I am going through the list of ways to check if my app is given Full Disk Access (FDA) or not. Out of which only one method is supported by apple.
@note The only supported way to check if an application is properly TCC authorized for Full Disk Access
* is to call es_new_client and handling ES_NEW_CLIENT_RESULT_ERR_NOT_PERMITTED in a way appropriate
* to your application.
I have implemented this method using EndpointSecurity and calling it from a root process as required. But when I disable System Integrity Protection (SIP) and call it, it succeeds without FDA. No error is thrown. Then I tested, in our app both EndpointSecurity and protected folder access (like Documents folder) functionalities are working fine even without FDA when SIP is disabled. Now my questions are
- When SIP disabled, does every app has FDA access by default?.
- Is there any use case that still needs FDA access when SIP is off?.
- Is there any way to check for FDA permission given or not whenever SIP is off, since above method won't work in that case?.