Building on @d4's answer, the sqlite DB does have the answer for which permission is granted. The
service column will be
kTCCServiceSystemPolicyAllFiles for Full Disk Access.
So the query:
sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
'select client from access where auth_value and service = "kTCCServiceSystemPolicyAllFiles"'
will list out the apps and binaries that are allowed Full Disk Access, i.e.:
(Updated answer based on @Motti Shneor answers, thanks! On their answer they note that auth_value is an int and not a bool, but the
WHERE filter still works.)
If you're interested, you can invert the query to
... where NOT auth_value and service = ... and it will list the apps that are unchecked in the policy dialog.
On older versions of macOS (before 11.6) the
auth_value column was named
allowed so you might need to adjust the query.
If you get the error
Error: unable to open database "/Library/Application Support/com.apple.TCC/TCC.db": authorization denied and any other file operations on the
TCC.db file all fail, your terminal app itself is missing the full disk access permission required to read the DB file. i.e. I can't run the command from vscode but it works from iTerm because that's how my permissions are set up. That's addressed in rdamazio's answer.