Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing macOS TCC user privacy protections by accident and design

labs.sentinelone.com

Post reply on HN
Print view View original

21–30 of 33 posts

Re: Bypassing macOS TCC user privacy protections by accident and design

#21

Post by easton »

GekkePrutser wrote: post #17
my123 wrote: post #11

Earlier quoted context omitted.

https://filebin.net/uwboypi04o23yzj8/Screenshot_2021-07-05_a... It is explicitly detailed as such. Full disk access actually means full disk access under that system. > Time Machine backups [...] for all users on this Mac

True but the other point mentioned in the article: - giving automatic access to Finder automatically leading to that app getting FDA access without appearing in the list - is very counterintuitive I think.

Intuitive to a end-user, perhaps not (but why are they modifying those settings anyway? Well behaved apps don’t ask for FDA), but for a developer or power user it should be. If I allow Terminal.app FDA it means that any executables it hatches have FDA, or else it would be super confusing if you give it FDA and then wonder why nothing seems to have changed.

Re: Bypassing macOS TCC user privacy protections by accident and design

#22

Post by adib »

csande17 wrote: post #5

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set. How does this interact with regular Unix file permissions? Is the assumption that Alice is using sudo, or do modern macOS versions mark al…

Alice finds a recent Time Machine local snapshot and mount that elsewhere with owners disabled. Then Alice can browse everyone else's (recent) files – without needing sudo access.

Re: Bypassing macOS TCC user privacy protections by accident and design

#23

Post by kmeisthax »

xenadu02 wrote: post #18
crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

TCC does not bypass Unix file permissions. I don't know where that idea is coming from but it is incorrect. An admin has always been able to sudo to bypass normal Unix permission checks. That's true on all Unix systems.

The problem isn't that TCC grants a Unix file permission bypass - because it doesn't, at least not on it's own. The problem is that ordinary users can create APFS snapshots via Time Machine, and then mount them with Unix permissions disabled (noowners). When Apple was told about this they decided to gate the snapshot mounting stuff... behind Full Disk Access, not being an admin. And Finder has FDA, because of course it does, otherwise users wouldn't be able to use their own filesystem rights at all.

All of this smacks of different parts of the macOS core team not understanding their security model. One half seems to think Full Disk Access just means "has the user's file system permissions instead of sandboxed access" (hence why Finder has it), while the other thinks it means "access the whole disk, regardless of other permissions". Both interpretations are reasonable but become unreasonable when combined into a single system.

Re: Bypassing macOS TCC user privacy protections by accident and design

#24

Post by crazygringo »

xenadu02 wrote: post #18
crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

TCC does not bypass Unix file permissions. I don't know where that idea is coming from but it is incorrect. An admin has always been able to sudo to bypass normal Unix permission checks. That's true on all Unix systems.

So is the article just plain wrong then?

Can an app given full-disk permissions not access data in other user folders other than the user who started it?

This is why I'm so confused.

Re: Bypassing macOS TCC user privacy protections by accident and design

#25

Post by brigade »

crazygringo wrote: post #24
xenadu02 wrote: post #18

Earlier quoted context omitted.

TCC does not bypass Unix file permissions. I don't know where that idea is coming from but it is incorrect. An admin has always been able to sudo to bypass normal Unix permission checks. That's true on all Unix systems.

So is the article just plain wrong then? Can an app given full-disk permissions not access data in other user folders other than the user who started it? This is why I'm so confused.

To an extent neither are wrong - full disk access doesn't directly bypass the live filesystem's Unix permissions. But it does explicitly grant full access to Time Machine backup images regardless of admin/superuser privileges, including the ability to create new up-to-date snapshots, which is equivalent to full read-only access ignoring Unix permissions (on a short time delay.)

Re: Bypassing macOS TCC user privacy protections by accident and design

#26

Post by GekkePrutser »

easton wrote: post #21
GekkePrutser wrote: post #17

Earlier quoted context omitted.

