23

A new security feature in Mojave revolves around a system dialogue that prompts you to grant access to apps that want to control other apps, such as Finder (I'm finding frequently happening with some apps like Epichrome):

image

Is there a known way to disable this or to allow certain destination (controlled apps) to always allow such activity?

I do believe that this behavior has changed markedly from the previous OS releases with regards to just using the "Accessibility" tab to simply allow an application to make system changes.

Here is the new panel: image

Improve this question
6
  • Would it be possible to edit the tcc sqlite databases directly (~/Library/Application Support/com.apple.TCC/TCC.db and /Library/Application Support/com.apple.TCC/TCC.db, the latter of which is only available to the root user) in order to grant an app blanket permissions?
    – Wowfunhappy
    Oct 12, 2018 at 22:43
  • That's an interesting question. I think it warrants a question in and of itself. If you post it, let me know as I'd like to follow it or if you don't want to I could post it since it seems different enough to warrant it @Wowfunhappy...
    – ylluminate
    Oct 13, 2018 at 16:32
  • 1
    Done. I had originally thought they would be too similar, but I took your advice! (I hope you don't mind that I reused your screenshot!) apple.stackexchange.com/questions/339509/…
    – Wowfunhappy
    Oct 13, 2018 at 21:50
  • 1
    Don't have time to fully investigate atm, but I believe the key to actually doing this lies in /System/Library/Sandbox/TCC_Compatibility.bundle/Contents/Resources/AllowedApplicationsList.plist, which contains a list of software Apple allows to send Apple Events without prompts. Protected by SIP, of course, so you'd have to disable that. See also: eclecticlight.co/2018/11/20/…
    – Wowfunhappy
    Nov 12, 2019 at 19:28
  • @Wowfunhappy this is extremely interesting... Thanks for finding this. I too don't have time to dig into this atm, but it's extremely promising.
    – ylluminate
    Nov 14, 2019 at 1:53

5 Answers 5

Reset to default
11

Add the app to "Full Disk Access"

In Mojave, under Security & Privacy, there is a new tab called "Full Disk Access".

Adding my personal Applescript apps to this list (in addition to the existing Accessibility list) has made the prompts disappear.

Update 9/26: Upon a couple days of further use, this seems to work sometimes, but not consistently. 🙁

Improve this answer
3
  • 3
    You may need to add the Applescript app to Security & Privacy - Accessibility
    – Chris Yim
    Oct 29, 2018 at 8:51
  • @ErickYim Nope, that doesn't work consistently in Mojave. :(
    – Wowfunhappy
    Oct 29, 2018 at 14:09
  • 1
    This solution keeps getting upvoted, and while I very much appreciate the rep, to be clear, the answer does not work with the specific type of prompt in the OP. At first, it seemed to sometimes prevent some prompts, but that might have been the placebo effect. And actually, at this point, I think it was probably the placebo effect.
    – Wowfunhappy
    Mar 8, 2019 at 1:04
3

You need to allow programs that will control your computer access through security preferences. Go to System preferences/ security and privacy/ privacy - accessibility and add Finder.app and "SOME_APP_NAME" to the list of programs allowed to control your computer.

enter image description here

Improve this answer
6
  • Thank you, unfortunately I believe this behavior has markedly changed now as per my edit above that you'll now see.
    – ylluminate
    Sep 7, 2018 at 15:42
  • 2
    Do you have an Apple developer account? If you do then you can code sign your AppleScript applications. If your AppleScript application is code signed, that may eliminate a lot of your problems . i.imgur.com/oL3xZ2d.png I code sign all of my AppleScript applications, and as long as I don't have persistent properties set, code signing my scripts and apps usually bypasses the hassle of gatekeeper
    – wch1zpink
    Sep 7, 2018 at 15:50
  • That's a really good idea @wch1zpink! That had not crossed my mind, thanks.
    – ylluminate
    Sep 7, 2018 at 16:13
  • This isn't 100% clear in the question—while this panel still exists under Mojave, it does not have the desired affect. Super, super, super annoying! These are apps that I wrote for use on my own computer. I can't pay for a developer account just for them!
    – Wowfunhappy
    Sep 25, 2018 at 13:53
  • 1
    @wch1zpink I didn't realize free accounts could sign mac apps in a way that lets them through Gatekeeper. Regardless, it apparently doesn't apply in this situation, since in Mojave the dialogue still appears for signed apps.
    – Wowfunhappy
    Sep 27, 2018 at 1:02
1

We have the same issue one user is being prompted for authorisation for "BASH" to run and "RC", The problem is we are unsure of the origin of the apps.

After poking around in activity monitor I've found whats using them and have allowed them to run the pop ups haven't reoccurred since.

Improve this answer
1

The answer to the "Permanently grant right to control another app to Apple Script App" Q&A solved this exact issue for me in Mojave:

Lock the file/script/application being executed.

Instant fix for me, no more prompts!

Improve this answer
1
  • The linked answer doesn't "work". It prevents the application from modifying itself. This means you are preventing an aspect of the program from working. This may well be desired, however doing so will cause unexpected behaviour in the application.
    – Sancarn
    May 10, 2021 at 1:08
0

In the past we've used the following terminal command to give the user the ability to "Allow apps from anywhere" and this eliminated the need to add apps to Accessibility:

sudo spctl --master-disable

That has worked great with Sierra and High Sierra but this new Automation tab in Mojave (installed public release today) seems to be working differently. Even with the above terminal change we are being prompted to allow all of our apps to control Finder and System Events. Though, I've found other code signed applications, like Adobe Bridge, have to prompt with this same message as well. Not sure if there is a way around it.

I'm hoping that accepting each dialog once will prevent the message from appearing again with future app updates that we send out. Will be testing that out now. Otherwise will have to test out the developer/code signed route.

Improve this answer
2
  • I'm guessing that someone thought this sounds like a serious security hazard.
    – keithcurtis
    Dec 19, 2018 at 20:30
  • 1
    I am the one who downvoted this. It has nothing to do with the question, which was specifically regarding the new Apple Event sandbox dialogs that are both unrelated to Gatekeeper and exclusive to Mojave.
    – Wowfunhappy
    Jan 27, 2019 at 21:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .