31

In macOS Catalina, is it possible to add apps directly to Security & Privacy -> Files and Folders? The plus icon is greyed out, even when the preference pane is unlocked.

Image showing Files and Folders window with plus sign greyed out

I know that the option becomes available when an app tries to access one of the protected folders, but I would like to add an app pre-emptively.

Improve this question
6
  • 5
    This instruction says that you can add it with the + button under the app list, or just drag & drop it from the Applications folder. But none of that works for me. Meanwhile, the instruction shows a screenshot with a greyed-out button.
    – stack-delay
    Commented Jan 7, 2020 at 15:00
  • I've been filing Bug Reports on the lack of controls in Sys Prefs since Catalina came out.
    – benwiggy
    Commented Apr 6, 2020 at 14:07
  • @benwiggy has anyone tried using the root user of their mac? support.apple.com/en-us/HT204012
    – FBI Surveillance Van
    Commented Apr 7, 2020 at 18:52
  • 1
    @FBISurveillanceVan Yes, I have. And no, it does not help.
    – Nanashi No Gombe
    Commented Dec 16, 2020 at 20:27
  • @bonh just a side tip regarding screenshots: see support.apple.com/en-us/HT201361 → How to capture a window or menu. Could be useful for you in the future :)
    – WhatHiFi
    Commented Apr 1, 2021 at 6:30

4 Answers 4

Reset to default
2
+50

This is possible for MDM managed Macs by pushing signed profiles to preemptively white-list signed applications.

The process is quite detailed, but it uses a well documented profile setup (175 pages to cover the basics). We currently push about 20 items this way, so if you need to manage a lot of apps and a lot of Macs, this is possible and once you have your tools in place, easy to add new profiles. This isn’t feasible for a few machines if you’re not running a MDM.

Look at the section on page 64

> Privacy Preferences Policy Control Payload

The Privacy Preferences payload is designated by specifying com.apple.TCC.configuration-profile-policy value as the PayloadType value. It controls the settings that are displayed in the ”Privacy” tab of the ”Security & Privacy” pane in System Preferences. This profile must be delivered via a user approved MDM server in a device profile.

Here is a very not short (but as short as can be reasonably made) guide for an engineer or team thinking about adding this to your MDM.

Here is an awesome tool for automating creation of your profiles:

Improve this answer
3
  • 1
    Thanks for this info, but of course there's a big "only if you're doing MDM" caveat, which sadly isn't the case. There's no way of setting the TCC config without that?
    – benwiggy
    Commented Apr 6, 2020 at 8:15
  • 2
    Apple very intentionally locked this down hard. Even with MDM - each user has to manually approve this control. My feeling is Apple did not want anyone that has a home mac getting hoodwinked into losing their privacy. This friction is very much intentional requiring a very clear opt in, @benwiggy
    – bmike ♦
    Commented Apr 6, 2020 at 12:59
  • @benwiggy you can get started with MDM for free at jamf.com/products/jamf-now
    – bmike ♦
    Commented Apr 10, 2020 at 18:55
2

Another answer elsewhere points to a new utility: https://github.com/jslegendre/tccplus

It does require SIP (and AMFI) to be disabled, but it may be the best hope.

Improve this answer
5
  • What’s AMFI stand for?
    – bmike ♦
    Commented Apr 6, 2020 at 12:59
  • 2
    eclecticlight.co/2018/12/29/…
    – benwiggy
    Commented Apr 6, 2020 at 13:26
  • Thank you! I like to think I’m very familiar with Howard’s log and tool and devote a ton of time to try to keep up, there’s just so much to know these days. Literally have never seen that string until today
    – bmike ♦
    Commented Apr 6, 2020 at 13:51
  • @bmike Me neither! ;-) I'm actually seriously worried about Apple's security. I only just found out that completely forbidding non-signed apps (i.e. non-paying devs) is on their future roadmap.
    – benwiggy
    Commented Apr 6, 2020 at 14:09
  • I wouldn’t sweat it. Notarized apps are about to become as easy as getting an ssl certificate. It’s like, who runs code that allows anyone to tamper with it. The default for people that actually ship code is changing, not locking down individuals.
    – bmike ♦
    Commented Apr 6, 2020 at 15:38
1

This is an old-old thread but as of 2023-11 when the current MacOS version is 14.1.1 aka Sonoma, this issue still exists.

A workaround is to bypass the File and Folder access and give the app access to the disk by adding it to the Full Disk Access list.

I am aware that this is less secure. However, this is the only option I am aware of which is safer then disabling the SIP and AMFI subsystems designed to keep the mac safe.

Improve this answer
0

Consider moving files to less restricted folders. For example, create a folder in your home directory. The app I wanted to use cannot open files in /Desktop, /Downloads, or /Documents.

Improve this answer
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – bmike ♦
    Commented Apr 25 at 22:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .