13

Is there a Terminal command to view a list of all macOS that are authorized and unauthorized but have asked for Full Access?

I am looking for the list that is displayed under System Preferences → Security & Privacy → Privacy → Full Disk Access, but via command-line.

6 Answers 6

6

The sqlite queries mentioned DO work, e.g.:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'

The trick, however, is that you need full-disk access to access that SQLite database, so depending on where you're trying to do this, it's a chicken-and-egg problem. For just testing purposes, you can give your terminal full-disk access, then you'll be able to run the command.

2
  • How exactly do you give your terminal full disk access, anyway???
    – Michael
    Mar 22, 2020 at 0:37
  • 1
    @Michael System Preferences → Security & Privacy → Privacy → Full Disk Access
    – Carl Walsh
    Aug 1, 2020 at 1:01
6

Building on @d4's answer, the sqlite DB does have the answer for which permission is granted. The service column will be kTCCServiceSystemPolicyAllFiles for Full Disk Access.

So the query:

sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"'

will list out the apps and binaries that are allowed Full Disk Access, i.e.:

/usr/libexec/atrun
/usr/sbin/sshd
com.googlecode.iterm2

(Updated answer based on @Motti Shneor answers, thanks! On their answer they note that auth_value is an int and not a bool, but the WHERE filter still works.)


If you're interested, you can invert the query to ... where NOT auth_value and service = ... and it will list the apps that are unchecked in the policy dialog.


On older versions of macOS (before 11.6) the auth_value column was named allowed so you might need to adjust the query.


If you get the error Error: unable to open database "/Library/Application Support/com.apple.TCC/TCC.db": authorization denied and any other file operations on the TCC.db file all fail, your terminal app itself is missing the full disk access permission required to read the DB file. i.e. I can't run the command from vscode but it works from iTerm because that's how my permissions are set up. That's addressed in rdamazio's answer.

0
5

Apps that have requested and been granted Security > Privacy permissions can be read via:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access'

However, this does not specify which permissions were granted.

There's also:

defaults read ~/Library/Preferences/com.apple.universalaccessAuthWarning.plist

..but this will only indicate whether a given app was approved or denied.

Taccy is a small utility that will list which permissions an app will request, even if it has not been launched yet:

https://eclecticlight.co/taccy-signet-precize-alifix-utiutility-alisma/

4
  • thanks. The first command line I receive the following error message: Error: unable to open database "/Library/Application Support/com.apple.TCC/TCC.db": unable to open database file Instead the second command I do see one application listed but I know for sure I have more than one. Jun 21, 2019 at 18:40
  • 2
    sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' doesn't seem to work for me either. sudo ls "/Library/Application Support/com.apple.TCC" also gives ls: com.apple.TCC: Operation not permitted, thou the directory is definitely there Jul 7, 2019 at 10:06
  • @da4 Aware of whether there's a way to programmatically check which apps have Automation access? And, is there a way to programmatically grant such permissions when Full Disk Access is enabled?
    – Zack Burt
    Feb 9, 2020 at 3:18
  • strangely this doesn't seem to contain camera permissions... any idea where that is?
    – Michael
    Mar 22, 2020 at 5:36
2

Fabio Viola use this command :

sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" 'UPDATE access SET allowed = "1";'

1 is for granting access and 0 is for declining access. I hope this may work.

1
  • !!! This doesn't answer OP's question. It's literally the same as scrolling through the dialog and checking everything unchecked. If your app isn't in the list, it won't help.
    – Carl Walsh
    Aug 1, 2020 at 1:04
1

The database

"/Library/Application Support/com.apple.TCC/TCC.db"

is protected via SIP on Mojave and cannot be opened by the command given in this answer unless you give full disk access to the Terminal app itself as noted in this answer.

I copied the file in a test folder and then opened it using a GUI app: DB browser for sqlite.app. You may use other apps too if you want.

Not affiliated with the app.

1
  • If you could you "copy the file" out of the SIP protected folder, you could probably read it with "readonly" permissions too... you should only fail to modify it in any way not read it. Dec 26, 2021 at 9:59
0

following previous good answers, that are regretfully outdated, I looked at a modern MacOS (Monterey 12.0.1) version of the TCC database, and finally found the following command:

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select client,auth_value from access where service = "kTCCServiceSystemPolicyAllFiles"'

to provide all the info OP asked for. All apps (and also non-app processes) who asked for full-disk-access appear in the list. Those without permissions, have the value '0' in their auth_value column, while those with permission - got '2' in that column.

Connecting the dots to previous answers - the old allowed column was replaced by the auth_value column in the TCC.db schema, and it is no longer a Boolean, rather an integer - whose values (other than 0 and 2) I do not know.

As others mentioned to run this, you must first provide full-disk-access permissions to the terminal app (or whatever app you're using to run this command from) Hope this helps out anyone...

3
  • In macOS Catalina this returns Error: no such column: auth_value. Also in macOS Monterey this errors unless at least one application currently has full disk access in the list of applications under Full Disk Access. Thus IMO making this not reliable or useful. Dec 26, 2021 at 12:57
  • Nice! I updated any stale info in my outdated answer, but feel free to edit it with anything more you know about the int. BTW I don't need to use sudo on my machine giving the terminal app has full disk access. (On a different terminal, sudo doesn't help.) If not needed I always prefer not using sudo.
    – Carl Walsh
    Dec 26, 2021 at 17:14
  • @user3439894 I'm trying to keep the versions and column names straight here
    – Carl Walsh
    Dec 26, 2021 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .