I've got a bit of applescript that I wrote that presses a couple window buttons on screen for me. On use, I get a pop-up saying I need to grant permissions in 'Security & Privacy -> Accessibility'. The checkbox to enable permissions does not work; it's not greyed out, it just doesn't take. bundle added, but no apparent effect when clicking checkbox

My understanding is that the TCC.db is the underlying implementation of the Accessibility permissions. This is what the 'access' table looks like immediately after I attempt to launch the app: $ sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" 'select * from access' kTCCServiceAccessibility|com.company.applet|0|0|1||

Here's what the table looks like after I try to click the checkbox to enable permissions: $ sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" 'select * from access' kTCCServiceAccessibility|com.company.applet|0|0|1|| kTCCServiceAccessibility|/Users/luser/Applications/applet.app|1|1|1||

From this, my theory is that the accessibility permission mechanism is seeing the app as two different names -- com.company.applet vs install path. But I don't know enough about macOS to proceed with troubleshooting. Can anyone help me understand what's going on? Does anyone have ideas on how to get this working?


Additional details:

My build process is to feed my applescript into osacompile, which generates the ~/Applications/applet.app bundle. I then manually add CFBundleIdentifier with /usr/libexec/PlistBuddy -c 'Add :CFBundleIdentifier string "com.company.applet"' ~/Applications/applet.app/Contents/Info.plist. If I leave out the plist CFBundleIdentifier update, the application still fails the accessibility check.

I can build the bundle in Script Editor and everything works. However, this is not a desirable long-term solution; as I want to keep everything in version control. The generated artifacts from Script Editor are binary, and thus unsuitable for git.

Finally, it looks like in previous versions of macOS, I could have modified TCC.db directly, but now all my writes fail -- elsewhere, I've seen this attributed to SIP. I don't want to disable SIP.

  • Welcome to Ask Different! This is a well written question and deserves and up vote before I ask some questions, +1. Does it make and difference if you use defaults to write the CFBundleIdentifier? Also, just as a test, if after creating the app the way you prefer, if you just open it in Script Editor, hit Compile and then Save, and close it before adding it to System Preferences > Security & Privacy > Privacy > Accessibility, does it then allow it to be checked without issue? – user3439894 Sep 29 '17 at 19:18
  • Thanks for the response! Using Defaults does not make a difference; the permissions are not enabled. Compiling&saving with Script Editor also offers no magic fix. Intriguingly, the application stops appearing at all in the TCC.db database after this. I should also note that defaults read fails to find the application by domain (i.e. com.company.applet) -- and wow, comments are limited; thus the many edits. – Hefeweizen Sep 29 '17 at 20:49

You must log in to answer this question.

Browse other questions tagged .