tccutil and SIP

[jacobsalmela]

Since I currently don't plan to circumvent Apple's SIP, I'm porting over the discussions from these two issues to a Discussion.

• TCC.db protected by SIP in Sierra #18
• Question: what parts of SIP need to be disabled? #40
• Error opening Database. You probably need to disable SIP for this to work. #62

So please continue the discussion here.

[chwzr]

do we have a proof that tccutil will work ( read / write) with SIP disabled as of now (big sur)?

[jacobsalmela]

Ok. I need to go back and check the code then. This would be a useful addition to the code base I think.

Let me ask in one of the PR threads how to get the hash and see if I'm on the right track or wandering far from the beacon

[jacobsalmela]

Can anyone here following this thread, check out this branch: https://github.com/jacobsalmela/tccutil/compare/bigsur

and see what the --digest flag returns?

[ylluminate]

@jacobsalmela tried to checkout that branch but it now appears to be gone...?

[jacobsalmela]

Merged to main

[ylluminate]

Oh, well then on 11.6:

$ sudo ./tccutil.py --digest
3d1c2a0e97

[ylluminate]

Any news or developments on this front? Or is anyone aware of a project that may have taken up the torch on this front?

It seems that there are ongoing issues and I'm curious about how to proceed when we do things like use amfi_get_out_of_my_way and no longer have an easy method to manage TCC.

Also, @jacobsalmela, have you thought about rewriting this project in V? Crossed my mind a bit here as it would be interesting, but I'm also very low on time.

[jacobsalmela]

I have thought about a rewrite in go or v.

In terms of SIP, I haven't planned to circumvent it. I am a bit rusty on it's inner workings the past few releases as well.

What specifically were you wondering about? This app working with/around SIP?

[ylluminate]

Well, specifically I've been wanting to kinda facilitate more easily operating with as many of macOS "features" turned off as possible. I have so many more strange bugs and weird things happening with their updates and it's easy to see that most of the points of pain are from both "safety" and convenience features that simply aren't necessary. I'm not the kind of person that feels as though things should be forced upon you if you're even at least generally cognizant of the consequences of turning them off and you shouldn't be punished for doing so. To this end, being able to still use devices and tcc-facilitated functions should not be eliminated if you choose to operate with amfi_get_out_of_my_way on, etc.

It seems that this app simply isn't working again on 12.6.4 and I've been kinda thinking outloud about what I can do to improve the situation. I still cannot "upgrade" to Ventura given some of the serious problems I had when I had initially tried to migrate some months ago and hesitate to try again until perhaps... well I dunno. I just want my macOS-as-a-Linux-option days back.

[danilagalimov]

Actually, there is a bug in newest version which incorrectly reports the error, hiding the actual one: TypeError: Unicode-objects must be encoded before hashing.

Suggested change:
line 110 -> accessTableDigest = hashlib.sha1(row[0].encode('utf-8')).hexdigest()[0:10]
after line 157 add print(traceback.format_exc()) to print exception verbosely.

and add import traceback in the beginning.

[jacobsalmela]

@danilagalimov want to make a PR? Much easier to see and test in that way.

[danilagalimov]

Actually, it looks like it is already fixed here, but brew package installs 1.2.11 version instead of latest

[jacobsalmela]

Homebrew/homebrew-core#140587

[danilagalimov]

It works for me to read the settings, but for writing it seems that schema has changed - now it has the hash in csreq column and 'auth_value' should be 2

[danilagalimov]

Googled an example how to calculate csreq column- https://stackoverflow.com/questions/52706542/how-to-get-csreq-of-macos-application-on-command-line