Golden Gate Application Support Protection
Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle of macOS 27. (What btw was a great move as now attackers with full disk access permissions can’t modify your privacy settings)
macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the
com.apple.maclprotection that has always guarded sandboxed apps’~/Library/Containers/<bundle-id>/Datafolders to a hand-picked set of non-sandboxed apps’~/Library/Application Support/<name>folders too. I noticed it by accident — Firefox’s profile folder was suddenly inaccessible from Terminal, while MacPass, a password manager sitting right next to it, was wide open. That asymmetry didn’t sit well with me, so I pulled the thread. It ends in a hardcoded app allowlist baked into /usr/libexec/sandboxd (thx @ciphwall for the hint), meant to be updated live via XProtect.
Previously:
- Hijacking Apps Using Archive Utility
- Privacy & Security Settings Don’t Show Intent-Based Access
- Resetting TCC
- Persistent File Access via com.apple.macl Xattr