True but the other point mentioned in the article: - giving automatic access to Finder automatically leading to that app getting FDA access without appearing in the list - is very counterintuitive I think.

Intuitive to a end-user, perhaps not (but why are they modifying those settings anyway? Well behaved apps don’t ask for FDA), but for a developer or power user it should be. If I allow Terminal.app FDA it means that any executables it hatches have FDA, or else it would be super confusing if you give it FDA and then wonder why nothing seems to have changed.

> but why are they modifying those settings anyway?

This is exactly the Apple attitude that bothers me. The idea that a user shouldn't be messing with settings. This is why they remove them as much as they can.

But sometimes there's a good reason to want to change something. Apple's vision isn't always right for everyone. And some users just have more complex needs. Imagine telling an Arch Linux user 'why would you want to change settings anyway?' :) It would break the entire idea behinds the that distribution.

In this case they do even offer the setting (so even Apple see the need for it) but it's not very transparent what it does.

PS: I'm not saying the arch method would work for Apple of course ;) But I am saying that what is configurable should be well documented, and that Apple should probably have a bit more configurability in my opinion.

Re: Bypassing macOS TCC user privacy protections by accident and design

#27

Post by tsimionescu »

interactivecode wrote: post #12

As I understand it full disk access means the app can read the disk outside of the usual (strict) app sandbox or explicit user actions like file modals. This is completely separate from the unix user permissions.

> This is completely separate from the unix user permissions.

It's supposed to be separate, but, with the Time Machine hole, it actually overrides them. So, if an admin enables FDA for Terminal (so that they can actually use it), then a Guest account on the system can use Terminal to create a TM snapshot, mount it, and read any file on the system, from any user, regardless of Unix file permissions.

Re: Bypassing macOS TCC user privacy protections by accident and design

#28

Post by tsimionescu »

lilyball wrote: post #15
lilyball wrote: post #14

Earlier quoted context omitted.

Finder doesn’t run as sudo though. TCC is layered on top of Unix file permissions. It prohibits access to files, it doesn’t open a hole through pre-existing protections. Basically, it acts as a sandbox rule. Sandboxing your app doesn’t allow you access to new files, it just denies access as determined by the sandbox profile.

I just took another look at the article and it appears I misunderstood what it was saying. I thought it was saying automation of Finder granted access to other users' files. This is not the case. It was talking about accessing other users' files in the previous section, but in this one it's merely claiming that allowing automation of Finder means being able to read data owned by your user that would otherwise be bloc…

The article's point is that, while understandable, the UI completely hides these facts from you. Finder is not mentioned as having FDA in the settings app, and so, even if you realize that Automation of FDA app means having FDA, you won't be able to tell implicitly that apps having Automation of Finder rights also have FDA through this mechanism.

Furthermore, in principle there is nothing stopping OSX from giving me a prompt when Automation AppX without FDA access wants to access my files through Finder specifically.

Re: Bypassing macOS TCC user privacy protections by accident and design

#29

Post by adib »

xenadu02 wrote: post #18
crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

TCC does not bypass Unix file permissions. I don't know where that idea is coming from but it is incorrect. An admin has always been able to sudo to bypass normal Unix permission checks. That's true on all Unix systems.

... in this case it _does_, albeit in a roundabout way via Time Machine local snapshots. In short, the attacker can bypass Unix file permissions by mounting a local backup with owners disabled.

Re: Bypassing macOS TCC user privacy protections by accident and design

#30

Post by wtmt »

crazygringo wrote: post #9

> At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is…

> In other words, granting full-disk access to an app would give it access to everything my user can access. Not "sudo" access to other users' data as well.

> Why would an app ever need that level of access? For installing files, maybe, but not while running.

Though bootable full disk backups aren’t possible anymore with the recent releases of macOS, there are applications such as Carbon Copy Cloner and SuperDuper! that need full disk access to create a backup of the entire volume. This is a limited case, but there are many people who use these (instead of or in addition to Time Machine).

Post reply on HN