2

I occasionally receive this permissions message in MacOS 10.15.5:

“bash“ wants access to control “System Events“. Allowing control will provide access to documents and data in “System Events“, and to perform actions within that app.

Googling around, PCrisk implies that this could be a virus/adware. That'd be surprising - I'm pretty careful about what I install.

Is there any way to determine which application is attempting to execute a bash command?

Screenshot: “bash“ wants access to control “System Events“. Allowing control will provide access to documents and data in “System Events“, and to perform actions within that app.

  • 1
    I agree with PCrisk that this is suspicious, especially if it's not related to what you're doing at the time (is it?). I don't have a full answer, but the first thing I'd do is, while the message is displayed, run the Activity Monitor utility, choose View menu > "All Processes, Hierarchically", and look for "bash" processes (you can use the search field in the top right of the window). See what "bash" processes exist, and what their parent processes are. Also, check their subprocesses (you'll have to remove the search to see them). The results may give some clues about what's going on. – Gordon Davisson Aug 12 at 19:40
  • Do you perhaps have a Finder extension that opens a Terminal in the Finder's current working directory? Something that would grab the CWD from Finder and then launch a Terminal with bash? Just a guess at this point. Might also be something you are running in your .bash_profile or .bashrc configuration. It doesn't do that with the Apple defaults. – James Brickley Aug 12 at 20:59
  • Check your bash configuration files especially if it's sourcing other additional configuration files. – James Brickley Aug 12 at 21:00

You must log in to answer this question.

Browse other questions tagged .