9

I'm currently working on automated instalation of Mavericks 10.9. I have NetBoot set up. Everything works OK untill I want to execute Applescript. Since the release of new version I need to manually enable those scripts. Is there a command that I can use in shell script to add app to Assistive Devices list? Or maybe there is some plist that has to be edited for it to work?

  • I'm not totally sure this is what you're seeing, but this article might help: support.apple.com/kb/HT5914 – Jay Thompson Nov 26 '13 at 16:47
  • Thank you for the reply. I also stumbled on this article while I was searching for solution. It is not what I am looking for as this solution still uses GUI interaction. – KarolBerlinski Nov 26 '13 at 18:25
  • @KarolBerlinski What was the workaround you used? I am still trying to figure out how to add an app to the Assistive Devices via command line or a non GUI method. Thanks Abraham – AbsterT Feb 20 '14 at 6:04
10

The settings are stored in /Library/Application Support/com.apple.TCC/TCC.db:

$ sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'
kTCCServiceAccessibility|com.apple.ScriptEditor2|0|1|0|��

kTCCServiceAccessibility|com.red-sweater.FastScripts|0|1|0|��

kTCCServiceAccessibility|com.apple.AccessibilityInspector|0|1|0|��

kTCCServiceAccessibility|com.slate.Slate|0|1|0|��

kTCCServiceAccessibility|com.apple.Automator|0|1|1|
kTCCServiceAccessibility|com.googlecode.iterm2|0|1|1|

The schema, as given by sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db '.schema access', is:

CREATE TABLE access (service TEXT NOT NULL, client TEXT NOT NULL, client_type INTEGER NOT NULL, allowed INTEGER NOT NULL, prompt_count INTEGER NOT NULL, csreq BLOB, CONSTRAINT key PRIMARY KEY (service, client, client_type));

On my installation the last four columns (client_type, allowed, prompt_count, and csreq) are 0|1|0|\xfa\xde\x0c for applications that were added after the "example.app" would like to control this computer using accessibility features dialog was shown and 0|1|1| for applications that I added by dropping them to the list in System Preferences.

~/Library/Preferences/com.apple.universalaccessAuthWarning.plist contains a list of applications for which the warning dialog has been shown:

$ defaults read com.apple.universalaccessAuthWarning
{
    "/Applications/Automator.app" = 1;
    "/Applications/Automator.app/Contents/MacOS/Automator" = 1;
    "/Applications/FastScripts.app" = 1;
    "/Applications/FastScripts.app/Contents/MacOS/FastScripts" = 1;
    "/Applications/Slate.app" = 1;
    "/Applications/Slate.app/Contents/MacOS/Slate" = 1;
    "/Applications/Utilities/AppleScript Editor.app" = 1;
    "/Applications/Utilities/AppleScript Editor.app/Contents/MacOS/AppleScript Editor" = 1;
    "/Applications/Xcode.app/Contents/Applications/Accessibility Inspector.app" = 1;
    "/Applications/Xcode.app/Contents/Applications/Accessibility Inspector.app/Contents/MacOS/Accessibility Inspector" = 1;
    "/Applications/iTerm.app" = 1;
    "/Applications/iTerm.app/Contents/MacOS/iTerm" = 1;
    "/Users/lauri/Desktop/aa.app" = 1;
    "/Users/lauri/Desktop/aa.app/Contents/MacOS/applet" = 1;
    "com.apple.AccessibilityInspector" = 1;
    "com.apple.Automator" = 1;
    "com.apple.ScriptEditor.id.aa" = 1;
    "com.apple.ScriptEditor2" = 1;
    "com.red-sweater.FastScripts" = 1;
    "com.slate.Slate" = 1;
}    

I couldn't figure out how to actually allow access for assistive devices for an application though. I tried for example running these commands:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'insert into access values ("kTCCServiceAccessibility","com.apple.ScriptEditor.id.qq",0,1,0,"'$'\xfa\xde\x0c''");'
defaults write com.apple.universalaccessAuthWarning com.apple.ScriptEditor.id.qq -bool true
defaults write com.apple.universalaccessAuthWarning /Users/lauri/Desktop/qq.app -bool true
defaults write com.apple.universalaccessAuthWarning /Users/lauri/Desktop/qq.app/Contents/MacOS/applet -bool true
sudo killall tccd

I also tried restarting to apply the changes and setting the last four columns to 0,1,1,"".

  • 2
    Thank so much for your feedback. I was able to make a workaround thanks to it. The tccd proccess cannot be killed, only restart will be sufficient here. I start the app that needs Accesssibility, then use sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'update access set allowed=1' and then reboot system. It works. Thanks again (If you need access for one app from list you can add WHERE clause to your sql). – KarolBerlinski Nov 29 '13 at 16:47
  • +1 for great sleuthing. See AbsterT's answer for a working programmatic based on sudo sqlite3 .... ~/Library/Preferences/com.apple.universalaccessAuthWarning.plist is not involved in granting permissions, it only records whether a warning has been shown to avoid annoying users with repeated warnings. – mklement0 May 16 '14 at 20:51
  • 2
    The ?? (\xfa\xde\x0c) value stems from the csreq column, which contains a fingerprint of sorts of the specified app; OSX manages that automatically behind the scenes - no need to ever specify it. The actual value is much longer; the truncation to 3 bytes comes from trying to output the binary value (data type BLOB) as if it were a string, causing output to stop at the first NUL byte (the ? stem from the \xfa and \xde not being valid characters in UTF8 encoding, \x0c is a vertical tab that effectively creates a line break). – mklement0 May 16 '14 at 20:55
  • The csreq column contains the compiled designated requirements for the app, see goo.gl/z10vl and Apple’s TN2206 Code Signing in Depth guide. The designated requirements are essentially a script that validates an app’s identity by checking the bundle ID and certificates. – zoul Mar 25 '15 at 15:00
  • 1
    This technique seems to be used by Dropbox to add Accessibility entitlements without user involvement: applehelpwriter.com/2016/08/29/… – pkamb Sep 9 '16 at 17:55
6

You can also add the file by following the commands below.

This command will find the Bundle Identifier for the application you are trying to add to Assistive Devices.

/usr/libexec/PlistBuddy -c 'Print CFBundleIdentifier' /Applications/enterapplicaitonnamehere.app/Contents/Info.plist

Let's say the application you were trying to add was SKYPE. You would then enter this below:

/usr/libexec/PlistBuddy -c 'Print CFBundleIdentifier' /Applications/Skype.app/Contents/Info.plist

And your bundle identifier would be :

com.skype.skype

You then use this output in the command below:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "REPLACE INTO access VALUES('kTCCServiceAccessibility','',0,1,1,NULL);" 

For Skype it would look like this:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "REPLACE INTO access VALUES('kTCCServiceAccessibility','com.skype.skype',0,1,1,NULL);" 

To remove the application you would use the sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db "delete from access where client='com.skype.skype';"

  • +1, but for robustness it is better to use REPLACE INTO instead of INSERT INTO so as to ensure that the command works even if the database already has an entry for the specified application. – mklement0 May 16 '14 at 20:57
  • @mklement Would that add the application if the application did not already exist in the database? – AbsterT May 19 '14 at 18:58
  • Yes, it would (REPLACE INTO is an alias for the more descriptive INSERT OR REPLACE INTO). – mklement0 May 19 '14 at 19:03
  • 1
    The REPLACE INTO is working perfectly and better than the INSERT INTO. – AbsterT Jun 27 '14 at 14:55
  • Does this method work for executable binaries that are inside a .prefpane Bundle? – jasonology Dec 13 '16 at 22:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .