16

I make extensive use of Apple Events to control a wide variety of applications on my machine. The new security prompts introduced in Mojave are crippling.

enter image description here

In previous versions of macOS, once an app was granted permission to "control your computer", it was able to send Apple events to any other app on your machine. In Mojave, this permission must be manually granted once for each app being controlled.

Once a user grants access, their selection is stored in one of two sqlite databases:

  1. ~/Library/Application Support/com.apple.TCC/TCC.db

  2. /Library/Application Support/com.apple.TCC/TCC.db

    • Note that #2 is only visible to the root user.
    • Note that System Integrity Protection is disabled.

Would it be possible to edit these sqlite databases directly to automatically grant permissions and bypass these security prompts?

Improve this question
4
  • @user3439894 Thanks, SIP is already disabled on my machine. It doesn't look like that python program is compatible with Mojave's new "Automation" protection.
    – Wowfunhappy
    Oct 13, 2018 at 22:53
  • What sends Apple Events to the various apps (i.e how many Foo.app do you have and how many Bar.app do you have and is that matrix sparse or dense?)? Are you OK with a solution that doesn't scale past 3 machines you control (or requires funds at that point)?
    – bmike ♦
    Nov 17, 2018 at 16:49
  • @bmike My applescripts have lines like "tell application (path to frontmost application as text) to quit", so Bar.app could be any installed app. This is all on a single machine.
    – Wowfunhappy
    Nov 17, 2018 at 20:10
  • Get it all out of the way in one go: tell app "Finder" to open every application file in the entire contents of (path to applications folder) as alias list. Then repeat with A in the result...ignoring application responses...quit the application named A...end ignoring...end repeat. It'll be painful, but it'll be like ripping a bandaid off.
    – CJK
    Nov 18, 2018 at 9:41

3 Answers 3

Reset to default
9
+125

To access the TCC.db database directly is no longer supported by Apple, even if you disable SIP, because of their policy of protecting users from big companies that like to track everything you do online, and also used to do this stealthy bypass without asking permission to users. However, even in Mojave, there is a way to circumvent this, but with a catch: that only works if a given computer is enrolled in an MDM program. To know more about the MDM program go here.

In order to bypass this for several computers you can use the python script tccprofile.py available at GitHub.

As far as I know, this is the only way to bypass the need to ask user permission from Mojave onwards.

Improve this answer
4
  • 1
    It really isn't practical to obtain an MDM profile for my own personal scripts. With SIP disabled, what exactly is preventing me from editing the database? I recognize that the system itself can't be directly turned off, but without SIP I should be able to edit any file on my computer, including the database that stores all the whitelists.
    – Wowfunhappy
    Nov 15, 2018 at 3:08
  • 2
    Apparently, Apple changed the way it accesses this database by using the private API guarded_open_np. I already saw some posts of Russian hackers trying to reverse engineer this API with IDA Pro, but so far without great success.
    – jvarela
    Nov 15, 2018 at 3:27
  • Regardless of how Apple would normally edit the whitelist, it appears to be a standard sqlite database, as evidenced by the fact that it can be opened and read in database editors. If there is another reason why the file is impossible to directly edit and replace (for example, if macOS stores a checksum of the databse, and that checksum is itself encrypted by Apple), I would like to see a clear and comprehensive explanation of this in your answer! Thank you.
    – Wowfunhappy
    Nov 15, 2018 at 3:44
  • 1
    +1, but I don't trust blogs. Can we take the content from that website and quote it directly or add it to drive or something like that?
    – JBis
    Nov 16, 2018 at 2:28
2

I found this for deleting an entry.

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/Tcc.db 'delete from access where client like "%appnamehere%"'

Replace "appnamehere" with the name of the app as it appears in the Accessibility list (keep the % signs).

Improve this answer
5
  • 2
    This would remove an app from the database, not add permissions, right? It didn't appear to do anything when I tried it (add or remove).
    – Wowfunhappy
    Nov 15, 2018 at 18:34
  • 1
    In Catalina you inexplicably can't even see the file as root... Error: unable to open database "/Library/Application Support/com.apple.TCC/TCC.db": unable to open database file, and if I try to ls the directory as root I get ls: : Operation not permitted.
    – Michael
    Mar 22, 2020 at 0:35
  • @Michael was you able to read TCC.db on Catalina? I have the same problem as well, can't even do ls in com.apple.TCC directory
    – AbstractVoid
    Mar 26, 2020 at 17:50
  • 1
    @WallTearer Yes, I have to enable full access to the filesystem to Terminal and/or /bin/bash under security and privacy in System Preferences
    – Michael
    Mar 26, 2020 at 17:56
  • @Michael cool, thank you! At the same moment I was also reading following article with similar suggestion to enable Full Disk Access - blog.kolide.com/macos-catalina-osquery-a6753dc3c35c In the end I granted access to iTerm2 and was able to read security settings with tccutil.py utility like sudo tccutil --list (github.com/jacobsalmela/tccutil)
    – AbstractVoid
    Mar 26, 2020 at 18:16
0

SIP does not support Library directory. So, it means you can still write to the TCC.db file through the terminal by some commands.

Here is the link : About SIP

Improve this answer
2
  • The TCC.db files are protected by SIP even though their directories are not. I don't care regardless—I'd just very much like to know what commands will let me whitelist applications.
    – Wowfunhappy
    Oct 15, 2019 at 13:23
  • apple.stackexchange.com/questions/362865/… this link may help your query
    – Saurav_Sharma
    Oct 16, 2019 at 3:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .