How to prompt to give specific folder access or full disk access to /bin/bash when run in an app bundle on Catalina

applicationspermission

I am trying to get an .app bundle wrapping a shell script that invokes /bin/bash to be allowed to read a plist file in ~/Library/Mail/V7/MailData/Signatures and to write to other files in that directory. When the app runs and tries to do either action it fails with a permission error (only seen in a console)

I've confirmed that it works properly when /bin/bash has been given Full Disk Access manually in the Security & Privacy preferences, but it is too cumbersome to direct users on how to do that. I have tried adding my .app as the one given full disk permissions, but that doesn't work

I have been unable to find a way to force MacOS to prompt the user to give these permissions and based on the TCC debug output (using /usr/bin/log stream --debug --predicate 'subsystem == "com.apple.TCC"'), it seems like that is never possible, that MacOS actively says you can't prompt to give full disk access.

Best Answer

An way to get around the problem is simply to not invoke /bin/bash, but rather interpret and run the shell script within your own app. For example you could restrict the script language to be a very simple one, so that you do not have to implement full bash scripting functionality (which would be quite an undertaking).

For example if the scripts only consists of simply running literal commands, or perhaps a few conditions - then that could easily be implemented directly in the app, or as a simple language interpreter.

This would then let the user give your app Full Disk Access, and it would work.