Advice needed (app permissions)

I'm new to the scene. I'm learning to be a software dev but this is my first venture into the MacOs scene. We use Macs in the computer labs at my workplace and I wanted to create a python app that detects if the signed in user is taking up more than 15Gb of the storage on the Mac. The program works great and I've built in some extra functionality so it works with our other management systems but I've run into an issue. The program will need to run on login and if the app runs for the first time it asks them to allow the app to access their data (scan documents folder, desktop folder, pictures folder etc.) and this kind of defeats the purpose of the app as we want to enforce and monitor without the students having the ability to break the program. If the user just clicks no on all of the prompts for permissions the app won't detect storage and I'm back to square one. I've tried adding a info.plist which I though would have fixed the issue but no luck. Any advice on how I can give the program elevated permissions or run something like a sudo instance that ignores or forces the permissions. The logic in my code can be changed too.. no biggy. Just need to find a solution and not spend any money on licenses or API's. Any advice will be greatly appreciated. Alex

Post not yet marked as solved Up vote post of Alex2721 Down vote post of Alex2721
592 views

Replies

Any advice on how I can give the program elevated permissions or run something like a sudo instance that ignores or forces the permissions.

sudo won’t help here because this is not a traditional BSD permissions issue but a MAC check. See On File System Permissions for more background on this.

Given that you’re working in a managed environment you should be able to avoid this by pushing a configuration profile with a com.apple.TCC.configuration-profile-policy payload that authorises your app to access photos.

IMPORTANT For this to work your app must be signed with a stable code signing identity. If your app is unsigned, or ad hoc signed, there’s no reliable way for the payload to identify your app.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Awesome, thanks for that. I ended up doing what you said by creating a configuration profile on JAMF and it worked like a charm. I haven't worked on client-side apps before so this was a good learning curve for me. Thanks once again. Alex 👍