1

I am working on a macOS app which is distributed outside of the App Store and isn't sandboxed. My understanding is that non-sandboxed apps should have access to everything that the user can access. Yet I'm getting a console error Sandbox: my-app(1868) System Policy: deny(1) file-read-data that is causing some problems:

The app uses several filepath inputs and writes to a workspace directory (by default ~/Documents/model_workspace/). It creates this directory if it doesn't exist and overwrites it if it already exists. If the workspace directory exists and was created by a previous run of the app, it works as expected. But if it exists and was created with mkdir or by the CLI version of the app, nothing happens. An error Sandbox: my-app(1868) System Policy: deny(1) file-read-data ~/Documents/model_workspace shows up in the console logs.

When the app first opens, it autofills inputs from the previous run and tries to validate filepath inputs by opening them. All filepaths initally fail validation and there is the same console error Sandbox: my-app(1868) System Policy: deny(1) file-read-data <filepath> for each filepath input. Clearing one input and re-entering it, which triggers validation to run again, causes all inputs to pass as expected.

I am testing on macOS Catalina 10.15.6.

Things I have tried:

  • Changed the file permissions to drwxrwxrwx (no effect)
  • Gave the app Full Disk Access in System preferences>Privacy (no effect)
  • Googling turned up this similar-sounding issue. However, I don't see any helpful error messages about a missing key like the ones described there.
  • Looked further into the logs. The error correlates with an error from tccd: FAIL: PID[2624]: SecTaskCopySigningIdentifier(): [22: Invalid argument]

I had thought that TCC would prompt the user for permission if the app tries to access ~/Documents. Maybe something is going wrong with that step? I tried to find more TCC logging with log show --info --debug --signpost --predicate 'eventMessage contains[c] "tcc"'. A small excerpt from around the time of the form autofilling and validation failing:

Timestamp                       Thread     Type        Activity             PID    TTL  
2020-10-14 10:18:01.835750-0600 0x1c4c5    Activity    0x1eaa1              2738   0    my-app: (TCC) TCCAccessRequest() IPC
2020-10-14 10:18:01.835987-0600 0x1c4c5    Info        0x1eaa1              2738   0    my-app: (TCC) [com.apple.TCC:access] Sending 0/7 synchronous to com.apple.tccd.system: request (0x7f96f353bec0): <dictionary: 0x7f96f353bec0> { count = 6, transaction: 0, voucher = 0x0, contents =
    "require_purpose" => <null: 0x7fff95117b70>: null-object
    "service" => <string: 0x7f96f353be90> { length = 22, contents = "kTCCServiceListenEvent" }
    "function" => <string: 0x7f96f353be40> { length = 16, contents = "TCCAccessRequest" }
    "preflight" => <bool: 0x7fff95117490>: true
    "target_token" => <null: 0x7fff95117b70>: null-object
    "background_session" => <bool: 0x7fff951174b0>: false
}
2020-10-14 10:18:01.836133-0600 0x1c02c    Info        0x1eaa1              156    0    tccd: [com.apple.TCC:access] tccd[156](0): handling request from PID[2738](501): {
    require_purpose=<null: 0x7fff95117b70>: null-object
    service="kTCCServiceListenEvent"
    function="TCCAccessRequest"
    preflight=true
    target_token={NULL}
    background_session=false
}
2020-10-14 10:18:01.836367-0600 0x1c02c    Info        0x1eaa1              156    0    tccd: [com.apple.TCC:access] Composed entitlement check for ({ID: <ID of InvalidCode>, PID[2738], auid: 501, euid: 501, binary path: '/private/var/folders/zh/dy02ljyd4mj5_nfm158hwcr00000gn/T/AppTranslocation/C6949B31-32EB-42CF-8B31-86CD00C36492/d/my-app.app/Contents/MacOS/my-app_dist/my-app'}, com.apple.private.tcc.allow) from: kTCCServiceListenEvent to parent: kTCCServicePostEvent
2020-10-14 10:18:01.836398-0600 0x1c02c    Info        0x1eaa1              156    0    tccd: [com.apple.TCC:access] Composed entitlement check for ({ID: <ID of InvalidCode>, PID[2738], auid: 501, euid: 501, binary path: '/private/var/folders/zh/dy02ljyd4mj5_nfm158hwcr00000gn/T/AppTranslocation/C6949B31-32EB-42CF-8B31-86CD00C36492/d/my-app.app/Contents/MacOS/my-app_dist/my-app'}, com.apple.private.tcc.allow) from: kTCCServicePostEvent to parent: kTCCServiceAccessibility

I notice several lines containing Composed entitlement check for ({ID: <ID of InvalidCode>. Is the InvalidCode related to this problem? The console errors above did not show up in these logs. Is there a better way to get information about what TCC is doing?

We are very stuck on this issue and any help would be appreciated!

  • Have you tried giving the specific app access to "Files and Folders" in System Preferences => Security & Privacy => Privacy ? – jksoegaard Oct 15 at 10:00

You must log in to answer this question.

Browse other questions tagged .