Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing macOS TCC user privacy protections by accident and design

labs.sentinelone.com

Post reply on HN
Print view View original

11–20 of 33 posts

Re: Bypassing macOS TCC user privacy protections by accident and design

#11

Post by my123 »

crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

https://filebin.net/uwboypi04o23yzj8/Screenshot_2021-07-05_a...

It is explicitly detailed as such. Full disk access actually means full disk access under that system.

> Time Machine backups [...] for all users on this Mac

Re: Bypassing macOS TCC user privacy protections by accident and design

#13

Post by Dah00n »

lilyball wrote: post #10

How does granting automation access to Finder allow other users to access Alice’s data? TCC doesn’t negate standard Unix file permissions, and other users couldnt read Alice’s data before TCC. And the standard user directories (such as Desktop) are not accessible by other users.

It gives full sudo access.

Re: Bypassing macOS TCC user privacy protections by accident and design

#14

Post by lilyball »

Dah00n wrote: post #13
lilyball wrote: post #10

How does granting automation access to Finder allow other users to access Alice’s data? TCC doesn’t negate standard Unix file permissions, and other users couldnt read Alice’s data before TCC. And the standard user directories (such as Desktop) are not accessible by other users.

It gives full sudo access.

Finder doesn’t run as sudo though. TCC is layered on top of Unix file permissions. It prohibits access to files, it doesn’t open a hole through pre-existing protections.

Basically, it acts as a sandbox rule. Sandboxing your app doesn’t allow you access to new files, it just denies access as determined by the sandbox profile.

Re: Bypassing macOS TCC user privacy protections by accident and design

#15

Post by lilyball »

lilyball wrote: post #14
Dah00n wrote: post #13

Earlier quoted context omitted.

It gives full sudo access.

Finder doesn’t run as sudo though. TCC is layered on top of Unix file permissions. It prohibits access to files, it doesn’t open a hole through pre-existing protections. Basically, it acts as a sandbox rule. Sandboxing your app doesn’t allow you access to new files, it just denies access as determined by the sandbox profile.

I just took another look at the article and it appears I misunderstood what it was saying. I thought it was saying automation of Finder granted access to other users' files. This is not the case. It was talking about accessing other users' files in the previous section, but in this one it's merely claiming that allowing automation of Finder means being able to read data owned by your user that would otherwise be blocked by TCC.

And honestly, that's not a surprise. "Granting an app the ability to automate the Finder means granting it the ability to access any data the Finder can access" seems fairly obvious.

Re: Bypassing macOS TCC user privacy protections by accident and design

#16

Post by salawat »

noizejoy wrote: post #6

It’s been too many years, since I had detailed professional involvement with computer and network security, so I apologize if this question is stupid and I’m not even sure, if it’s even phrased quite right by modern standards: On a computer shared by multiple people and multiple applications, shouldn’t privileges be assigned at the intersection between user and app (and or groupings thereof)? And if there was some so…

I'm fairly sure that anything permission related has been completely mangled beyond all recognizability in this brave new world of "why should users be burdened with understanding the basic abstractions and mechanics of computing, just give them an app!"

Except now we have two permission problems...

Re: Bypassing macOS TCC user privacy protections by accident and design

#17

Post by GekkePrutser »

my123 wrote: post #11
crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

https://filebin.net/uwboypi04o23yzj8/Screenshot_2021-07-05_a... It is explicitly detailed as such. Full disk access actually means full disk access under that system. > Time Machine backups [...] for all users on this Mac

True but the other point mentioned in the article: - giving automatic access to Finder automatically leading to that app getting FDA access without appearing in the list - is very counterintuitive I think.

Re: Bypassing macOS TCC user privacy protections by accident and design

#18

Post by xenadu02 »

crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

TCC does not bypass Unix file permissions. I don't know where that idea is coming from but it is incorrect.

An admin has always been able to sudo to bypass normal Unix permission checks. That's true on all Unix systems.

Re: Bypassing macOS TCC user privacy protections by accident and design

#19

Post by wtallis »

my123 wrote: post #11
crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

https://filebin.net/uwboypi04o23yzj8/Screenshot_2021-07-05_a... It is explicitly detailed as such. Full disk access actually means full disk access under that system. > Time Machine backups [...] for all users on this Mac

That seems like the less likely parsing of the actual text. The more plausible reading would have the "for all users" apply only to the bit about "certain administrative settings", which may by their nature need to apply to all users instead of per-user.

A less ambiguous warning is needed if this is truly meant to be such a powerful setting that overrides regular user-based permissions.

Re: Bypassing macOS TCC user privacy protections by accident and design

#20

Post by GekkePrutser »

I really think Apple should be clearer about what all this stuff does. They're adding a layer of what looks like security but it's not always clear how it behaves.

I feel Apple tries to hide complexity from the user too much. I understand they want to do this by default but there should be a way for technical users to know what's going on. I don't think that's the case well enough now.

Especially that thing with the full disk access cascading though the automation permission is very vague.

Post reply on HN