macOS: List apps authorized for full disk access

Question

Is there a Terminal command to view a list of all macOS that are authorized and unauthorized but have asked for Full Access?

I am looking for the list that is displayed under System Preferences → Security & Privacy → Privacy → Full Disk Access, but via command-line.

Answer 1

Building on @d4's answer, the sqlite DB does have the answer for which permission is granted. The service column will be kTCCServiceSystemPolicyAllFiles for Full Disk Access.

So the query:

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"'

will list out the apps and binaries that are allowed Full Disk Access, i.e.:

/usr/libexec/atrun
/usr/sbin/sshd
com.googlecode.iterm2

(Updated answer based on @Motti Shneor answers, thanks! On their answer they note that auth_value is an int and not a bool, but the WHERE filter still works.)

---

If you're interested, you can invert the query to ... where NOT auth_value and service = ... and it will list the apps that are unchecked in the policy dialog.

---

On older versions of macOS (before 11.6) the auth_value column was named allowed so you might need to adjust the query.

---

If you get the error Error: unable to open database "/Library/Application Support/com.apple.TCC/TCC.db": authorization denied and any other file operations on the TCC.db file all fail, your terminal app itself is missing the full disk access permission required to read the DB file. i.e. I can't run the command from vscode but it works from iTerm because that's how my permissions are set up. That's addressed in rdamazio's answer.

Answer 2

The sqlite queries mentioned DO work, e.g.:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'

The trick, however, is that you need full-disk access to access that SQLite database, so depending on where you're trying to do this, it's a chicken-and-egg problem. For just testing purposes, you can give your terminal full-disk access, then you'll be able to run the command.

Answer 3

Apps that have requested and been granted Security > Privacy permissions can be read via:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'

However, this does not specify which permissions were granted.

There's also:

defaults read ~/Library/Preferences/com.apple.universalaccessAuthWarning.plist

..but this will only indicate whether a given app was approved or denied.

Taccy is a small utility that will list which permissions an app will request, even if it has not been launched yet:

https://eclecticlight.co/taccy-signet-precize-alifix-utiutility-alisma/

Answer 4

Fabio Viola use this command :

sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" 'UPDATE access SET allowed = "1";'

1 is for granting access and 0 is for declining access. I hope this may work.

Answer 5

The database

"/Library/Application Support/com.apple.TCC/TCC.db"

is protected via SIP on Mojave and cannot be opened by the command given in this answer unless you give full disk access to the Terminal app itself as noted in this answer.

I copied the file in a test folder and then opened it using a GUI app: DB browser for sqlite.app. You may use other apps too if you want.

Not affiliated with the app.

Answer 6

following previous good answers, that are regretfully outdated, I looked at a modern MacOS (Monterey 12.0.1) version of the TCC database, and finally found the following command:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select client,auth_value from access where service = "kTCCServiceSystemPolicyAllFiles"'

to provide all the info OP asked for. All apps (and also non-app processes) who asked for full-disk-access appear in the list. Those without permissions, have the value '0' in their auth_value column, while those with permission - got '2' in that column.

Connecting the dots to previous answers - the old allowed column was replaced by the auth_value column in the TCC.db schema, and it is no longer a Boolean, rather an integer - whose values (other than 0 and 2) I do not know.

As others mentioned to run this, you must first provide full-disk-access permissions to the terminal app (or whatever app you're using to run this command from) Hope this helps out anyone...