I downloaded an app from the MacOS app store. Using codesign, I can see that the app has a number of entitlements including:

  • com.apple.security.files.user-selected.read-write; and
  • com.apple.security.files.bookmarks.app-scope.

Inside the app, one can choose which directories it has access to. Once selected by the user, the app will continue to have access to these directories (without asking the user again in the future).

Is there an administrative command-line (or graphical) security utility that allows me to see which exact directories (say which subdirectories of Documents) a sandboxed or notarised app has access to? I am assuming that MacOS somehow remembers this information.


You must log in to answer this question.

Browse other questions tagged .