15

In macOS Catalina, is it possible to add apps directly to Security & Privacy -> Files and Folders? The plus icon is greyed out, even when the preference pane is unlocked.

Image showing Files and Folders window with plus sign greyed out

I know that the option becomes available when an app tries to access one of the protected folders, but I would like to add an app pre-emptively.

  • 1
    This instruction says that you can add it with the + button under the app list, or just drag & drop it from the Applications folder. But none of that works for me. Meanwhile, the instruction shows a screenshot with a greyed-out button. – stack-delay Jan 7 at 15:00
  • I've been filing Bug Reports on the lack of controls in Sys Prefs since Catalina came out. – benwiggy Apr 6 at 14:07
  • @benwiggy has anyone tried using the root user of their mac? support.apple.com/en-us/HT204012 – FBI Surveillance Van Apr 7 at 18:52
2
+50

This is possible for MDM managed Macs by pushing signed profiles to preemptively white-list signed applications.

The process is quite detailed, but it uses a well documented profile setup (175 pages to cover the basics). We currently push about 20 items this way, so if you need to manage a lot of apps and a lot of Macs, this is possible and once you have your tools in place, easy to add new profiles. This isn’t feasible for a few machines if you’re not running a MDM.

Look at the section on page 64

> Privacy Preferences Policy Control Payload

The Privacy Preferences payload is designated by specifying com.apple.TCC.configuration-profile-policy value as the PayloadType value. It controls the settings that are displayed in the ”Privacy” tab of the ”Security & Privacy” pane in System Preferences. This profile must be delivered via a user approved MDM server in a device profile.

Here is a very not short (but as short as can be reasonably made) guide for an engineer or team thinking about adding this to your MDM.

Here is an awesome tool for automating creation of your profiles:

| improve this answer | |
  • 1
    Thanks for this info, but of course there's a big "only if you're doing MDM" caveat, which sadly isn't the case. There's no way of setting the TCC config without that? – benwiggy Apr 6 at 8:15
  • 1
    Apple very intentionally locked this down hard. Even with MDM - each user has to manually approve this control. My feeling is Apple did not want anyone that has a home mac getting hoodwinked into losing their privacy. This friction is very much intentional requiring a very clear opt in, @benwiggy – bmike Apr 6 at 12:59
  • @benwiggy you can get started with MDM for free at jamf.com/products/jamf-now – bmike Apr 10 at 18:55
2

Another answer elsewhere points to a new utility: https://github.com/jslegendre/tccplus

It does require SIP (and AMFI) to be disabled, but it may be the best hope.

| improve this answer | |
  • What’s AMFI stand for? – bmike Apr 6 at 12:59
  • 2
  • Thank you! I like to think I’m very familiar with Howard’s log and tool and devote a ton of time to try to keep up, there’s just so much to know these days. Literally have never seen that string until today – bmike Apr 6 at 13:51
  • @bmike Me neither! ;-) I'm actually seriously worried about Apple's security. I only just found out that completely forbidding non-signed apps (i.e. non-paying devs) is on their future roadmap. – benwiggy Apr 6 at 14:09
  • I wouldn’t sweat it. Notarized apps are about to become as easy as getting an ssl certificate. It’s like, who runs code that allows anyone to tamper with it. The default for people that actually ship code is changing, not locking down individuals. – bmike Apr 6 at 15:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .