4

In MacOS Big Sur, I figured out an app (downloaded from internet) normally can not access ~/Downloads/, ~/Documents/, ~/Desktop/ folders directly. When it tries to access those folders at the first time, there will be a popup window to ask for permission and the permission can be setup in System Preferences > Security & Privacy > Privacy > Files and Folders.

Edited: It seems my bad description makes people confused (sorry about my English). I will put two screenshots here to clarify what I mean:

enter image description here

The above screenshot appears when the app iTerm2 tries to access ~/Downloads folder at the first time in Big Sur. (basically when I execute ls ~/Downloads/ commands in iTerm2)

enter image description here

The above screenshot is where I can change the folders privacy setup.

But, today, I downloaded an app (it's a downloading tool) and installed it by dragging it to /Applications folder. (the same way I installed iTerm2) I tried to use that tool to download a file to ~/Downloads folder and the file can be downloaded and written to ~/Downloads folder directly without any permission requirement. It can also display/read all the files in the ~/Downloads folder. I checked the Privacy setup in System Preferences and it does NOT have that app setup too.

I am very confused how can that app read/write the file to ~/Downloads without requiring a privacy permission on the protected folder. I thought those protected folders were protected and were not allowed to be read/write before granting privacy permission. But I was wrong. (Note that, later I found out Google Chrome App can read/write those protected folders too without asking this privacy permission. File > Open File > Choose any files inside the three protected folders)

PS1: I haven't mentioned the "downloading tool app" name here because that is a non-English app. If anyone consider I should give the name to get a better help, just let me know. Thanks.

PS2: This is a fresh install of MacOS Big Sur. (Not a upgraded system)

PS3: The "downloading tool app" is a GUI app. (NOT a CML app).

PS4: I just find out the Google Chrome.app downloaded from https://chrome.google.com can write to (save file to) ~/Downloads/ folder directly without requiring any privacy permission too. This is weird. Why does iTerm, Code and VLC require privacy permission to do any read/write to those protected folders but google chrome does NOT need to require anything.

7
  • What permissions are set on the Downloads folder? – Solar Mike Mar 29 at 9:01
  • 3
    @SolarMike The question is about MacOS new feature Security & Priavcy > Privacy > FIles and Folders. I think that has nothing to do with the file system folder permission. This is a fresh install of Big Sur. So the Downloads folder should have the default permission. Since you ask, that is drwx------+ 9 myusername staff here. Cheers. – sgon00 Mar 29 at 9:07
  • I would be much less concerned about write access than read access to ~/Downloads. If there's always an OS-provided picker, or files go directly to ~/Downloads, that's a different issue than arbitrary apps being able to read files in the ~/Downloads folder. – pseudon Mar 29 at 21:07
  • @pseudon yeah, you are right. I am more concerned about read access too. They actually have read access too, but I haven't put it in the question. I tried Google Chrome, it can read/open any files inside those protected folders without any privacy requirement. – sgon00 Mar 30 at 2:09
  • Did you grant full disk access to the absent question? It's right above the files and folders section of the security preferences in your screenshot. Did those apps ask for permission for full disc access when you installed them? – hepcat72 Mar 31 at 11:48
0

I’m not sure I fully follow all the PS, but when you download the tool in the first place and execute or move the file, you are granting entitlements for the download folder and clearing the quarantine flags on the app signaling that the app can run.

Apple designed this to warn people when they didn’t intentionally run an app so the friction is for unintentional downloads is how I interpret why Apple designed it thusly.

You may need a session with someone to pick apart every step and evaluate each program closely to get a specific answer, but generally downloaded apps behave differently than ones the App Store installs with respect to sandbox and entitlement warnings.

2
  • I am not sure how to call this privacy feature in Big Sur. There must be a name. Sorry that if you don't understand what I mean in the question due to the limit of my English. I am talking about the Security & Privacy > Files and Folder Privacy feature. For example, if you download iterm2 and install it, the first time you access Downloads folder, there will be a popup window to ask whether or not I want to grant the access. That happens to most downloaded apps that I mentioned in the question. But the downloading tool app and google chrome app are the two exceptions I found so far. – sgon00 Mar 29 at 11:37
  • I have updated the question and posted two screenshots to clarify what I mean with this privacy permission. Hopefully, that makes the question more clear. Thanks. – sgon00 Mar 29 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .