Data Protection / NSFileProtectionComplete - successfully supported through entitlements.plist?

ios entitlements data-protection
Snips picture Snips · Feb 6, 2013 · Viewed 11.6k times · Source

I'm looking to encrypt user data in an app, and the NSFileProtection mechanism looks perfect for this.

This SO Question / Answer thread pointed me at the WWDC 2011 Video Securing iOS Apps which gave the 'too good to be true' tip of setting Data Protection across the app via entitlements (see from 33 minutes in).

So, I tried this for my iOS 5.x+ app, and ran into the problem where it complains about Invalid Entitlements.

I've configured Data Protection for the specific app via the iOS Provisioning Portal, and updated my app Provisioning, so in theory I should all be set, but I still get the error.

If I remove the specific FileProtectionComplete setting from the Entitlement, the app runs without the Invalid Entitlement error.

In investigating this, I also saw the some folk are getting their apps rejected (at the point they upload the binary) as this isn't supported (or deprecated?). Please note that I'm specifically asking about Data Protection, and not Passbook.

At this stage, I'm thinking, maybe it really is, 'too good to be true'. So, I'm about to give up on this magic entitlements flag, and instead use the programmatic method, of adding NSFileProtectionComplete as a write option.

However, before I do that, can anyone confirm they've been able to successfully add Data Protection just by using the Entitlements flag? Thanks.

Answer

Heath Borders picture Heath Borders · May 6, 2013

NSFileProtectionComplete isn't supported via entitlements anymore. Instead, it is specified in the provision profile.

I had the exact same problem you did. When I tried to build and run on a device, I got the following alert:

The executable was signed with invalid entitlements.

The entitlements specified in your application’s Code Signing Entitlements file do not match those specified in your provisioning profile.

(0xE8008016).

In the console, it manifested itself as this error:

May 6 16:18:13 XXXXX installd[54] : entitlement 'DataProtectionClass' has value not permitted by a provisioning profile

Eventually, I found the proper settings. You must log in to the developer portal and enable data protection on the app id associated with the provisioning profile you're using. See the image below:

enter image description here

Related questions

What does get-task-allow do in Xcode?

So when I set up my entitlements in my iPhone app project, I create a new Entitlements.plist, and set the value of get-task-allow to false. But why? What does this key represent? EDIT Note this is related to this …

Read More
How to create Entitlement.plist file in Xcode?

I have downloaded the latest version of Xcode. I want to create Entitlement.plist file in my project. Please give me proper steps to create an Entitlement.plist file in Xcode.

Read More
Xcode6 error: "No matching provisioning profiles found for application"

I'm trying to submit my iOS app in Xcode6. When I click Submit or Validate in the organizer, a window pops up that says: Failed to locate or generate matching signing assets: Xcode attempted to locate or generate matching signing …

Read More