how dangerous is it to give zsh full disk access?

Question

I have a shell script that runs a few (Duplicacy) backup commands. It works fine when I manually run the script from terminal (cd to the directory where it is and then ./backup.sh).

To make it run automatically I created a launch agent (a .plist file). When it runs now, I get only "operation not permitted" errors whenever Duplicacy attempts to open a preference file or any other file to do its backups. The permission of the script is 755, and it's owned by the same user as the the files Duplicacy tried to open.

Quite a bit of research suggests that I should open Security & Privacy in Preferences and allow zsh to have full disk access. I tried this and it solved the problem.

Is this overkill and dangerous for this issue? Is it ok for zsh to have full disk access?

Answer 1

There’s no inherent danger per se with respect to ZSH; it’s only a shell.

What is “dangerous” is what you run in the shell. Most users don’t use the shell so securing it gives a nice level of extra security so when they inadvertently download nefarious apps from the Internet, they will have the protection that the shell doesn’t have full disk access.

Is it overkill? In my opinion, no. If you run scripts like this backup script, you’re going to want access to more than just one or two directories (which you can do, by the way); you’ll want access to the whole disk.