MacOS – Mojave: How to grant apps permission in Security & Privacy -> Privacy -> Accessibility on the command line

macosmojavepreferences

I manage a number of macOS laptops.

Trying to automate a deploy of Mojave, I have found that some things aren't very automatable. One thing in particular stands out: the new permission scheme in Mojave for apps to access disk and other resources.

Since my environment is managed, users can't access System Prefs panels that require admin credentials.

However, the Security & Privacy is locked to admins.

I have a device management system in place that can run things with elevated credentials which is why I am looking for an alterative way to do this.

So: Is there any way to automate the addition of apps to this preference pane?

Best Answer

tccutil. But not the official one from Apple.

brew has it.

Regards

Related Solutions

MacOS – Adding Apps to “Security & Privacy” Settings (Automatically)

Just found it. The settings are in one of these two files:

System-wide settings: /Library/Application Support/com.apple.TCC/TCC.db
Per user settings: ~/Library/Application Support/com.apple.TCC/TCC.db

They are SQLite databases of the following form:

sqlite> .schema access
CREATE TABLE access (service TEXT NOT NULL, client TEXT NOT NULL, client_type INTEGER NOT NULL, allowed INTEGER NOT NULL, prompt_count INTEGER NOT NULL, CONSTRAINT key PRIMARY KEY (service, client, client_type));

Example (MS Office and Address Book setting):

sqlite> select * from access;
kTCCServiceAddressBook|com.microsoft.Word|0|1|0
kTCCServiceAddressBook|com.microsoft.Excel|0|1|0
kTCCServiceAddressBook|com.microsoft.Powerpoint|0|1|0

For other services, just pick the correct service name (such as kTCCServiceAccessibility) and the application bundle ID and add it to the appropriate database.

MacOS – What does Security & Privacy/Accessibility enable

In essence, the 'assistive devices' feature gives apps the ability to control other apps. It was intended to give assistive applications the ability to read the screen and process information for other methods of interaction, such as VoiceOver or braille readers. However, other apps use the same feature to 'plug in' to other apps.

For example, Steam uses this feature to provide the Steam Overlay on top of games. Apps requiring AppleScript integration also require this feature, as well as apps that want the ability to press buttons in other apps. This would allow assistive apps to press buttons in apps per voice commands or other input, however it could also potentially allow apps to press buttons without your consent.

It doesn't give apps any more access to your data than the app would already have, however there's nothing stopping it from giving itself access to your data by clicking the relevant buttons in the GUI (i.e. opening Get Info and adjusting the file permissions). Despite all this, it would still require that you enter your password.

In conclusion, it simply allows apps to press buttons in other apps and read data from other apps.

Best Answer

Related Solutions

MacOS – Adding Apps to “Security & Privacy” Settings (Automatically)

MacOS – What does Security & Privacy/Accessibility enable

Related Question