MacOS Firewall: Program grayed out, can't be added to Firewall Options

Question

In MacOS Monterey (12.0.1), I am running Python 2.7 from an Anaconda virtual environment. Each time I run the Python script, I am asked if I want to accept incoming network connections:

I have tried multiple times to "Deny" or "Allow" this (which requires me to enter the username & password of an administrator user). However, each time I run the script I am presented with the same question.

When I go to System Preferences > Security & Privacy > Firewall > Firewall Options and press + to add an application manually, I am unable to select Python 2.7 in the file picker (it's grayed out, as can be seen in the screenshot below):

According to Get Info, my user has Read & Write privileges for this file, which also seems to be true in Terminal for the file and the directory it's in:

-rwxrwxr-x@  1  my_user  staff   8464 Oct 30 12:21 python2.7
drwxr-xr-x@  81 my_user  staff   2592 Nov 19 10:10 bin

How can I stop this annoying pop-up from reappearing?

Answer 1

You can try controlling the firewall through the Terminal interface of the Application Firewall, socketfilterfw.

Step-by-step

socketfilterfw is located under /usr/libexec/ApplicationFirewall, so first go there in Terminal:

cd /usr/libexec/ApplicationFirewall

Then you can list existing rules with:

./socketfilterfw --listapps

You can add an application with the following command:

sudo ./socketfilterfw --add <full path to application executable>

Terminal should print Incoming connection to the application is permitted when successful.

Example: allowing python through in an Anaconda install

It seems you have installed python through Anaconda and are trying to let it through the firewall.
In this example I go through all the steps in Terminal.
I assume that you're working in the base environment, if not, you need to change that name in the first steps.

conda activate base
python_loc=$(which python)
cd /usr/libexec/ApplicationFirewall
sudo ./socketfilterfw --add $python_loc
sudo ./socketfilterfw --listapps

The last step should show the freshly added python application in the list:

ALF: total number of apps = 8 

...

8 :  /Users/username/opt/anaconda3/bin/python3.9 
     ( Allow incoming connections ) 

Note that python is often a symlink to another binary (e.g. python3.9 or python2.7). During the creation it's fine to refer to the symlink, but when you want to remove the rule again (with ./socketfilterfw --remove) you need to provide the actual path that is listed by socketfilterfw (/Users/username/opt/anaconda3/bin/python3.9 in this case), not the symlink.