How does the Keychain identify executables? I am wondering how the Keychain identifies applications. I suspect that this based on code signing, but the experiments are not really consistent with this:

It works for executables that are not signed at all:

codesign -dv  /Library/Frameworks/R.framework/Resources/bin/exec/R
# /Library/Frameworks/R.framework/Resources/bin/exec/R: code object is not signed at all


But the R process is added to the ACL of this secret, and it can query it happily...

There is also nothing in the extended attributes of the executable:

xattr -l  /usr/bin/security
# 


If I change the file itself, it still works:

cp /usr/bin/security foobar
echo "\nharmless" &gt;&gt; foobar
./foobar find-generic-password -a 'gaborcsardi' -s foobar -g
# keychain: "/Users/gaborcsardi/Library/Keychains/login.keychain"
# class: "genp"
# attributes:
#     0x00000007 &lt;blob&gt;="foobar"
#     0x00000008 &lt;blob&gt;=&lt;NULL&gt;
#     "acct"&lt;blob&gt;="gaborcsardi"
# ...
# password: "secret"


But then how does it work? More specifically, how does the keychain know that the password query is coming from the security app, that I specifically allowed access to this entry?
The Keychain doesn't identify applications, the applications call the Keychain API


  The Keychain Services API provides a solution to this problem. By
  making a single call to this API, an app can store small bits of
  secret information on a keychain, from which the app can later
  retrieve the information—also with a single call. The keychain secures
  data by encrypting it before storing it in the file system, relieving
  you of the need to implement complicated encryption algorithms. The
  system also carefully controls access to stored items. The entire
  keychain can be locked, meaning no one can decrypt its protected
  contents until it is unlocked with a master password. Even with an
  unlocked keychain, the system’s Keychain Access policy ensures that
  only authorized apps gain access to a given item in the keychain. In
  the simplest case, the app that created an item is the only one that
  can access it later. However, Keychain Services also provides ways to
  share secrets among apps.