Only reauthorize passwords. Don't reauthorize private keys.

chrome/browser/mac/keychain_reauthorize.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/mac/keychain_reauthorize.h"
 
 #import <Foundation/Foundation.h>
 #include <Security/Security.h>
 
 #include <algorithm>
@@ skipping 437 matching lines @@
   SecKeychainItemRef old_item = item_and_reauthorized_access.item();
   base::mac::ScopedCFTypeRef<SecKeychainRef> keychain(
       CrSKeychainItemCopyKeychain(old_item));
 
   ScopedCrSKeychainItemAttributesAndData old_attributes_and_data(
       CrSKeychainItemCopyAttributesAndData(keychain, old_item));
   if (!old_attributes_and_data.get()) {
     return;
   }
 
+  // CrSKeychainItemCreateFromContent (SecKeychainItemCreateFromContent)
+  // returns errKCNoSuchAttr (errSecNoSuchAttr) when asked to add an item of
+  // type kSecPrivateKeyItemClass. This would happen after the original
+  // private key was deleted, resulting in data loss. I can't figure out how
+  // SecKeychainItemCreateFromContent wants private keys added. Skip them,
+  // only doing the reauthorization for Keychain item types known to work,
+  // the item types expected to be used by most users and those that are
+  // synced. See http://crbug.com/130738 and
+  // http://lists.apple.com/archives/apple-cdsa/2006/Jan/msg00025.html .
+  switch (old_attributes_and_data.item_class()) {
+    case kSecInternetPasswordItemClass:
+    case kSecGenericPasswordItemClass:
+      break;
+    default:
+      return;
+  }
+
   // SecKeychainItemCreateFromContent fails if any attribute is zero-length,
   // but old_attributes_and_data can contain zero-length attributes. Create
   // a new attribute list devoid of zero-length attributes.
   //
   // This is awkward: only the logic to build the
   // std::vector<SecKeychainAttribute> is in KCAttributesWithoutZeroLength
   // because the storage used for the new attribute list (the vector) needs to
   // persist through the lifetime of this function.
   // KCAttributesWithoutZeroLength doesn't return a
   // CrSKeychainItemAttributesAndData (which could be held here in a
@@ skipping 40 matching lines @@
   }
 
   return new_attributes;
 }
 
 }  // namespace
 
 }  // namespace mac
 }  // namespace browser
 }  // namespace chrome