Part of the install of our kext is a simple launchctl script to automatically mount the volumes.
In essence, the script is:
/usr/local/sbin/zpool import -a
If users add "bash" to allow Full Disk access, the script runs on boot. So that's "a" solution.
But allowing "bash" Full Disk access is an excessively large hammer I feel.
However, allowing "Full Disk" access to "zpool" will not work, it is
apparently not enough.
In the interest of doing things the way Apple intended (or rather, not going against Apple) what would
be the "right" way to approach this. Clearly there is some inheritance in play, but it isn't clear to me
how that works. Why wouldn't allowing "zpool" to work? How to debug this?