11

I make extensive use of Apple Events to control a wide variety of applications on my machine. The new security prompts introduced in Mojave are crippling.

enter image description here

In previous versions of macOS, once an app was granted permission to "control your computer", it was able to send Apple events to any other app on your machine. In Mojave, this permission must be manually granted once for each app being controlled.

Once a user grants access, their selection is stored in one of two sqlite databases:

  1. ~/Library/Application Support/com.apple.TCC/TCC.db
  2. /Library/Application Support/com.apple.TCC/TCC.db

    • Note that #2 is only visible to the root user.
    • Note that System Integrity Protection is disabled.

Would it be possible to edit these sqlite databases directly to automatically grant permissions and bypass these security prompts?

  • @user3439894 Thanks, SIP is already disabled on my machine. It doesn't look like that python program is compatible with Mojave's new "Automation" protection. – Wowfunhappy Oct 13 '18 at 22:53
  • What sends Apple Events to the various apps (i.e how many Foo.app do you have and how many Bar.app do you have and is that matrix sparse or dense?)? Are you OK with a solution that doesn't scale past 3 machines you control (or requires funds at that point)? – bmike Nov 17 '18 at 16:49
  • @bmike My applescripts have lines like "tell application (path to frontmost application as text) to quit", so Bar.app could be any installed app. This is all on a single machine. – Wowfunhappy Nov 17 '18 at 20:10
  • Get it all out of the way in one go: tell app "Finder" to open every application file in the entire contents of (path to applications folder) as alias list. Then repeat with A in the result...ignoring application responses...quit the application named A...end ignoring...end repeat. It'll be painful, but it'll be like ripping a bandaid off. – CJK Nov 18 '18 at 9:41
0

SIP does not support Library directory. So, it means you can still write to the TCC.db file through the terminal by some commands.

Here is the link : About SIP

  • The TCC.db files are protected by SIP even though their directories are not. I don't care regardless—I'd just very much like to know what commands will let me whitelist applications. – Wowfunhappy Oct 15 at 13:23
  • apple.stackexchange.com/questions/362865/… this link may help your query – Saurav Oct 16 at 3:25
2

I found this for deleting an entry.

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/Tcc.db 'delete from access where client like "%appnamehere%"'

Replace "appnamehere" with the name of the app as it appears in the Accessibility list (keep the % signs).

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • 2
    This would remove an app from the database, not add permissions, right? It didn't appear to do anything when I tried it (add or remove). – Wowfunhappy Nov 15 '18 at 18:34
5
+125

To access the TCC.db database directly is no longer supported by Apple, even if you disable SIP, because of their policy of protecting users from big companies that like to track everything you do online, and also used to do this stealthy bypass without asking permission to users. However, even in Mojave, there is a way to circumvent this, but with a catch: that only works if a given computer is enrolled in an MDM program. To know more about the MDM program go here.

In order to bypass this for several computers you can use the python script tccprofile.py available at GitHub.

An in-depth discussion of what you can and cannot do can be found here.

As far as I know, this is the only way to bypass the need to ask user permission from Mojave onwards.

  • It really isn't practical to obtain an MDM profile for my own personal scripts. With SIP disabled, what exactly is preventing me from editing the database? I recognize that the system itself can't be directly turned off, but without SIP I should be able to edit any file on my computer, including the database that stores all the whitelists. – Wowfunhappy Nov 15 '18 at 3:08
  • 1
    Apparently, Apple changed the way it accesses this database by using the private API guarded_open_np. I already saw some posts of Russian hackers trying to reverse engineer this API with IDA Pro, but so far without great success. – jvarela Nov 15 '18 at 3:27
  • Regardless of how Apple would normally edit the whitelist, it appears to be a standard sqlite database, as evidenced by the fact that it can be opened and read in database editors. If there is another reason why the file is impossible to directly edit and replace (for example, if macOS stores a checksum of the databse, and that checksum is itself encrypted by Apple), I would like to see a clear and comprehensive explanation of this in your answer! Thank you. – Wowfunhappy Nov 15 '18 at 3:44
  • 1
    +1, but I don't trust blogs. Can we take the content from that website and quote it directly or add it to drive or something like that? – JBis Nov 16 '18 at 2:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .