24

In macOS Catalina, is it possible to add apps directly to Security & Privacy -> Files and Folders? The plus icon is greyed out, even when the preference pane is unlocked.

Image showing Files and Folders window with plus sign greyed out

I know that the option becomes available when an app tries to access one of the protected folders, but I would like to add an app pre-emptively.

5
  • 2
    This instruction says that you can add it with the + button under the app list, or just drag & drop it from the Applications folder. But none of that works for me. Meanwhile, the instruction shows a screenshot with a greyed-out button. Jan 7 '20 at 15:00
  • I've been filing Bug Reports on the lack of controls in Sys Prefs since Catalina came out.
    – benwiggy
    Apr 6 '20 at 14:07
  • @benwiggy has anyone tried using the root user of their mac? support.apple.com/en-us/HT204012 Apr 7 '20 at 18:52
  • @FBISurveillanceVan Yes, I have. And no, it does not help. Dec 16 '20 at 20:27
  • @bonh just a side tip regarding screenshots: see support.apple.com/en-us/HT201361How to capture a window or menu. Could be useful for you in the future :)
    – WhatHiFi
    Apr 1 at 6:30
2
+50

This is possible for MDM managed Macs by pushing signed profiles to preemptively white-list signed applications.

The process is quite detailed, but it uses a well documented profile setup (175 pages to cover the basics). We currently push about 20 items this way, so if you need to manage a lot of apps and a lot of Macs, this is possible and once you have your tools in place, easy to add new profiles. This isn’t feasible for a few machines if you’re not running a MDM.

Look at the section on page 64

> Privacy Preferences Policy Control Payload

The Privacy Preferences payload is designated by specifying com.apple.TCC.configuration-profile-policy value as the PayloadType value. It controls the settings that are displayed in the ”Privacy” tab of the ”Security & Privacy” pane in System Preferences. This profile must be delivered via a user approved MDM server in a device profile.

Here is a very not short (but as short as can be reasonably made) guide for an engineer or team thinking about adding this to your MDM.

Here is an awesome tool for automating creation of your profiles:

3
  • 1
    Thanks for this info, but of course there's a big "only if you're doing MDM" caveat, which sadly isn't the case. There's no way of setting the TCC config without that?
    – benwiggy
    Apr 6 '20 at 8:15
  • 1
    Apple very intentionally locked this down hard. Even with MDM - each user has to manually approve this control. My feeling is Apple did not want anyone that has a home mac getting hoodwinked into losing their privacy. This friction is very much intentional requiring a very clear opt in, @benwiggy
    – bmike
    Apr 6 '20 at 12:59
  • @benwiggy you can get started with MDM for free at jamf.com/products/jamf-now
    – bmike
    Apr 10 '20 at 18:55
2

Another answer elsewhere points to a new utility: https://github.com/jslegendre/tccplus

It does require SIP (and AMFI) to be disabled, but it may be the best hope.

5
  • What’s AMFI stand for?
    – bmike
    Apr 6 '20 at 12:59
  • 2
    eclecticlight.co/2018/12/29/…
    – benwiggy
    Apr 6 '20 at 13:26
  • Thank you! I like to think I’m very familiar with Howard’s log and tool and devote a ton of time to try to keep up, there’s just so much to know these days. Literally have never seen that string until today
    – bmike
    Apr 6 '20 at 13:51
  • @bmike Me neither! ;-) I'm actually seriously worried about Apple's security. I only just found out that completely forbidding non-signed apps (i.e. non-paying devs) is on their future roadmap.
    – benwiggy
    Apr 6 '20 at 14:09
  • I wouldn’t sweat it. Notarized apps are about to become as easy as getting an ssl certificate. It’s like, who runs code that allows anyone to tamper with it. The default for people that actually ship code is changing, not locking down individuals.
    – bmike
    Apr 6 '20 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .