11

Is there a Terminal command to view a list of all macOS that are authorized and unauthorized but have asked for Full Access?

I am looking for the list that is displayed under System Preferences → Security & Privacy → Privacy → Full Disk Access, but via command-line.

6

The sqlite queries mentioned DO work, e.g.:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'

The trick, however, is that you need full-disk access to access that SQLite database, so depending on where you're trying to do this, it's a chicken-and-egg problem. For just testing purposes, you can give your terminal full-disk access, then you'll be able to run the command.

2
  • How exactly do you give your terminal full disk access, anyway???
    – Michael
    Mar 22 '20 at 0:37
  • 1
    @Michael System Preferences → Security & Privacy → Privacy → Full Disk Access
    – Carl Walsh
    Aug 1 '20 at 1:01
4

Apps that have requested and been granted Security > Privacy permissions can be read via:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'

However, this does not specify which permissions were granted.

There's also:

defaults read ~/Library/Preferences/com.apple.universalaccessAuthWarning.plist

..but this will only indicate whether a given app was approved or denied.

Taccy is a small utility that will list which permissions an app will request, even if it has not been launched yet:

https://eclecticlight.co/taccy-signet-precize-alifix-utiutility-alisma/

4
  • thanks. The first command line I receive the following error message: Error: unable to open database "/Library/Application Support/com.apple.TCC/TCC.db": unable to open database file Instead the second command I do see one application listed but I know for sure I have more than one. Jun 21 '19 at 18:40
  • 2
    sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' doesn't seem to work for me either. sudo ls "/Library/Application Support/com.apple.TCC" also gives ls: com.apple.TCC: Operation not permitted, thou the directory is definitely there Jul 7 '19 at 10:06
  • @da4 Aware of whether there's a way to programmatically check which apps have Automation access? And, is there a way to programmatically grant such permissions when Full Disk Access is enabled?
    – Zack Burt
    Feb 9 '20 at 3:18
  • strangely this doesn't seem to contain camera permissions... any idea where that is?
    – Michael
    Mar 22 '20 at 5:36
2

Fabio Viola use this command :

sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" 'UPDATE access SET allowed = "1";'

1 is for granting access and 0 is for declining access. I hope this may work.

1
  • !!! This doesn't answer OP's question. It's literally the same as scrolling through the dialog and checking everything unchecked. If your app isn't in the list, it won't help.
    – Carl Walsh
    Aug 1 '20 at 1:04
2

Building on @d4's answer, the sqlite DB does have the answer for which permission is granted. The service column will be kTCCServiceSystemPolicyAllFiles for Full Disk Access.

So the query:

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  'select client from access where allowed and service = "kTCCServiceSystemPolicyAllFiles"'

will list out the apps and binaries that are allowed Full Disk Access, i.e.:

/usr/libexec/atrun
/usr/sbin/sshd
com.googlecode.iterm2

If you're interested, you can invert the query to ... where NOT allowed and service = ... and it will list the apps that are unchecked in the policy dialog.

3
  • which macOS version are you using?
    – anki
    Aug 1 '20 at 6:42
  • @anki version 10.15.6
    – Carl Walsh
    Aug 3 '20 at 18:27
  • Then this won't work due to SIP even if you take the db file out in some other folder. One has to give the terminal full disk access first. See apple.stackexchange.com/a/383651/313842.
    – anki
    Aug 3 '20 at 18:54
1

The database

"/Library/Application Support/com.apple.TCC/TCC.db"

is protected via SIP on Mojave and cannot be opened by the command given in this answer unless you give full disk access to the Terminal app itself as noted in this answer.

I copied the file in a test folder and then opened it using a GUI app: DB browser for sqlite.app. You may use other apps too if you want.

Not affiliated with the app.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .