Detecting Full Disk Access on macOS 27 — TCC.db path no longer usable

Question

druvait OP

Created 3w

Replies 3

Boosts 0

Participants 2

We have been using this path to detect whether Full Disk Access is granted:

~/Library/Application Support/com.apple.TCC/TCC.db

Since macOS [27], reading this path fails with access denied even when Full Disk Access has been granted to the app, so the check now reports a false negative.

Questions:

Is there an API an app can use to detect whether Full Disk Access has been

granted to it? 2. If not, is there another supported method to detect it? 3. If this path is no longer usable, which path can we probe to reliably determine that Full Disk Access is granted?

Answer 1

DTS Engineer OP

Apple

3w

Is there an API an app can use to detect whether Full Disk Access has been granted to it?
If not, is there another supported method to detect it?
If this path is no longer usable, which path can we probe to reliably determine that Full Disk Access is granted?

The answer to all three of these questions remains "no", due to the issues outlined in this thread. If you can provide some more details about your specific need for FDA then I may be able to provide more guidance, but there isn't currently a "general" solution to this issue.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware

Answer 2

druvait OP

2w

Hello Kevin,

Thanks for your response.

Our use case is a macOS backup solution. Before starting a backup, we need to verify whether Full Disk Access (FDA) has been granted. If not, we prompt the user to grant FDA so that we can back up all required data."

Answer 3

DTS Engineer OP

Apple

2w

Our use case is a macOS backup solution. Before starting a backup, we need to verify whether Full Disk Access (FDA) has been granted. If not, we prompt the user to grant FDA so that we can back up all required data.

In that case, my advice would be that you create a list of data locations you know to be critical to a complete backup and spot-check those locations. If you're unable to access them, you can then warn the user of the issue and tell them that FDA might be the issue. Keep in mind that things like Endpoint Security mean your access can unexpectedly fail, even FDA, so this "Preflight" will catch issues you wouldn't necessarily catch any other way.

Related to that point, I'd make your preflight check process match your actual backup process as closely as possible. For example, have it go through your privileged helper (not your main app) and do the check against a snapshot you've created instead of the live filesystem.

__
Kevin Elliott
DTS Engineer, CoreOS/Hardware