Rust中调用SecTrustSettingsSetTrustSettings始终返回errSecInternalComponent错误

问题核心原因 #

调用SecTrustSettingsSetTrustSettings返回-2070 errSecInternalComponent，主要和两个关键点有关：

• 权限上下文缺失：macOS 13+对系统级信任设置的权限管控严格，仅通过sudo提升UID不足以让Security.framework认可操作权限，需要通过Authorization Services明确获取授权
• 参数无效：直接传入空CFTypeRef作为信任设置参数，在Admin/System域下不被允许，必须构造符合要求的信任配置结构

分步解决方案 #

1. 构造合法的信任设置参数 #

针对Admin域，需要构建包含信任级别配置的CFArray（元素为CFDictionary），示例代码如下：

use core_foundation_sys::dictionary::{CFDictionaryCreate, CFDictionaryRef};
use core_foundation_sys::array::{CFArrayCreate, CFArrayRef};
use core_foundation_sys::string::CFStringRef;
use core_foundation_sys::base::{kCFAllocatorDefault, CFTypeRef};
use std::ptr;

// 绑定Security.framework的CFString常量
extern "C" {
    static kSecTrustSettingsResult: CFStringRef;
}

fn create_trust_settings(trust_result: SecTrustSettingsResult) -> CFTypeRef {
    // 构造信任设置字典：指定信任级别
    let keys = [kSecTrustSettingsResult];
    let values = [trust_result as CFTypeRef];
    
    let trust_dict = unsafe {
        CFDictionaryCreate(
            kCFAllocatorDefault,
            keys.as_ptr() as *const _,
            values.as_ptr(),
            1,
            ptr::null(),
            ptr::null(),
        )
    };
    
    // 将字典包装为数组（SecTrustSettings要求传入数组格式）
    let trust_array = unsafe {
        CFArrayCreate(
            kCFAllocatorDefault,
            &trust_dict as *const _,
            1,
            ptr::null(),
        )
    };
    
    trust_array as CFTypeRef
}

2. 通过Authorization Services获取操作权限 #

必须通过Authorization Services申请com.apple.trust-settings.admin权限，示例代码：

use core_foundation_sys::authorization::{
    AuthorizationCreate, AuthorizationRef, AuthorizationItem, AuthorizationRights,
    kAuthorizationFlagDefaults, kAuthorizationFlagInteractionAllowed, kAuthorizationFlagPreAuthorize,
};
use core_foundation_sys::base::OSStatus;

const AUTH_RIGHT_TRUST_SETTINGS_ADMIN: &str = "com.apple.trust-settings.admin";

fn get_authorization() -> Result<AuthorizationRef, OSStatus> {
    let auth_item = AuthorizationItem {
        name: AUTH_RIGHT_TRUST_SETTINGS_ADMIN.as_ptr() as *const _,
        valueLength: 0,
        value: ptr::null_mut(),
        flags: 0,
    };
    
    let auth_rights = AuthorizationRights {
        count: 1,
        items: &auth_item as *const _,
    };
    
    let mut auth_ref: AuthorizationRef = ptr::null_mut();
    let status = unsafe {
        AuthorizationCreate(
            &auth_rights,
            ptr::null(),
            kAuthorizationFlagDefaults | kAuthorizationFlagInteractionAllowed | kAuthorizationFlagPreAuthorize,
            &mut auth_ref,
        )
    };
    
    if status == 0 { Ok(auth_ref) } else { Err(status) }
}

3. 修改调用逻辑整合权限与参数 #

更新set_trust_settings函数，整合上述逻辑：

use std::ptr;
use crate::base::SecCertificate;
use core_foundation_sys::base::OSStatus;
use core_foundation_sys::authorization::AuthorizationFree;

pub fn set_trust_settings(cert: &SecCertificate) -> Result<(), OSStatus> {
    // 1. 获取授权上下文
    let auth_ref = get_authorization()?;
    
    // 2. 构造信任设置（示例：设置为信任根证书）
    let trust_settings = create_trust_settings(kSecTrustSettingsResultTrustRoot);
    
    // 3. 调用SecTrustSettingsSetTrustSettings
    let status = unsafe {
        SecTrustSettingsSetTrustSettings(
            cert.as_CFTypeRef() as *mut _,
            kSecTrustSettingsDomainAdmin,
            trust_settings,
        )
    };
    
    // 4. 释放资源
    unsafe {
        AuthorizationFree(auth_ref, 0);
        // 需根据core-foundation规则手动释放CFArray/CFDictionary（或依赖crate自动释放）
        // CFRelease(trust_settings);
    }
    
    if status == 0 { Ok(()) } else { Err(status) }
}

额外注意事项 #

• 确保证书已添加到对应域的钥匙串（Admin域对应系统钥匙串或管理员专属钥匙串）
• 程序运行时需允许UI授权弹窗（避免在无图形界面环境下运行），否则授权会失败
• 不要修改authorizationdb默认规则，这会带来系统安全风险且无法解决根本问题

内容的提问来源于stack exchange，提问作者emanuele-em