Golden Gate Application Support Protection
Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle of macOS 27. (What btw was a great move as now attackers with full disk access permissions can’t modify your privacy settings)
macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the
com.apple.maclprotection that has always guarded sandboxed apps’~/Library/Containers/<bundle-id>/Datafolders to a hand-picked set of non-sandboxed apps’~/Library/Application Support/<name>folders too. I noticed it by accident — Firefox’s profile folder was suddenly inaccessible from Terminal, while MacPass, a password manager sitting right next to it, was wide open. That asymmetry didn’t sit well with me, so I pulled the thread. It ends in a hardcoded app allowlist baked into /usr/libexec/sandboxd (thx @ciphwall for the hint), meant to be updated live via XProtect.
Previously:
- Hijacking Apps Using Archive Utility
- Privacy & Security Settings Don’t Show Intent-Based Access
- Resetting TCC
- Persistent File Access via com.apple.macl Xattr
1 Comment RSS · Twitter · Mastodon
For posterity, with SIP disabled, it is still possible to write to the user's TCC database in its new location. The root TCC database is still at the same location that it used to be, and is also writeable with SIP off.
