Bypassing macOS TCC user privacy protections by accident and design • Hacker News Board

Re: Bypassing macOS TCC user privacy protections by accident and design

#31

Post by adib » Mon, Jul 05, 2021, 6:09 AM UTC

lilyball wrote: post #10

How does granting automation access to Finder allow other users to access Alice’s data? TCC doesn’t negate standard Unix file permissions, and other users couldnt read Alice’s data before TCC. And the standard user directories (such as Desktop) are not accessible by other users.

... by manipulating the Finder to:

(1) Create a snapshot of the entire file system; (2) or find a recent Time Machine local snapshot; then (3) mount the snapshot obtained in [1] or [2] without owners enabled, effectively granting Alice read-only access to other people's files without having administrative privileges.

Re: Bypassing macOS TCC user privacy protections by accident and design

#32

Post by lilyball » Mon, Jul 05, 2021, 9:17 AM UTC

adib wrote: post #31

lilyball wrote: post #10

How does granting automation access to Finder allow other users to access Alice’s data? TCC doesn’t negate standard Unix file permissions, and other users couldnt read Alice’s data before TCC. And the standard user directories (such as Desktop) are not accessible by other users.

... by manipulating the Finder to: (1) Create a snapshot of the entire file system; (2) or find a recent Time Machine local snapshot; then (3) mount the snapshot obtained in [1] or [2] without owners enabled, effectively granting Alice read-only access to other people's files without having administrative privileges.

The Finder doesn’t create or mount APFS snapshots. And while I haven’t tested it, I fully expect Time Machine to still enforce Unix file permissions. You really need to be using the command line to do what you’re describing.

Re: Bypassing macOS TCC user privacy protections by accident and design

#33

Post by adib » Mon, Jul 05, 2021, 11:50 AM UTC

lilyball wrote: post #32

adib wrote: post #31

Earlier quoted context omitted.

... by manipulating the Finder to: (1) Create a snapshot of the entire file system; (2) or find a recent Time Machine local snapshot; then (3) mount the snapshot obtained in [1] or [2] without owners enabled, effectively granting Alice read-only access to other people's files without having administrative privileges.

The Finder doesn’t create or mount APFS snapshots. And while I haven’t tested it, I fully expect Time Machine to still enforce Unix file permissions. You really need to be using the command line to do what you’re describing.

I haven’t tested the Finder case though. Nevertheless there is the `tell ‘Finder’ ... do shell script ... end tell` construct that _may_ be able to get the Finder to launch an arbitrary subprocess (and may inherit full disk access) just like how Terminal would.

However I’ve tested mounting a local snapshot using the Terminal having full disk access and found out that it is possible to mount a local snapshot and make the mounted copy ignore Unix file permissions.