DBusRetriever{}, chain.retrievers[0], "first retriever should be DBusRetriever")
44+
assert.IsType(t, &FallbackRetriever{}, chain.retrievers[1], "second retriever should be FallbackRetriever")
45+
}

‎go.mod‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,12 @@ require (
88
github.com/otiai10/copy v1.14.1
99
github.com/ppacher/go-dbus-keyring v1.0.1
1010
github.com/spf13/cobra v1.10.2
11+
github.com/spf13/pflag v1.0.10
1112
github.com/stretchr/testify v1.11.1
1213
github.com/syndtr/goleveldb v1.0.0
1314
github.com/tidwall/gjson v1.18.0
14-
golang.org/x/sys v0.27.0
15+
golang.org/x/sys v0.30.0
16+
golang.org/x/term v0.29.0
1517
modernc.org/sqlite v1.31.1
1618
)
1719

@@ -27,7 +29,6 @@ require (
2729
github.com/otiai10/mint v1.6.3 // indirect
2830
github.com/pmezard/go-difflib v1.0.0 // indirect
2931
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
30-
github.com/spf13/pflag v1.0.9 // indirect
3132
github.com/tidwall/match v1.1.1 // indirect
3233
github.com/tidwall/pretty v1.2.0 // indirect
3334
golang.org/x/sync v0.8.0 // indirect

‎go.sum‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,9 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qq
4343
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
4444
github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
4545
github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
46-
github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
4746
github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
47+
github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
48+
github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
4849
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
4950
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
5051
github.com/syndtr/goleveldb v1.0.0 h1:fBdIW9lB4Iz0n9khmH8w27SJ3QEJ7+IgjPEwGSZiFdE=
@@ -64,8 +65,10 @@ golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
6465
golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
6566
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
6667
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
67-
golang.org/x/sys v0.27.0 h1:wBqf8DvsY9Y/2P8gAfPDEYNuS30J4lPHJxXSb/nJZ+s=
68-
golang.org/x/sys v0.27.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
68+
golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
69+
golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
70+
golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
71+
golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
6972
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
7073
golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
7174
golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=

0 commit comments

Comments
 (0)