1

I am trying to get an .app bundle wrapping a shell script that invokes /bin/bash to be allowed to read a plist file in ~/Library/Mail/V7/MailData/Signatures and to write to other files in that directory. When the app runs and tries to do either action it fails with a permission error (only seen in a console)

I've confirmed that it works properly when /bin/bash has been given Full Disk Access manually in the Security & Privacy preferences, but it is too cumbersome to direct users on how to do that. I have tried adding my .app as the one given full disk permissions, but that doesn't work

I have been unable to find a way to force MacOS to prompt the user to give these permissions and based on the TCC debug output (using /usr/bin/log stream --debug --predicate 'subsystem == "com.apple.TCC"'), it seems like that is never possible, that MacOS actively says you can't prompt to give full disk access.

1
  • Requiring an app to allow any script using /bin/bash is rather a large security issue - If I don't want any random /bin/bash script to access things why should I allow your app. Probvaly best to rewite in swift and then have explicit permissions for your app.
    – mmmmmm
    Oct 7, 2023 at 10:22

1 Answer 1

0

An way to get around the problem is simply to not invoke /bin/bash, but rather interpret and run the shell script within your own app. For example you could restrict the script language to be a very simple one, so that you do not have to implement full bash scripting functionality (which would be quite an undertaking).

For example if the scripts only consists of simply running literal commands, or perhaps a few conditions - then that could easily be implemented directly in the app, or as a simple language interpreter.

This would then let the user give your app Full Disk Access, and it would work.

1
  • The bundle is actually just wrapping the shellscript itself using CFBundleExecutable in the Info.plist
    – brent
    Sep 21, 2020 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .