Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can't trust macOS Privacy and Security settings

eclecticlight.co

Post reply on HN
Print view View original

51–60 of 175 posts

Re: You can't trust macOS Privacy and Security settings

#51

Post by tpmoney »

mh8h wrote: post #35
layer8 wrote: post #32

Earlier quoted context omitted.

The problem is that this given permission doesn’t show in Files & Folders, and after turning it on and off there it still persists. The only way to revoke it is using some CLI command and restart the computer.

That's not what's happening here. Forget about the first 5 steps. If you install the app and start from step 6, the behaviour will be the same. If the user chooses the Documents folder in the browse window in an app, the app can use the contents of the Documents folder without the need for that permission in the Settings page. The Privacy settings applies only to access to the Documents folder without the user intera…

I think the issue here though is that the permission for access remains even after you're not using the open/save dialog and that's not obvious (or controllable from the UI) after the fact.

I think it's reasonable to expect that an application gets access to a file you access through open/save, but the fact that the access to the directory and all the items in that directory persists after that isn't necessarily expected. Especially given that the near equivalent workflow on iOS doesn't behave like this and that's what a lot of users would probably expect. On iOS an app can ask for access to your photos, which you can allow, or limit to specific photos or deny. If you allow access to specific photos and then the photo selector appears, even if you chose an album, the app will only get and retain access to the specific individual photos you gave it access to. It can not read the contents or even the names of any of the other photos in your library.

It seems pretty reasonable to expect that if the "Documents" folder permission is turned off for an app on macOS and you have given the application access to a specific document inside your documents folder, that the application would not also get (and retain) access to read from all the other folders and files within your documents folder.

I agree that this is the default behavior of most desktop OSes (including macOS), but it's also something that seems reasonable for Apple to change given how important sandboxing is to them in general, and how important it is in the broader context of always connected computers with multitudes of arbitrarily networked applications running.

Re: You can't trust macOS Privacy and Security settings

#52

Post by jasonjei »

jjtech wrote: post #47
jasonjei wrote: post #7

The problem with Mac’s sandbox system is that it’s giving me some PTSD of Windows UAC. It’s inventing a solution to a problem that might exist in small doses, but instead gives users permission fatigue. I personally think the traditional *nix model has served us quite well, and elective sandboxing using containers (à la Docker and so on) is quite good. The Mac sandbox model is probably ok for most normal users, but f…

Note that this isn't "Mac's sandbox system", it's TCC. That's an important distinction to make, because apps that have opted into the proper App Sandbox can't do this... they don't even have the ability to display a prompt for direct access to Documents/. With the App Sandbox, sandbox extensions are issues whenever you open a file using the file picker. They only last until the app is restarted. A caveat is that you…

Yes, TCC is what I meant, but my understanding is TCC is a platform wide sandboxing system?

Re: You can't trust macOS Privacy and Security settings

#53

Post by big_toast »

jasonjei wrote: post #33
big_toast wrote: post #21

Earlier quoted context omitted.

I feel like I can mostly use containers on macOS. Is there a different sense that people are using containers on *nix? Or are you referring to all the macOS specific software footguns? I would like to be able to run arbitrary code with gradual/granular privilege escalation. (e.g iOS/android with more affordances and escape hatches. macOS is getting there, but it's been a pretty bumpy/potholed road). Right now if I do…

I was building a lightweight imitation of OpenClaw. Just a Claude.md and iMessage watcher. I had to play around with Privacy a lot to be able to read my iMessages database, and do a lot of iTerm restarting.

I remember it being worse a while ago. But most of the time I can drag a binary into Settings->Privacy & Security->Full Disk Access or other things (Accessibility API). Maybe other issues come up.

I feel like it should still be much easier, but the general sandboxing model seems directionally functional. (My understanding is containerization isn't a silver bullet security-wise, still requires fiddling, and would be a resource hog ram-wise if not CPU?)

I wish I could pick a parent folder/file and get a box to control everything (network/disk/folders/peripherals/accessibility).

Re: You can't trust macOS Privacy and Security settings

#54

Post by galad87 »

jasonjei wrote: post #7

The problem with Mac’s sandbox system is that it’s giving me some PTSD of Windows UAC. It’s inventing a solution to a problem that might exist in small doses, but instead gives users permission fatigue. I personally think the traditional *nix model has served us quite well, and elective sandboxing using containers (à la Docker and so on) is quite good. The Mac sandbox model is probably ok for most normal users, but f…

TCC is a different thing. Sandboxed apps work differently and won't need those TCC dialogs.

Re: You can't trust macOS Privacy and Security settings

#55

Post by epistasis »

eviks wrote: post #36

That's the beauty of using a GUI-first operating system! > only way you can protect your Documents folder from access by Insent is to run the following command in Terminal: tccutil reset All co.eclecticlight.Insent then restart your Mac

Jobs is turning in his grave. There are lots of stories of this conflict at NeXT and Mac OS X where there's a quick fix but not via GUI, which was one of the many things that incensed him.

Re: You can't trust macOS Privacy and Security settings

#56

Post by lloeki »

swiftcoder wrote: post #26
yAak wrote: post #20

Earlier quoted context omitted.

The gotcha is “I gave it permission, then revoked permission in the UI, but it still has permission.”

That's not quite it either. It's more along the lines of "I revoked access via one mechanism, then granted it via a different mechanism, and the setting UI for the first mechanism doesn't reflect the second action". There's no privilege escalation here, but there is a misleading privacy settings UI, which offers no obvious way to audit/revoke permissions in the second case

I think the issue is more like:

- it's non-obvious that the second mechanism (a file picker) is a permission granting mechanism.

- it's non-obvious that the second mechanism (a file picker) is a permission granting mechanism whose permission survives the action context that triggered the file picker (e.g "pick a folder to do action A" also magically imbues similarly gated actions B C D and Z with access to that folder, possibly non-interactively even).

- it's non-obvious that the second mechanism (a file picker) is a permission granting mechanism whose permission propagates to an action gated by the first mechanism, a first mechanism for which "Yes" means yes but "No" means "Maybe, depending on past unrelated actions that triggered an unrelated permission mechanism"

Re: You can't trust macOS Privacy and Security settings

#57

Post by galad87 »

jasonjei wrote: post #52
jjtech wrote: post #47

Earlier quoted context omitted.

Note that this isn't "Mac's sandbox system", it's TCC. That's an important distinction to make, because apps that have opted into the proper App Sandbox can't do this... they don't even have the ability to display a prompt for direct access to Documents/. With the App Sandbox, sandbox extensions are issues whenever you open a file using the file picker. They only last until the app is restarted. A caveat is that you…

Yes, TCC is what I meant, but my understanding is TCC is a platform wide sandboxing system?

TCC is a leaky shoot at limiting non-sandboxed apps permissions. The actual macOS sandbox is a different thing.

I would say that TCC is working as intended, unfortunately, with many obscure behaviors to avoid breaking existing apps.

It's even more unfortunate that a lot of apps that could be easily sandboxed aren't.

Re: You can't trust macOS Privacy and Security settings

#59

Post by [deleted] »

mh8h wrote: post #35
layer8 wrote: post #32

Earlier quoted context omitted.

The problem is that this given permission doesn’t show in Files & Folders, and after turning it on and off there it still persists. The only way to revoke it is using some CLI command and restart the computer.

That's not what's happening here. Forget about the first 5 steps. If you install the app and start from step 6, the behaviour will be the same. If the user chooses the Documents folder in the browse window in an app, the app can use the contents of the Documents folder without the need for that permission in the Settings page. The Privacy settings applies only to access to the Documents folder without the user intera…

[deleted]
Post reply on HN