How to Rename ‘Pictures’ Folder Without Full Disk Access on macOS

mojaveprivacySecuritysip

Our application needs write access to the user's Home directory, specifically to Pictures, Movies, Music, etc., so it can redirect them to our cloud support. But, on Mojave, renaming Pictures (to some back-up folder) fails with EPERM without the Full Disk Access right, which seems too much and too hard to acquire (cf "Unfortunately, Apple has intentionally designed the process of granting Full Disk Access to be difficult, so that users are discouraged from granting Full Disk Access unless absolutely necessary." seen here). Is there another way ?

Best Answer

If you want to do this as a regular user running in standard mode, then no - you have to ask the user to grant permission via Full Disk Access.

You can do it through other means by booting the Mac in Recovery mode for example, but I assume this is not something you want to do as part of a standard process. Granting the correct permissions is way easier.

Note that it is possible to grant the permission, make the change, and then remove the permissions again. This will help if you feel that it is too permissive to allow this software Full Disk Access forever.

Related Solutions

Permission – Grant Root Access to User Files in Mojave

As documented in this post among some other places, MacOS Mojave implements additional security protocols that even affect root's access to user data.

The solution in the linked question provides the basic method I used to resolve my issue.

For custom-built scripts that will run through launchd, the administrator of the computer on which the script is to be run must add that script to Security & Privacy to give that "app" permission to access user data.

It was not necessary to add launchd or rsync (in my case) to Security & Privacy.

I have not researched if there is a way to do this via Terminal, which it seems would be necessary for those administering a large number of clients.

========

Update: I've also learned that if you add a script, and you later make changes to that script, you need to delete it from the Security & Privacy-->Full Disk Access, then add it again. Perhaps macOS creates a hash that is checked?

========

Update w/ Catalina: I do not recall if I had System Integrity Protection disabled on Mojave, but it appears to be required to be disabled in Catalina. I know SIP doesn't have to be disabled for OS versions prior to these.

Disabling macOS SIP allowed the script in question to start running again. This is not ideal, so I'll be researching other approaches.

Give local PHP Full Disk Access in Mojave

You are possibly doing it incorrectly.

First of all, sudo typically requires a password to be typed, and that won't happen via a Web app.

Second, the _www user doesn't get to use sudo. That's a big security hole. Don't even think of modifying sudoers to allow it.

What you should be doing instead is allow the _www user (the one the webserver runs as) access to the chat.db file, like this:

sudo chgrp _www ~/Library
sudo chgrp _www ~/Library/messages
sudo chgrp _www ~/Library/messages/chat.db
chmod g+rx ~/Library
chmod g+rx ~/Library/messages
chmod g+r  ~/Library/messages/chat.db

Best Answer

Related Solutions

Permission – Grant Root Access to User Files in Mojave

Give local PHP Full Disk Access in Mojave

Related Question