TCC.db protected by SIP in Sierra #18

avivais · 2016-09-03T07:49:19Z

Was this tested on Sierra latest beta?

avivais · 2016-09-03T09:05:09Z

Just tried - Seems as now TCC.db is protected by SIP - It is now readonly

jacobsalmela · 2016-09-12T14:45:41Z

Yeah, I was seeing this, too. Not sure there will be a great way around it besides disabling SIP...

avindra · 2017-01-17T21:34:15Z

Error is:

Traceback (most recent call last):
  File "./tccutil.py", line 294, in <module>
    main()
  File "./tccutil.py", line 284, in main
    enable(item)
  File "./tccutil.py", line 232, in enable
    c.execute("UPDATE access SET allowed='1' WHERE client='%s'" % (client))
sqlite3.OperationalError: attempt to write a readonly database

keyurp1987 · 2017-10-18T17:00:03Z

Any updates on the issue above? We have been hit with the same issue and wondering if anyone found a workaround to get pass this and set the accessibility via command line.

jacobsalmela · 2017-10-20T03:08:02Z

I personally have not bothered trying to circumvent SIP and don't plan to. I like SIP despite some headaches it can cause for traditional ways of doing things.

Ideally, it would be nice if Apple were to implement this open source software as part of their OS. They already have there own tccutil--they just need to add the functionality my tool offers (plus some Apple engineering to safely work with SIP)...The whole reason I made this to begin with is because Apple's tccutil only has one command, which just resets everything; it seems like a perfect opportunity to merge the two utilities.

Tatsh · 2018-02-11T15:00:51Z

I have my database modified since I did this before SIP existed, yet SIP protects the file. Perhaps it is possible to go into SIP-less mode, update the file, and then turn it back on?

I have not tried this yet as I have not needed to yet. The entries for bash, tmux, sh, etc all show up in Accessibility. And also there are these defaults keys which have full paths, either file or directory:

defaults write com.apple.universalaccessAuthWarning /usr/libexec -bool true
defaults write com.apple.universalaccessAuthWarning /usr/libexec/sshd-keygen-wrapper -bool true

I have not tried to add an entry this way but I am already fairly certain it will not work because otherwise this utility would not exist.

jacobsalmela · 2018-02-11T15:24:24Z

Isn't a reboot necessary in order to enable/disable SIP? I've been out of the Mac world for a couple of years now so I'm not familiar with what the defaults commands you mentioned do.

Tatsh · 2018-02-11T16:12:16Z

Yes a reboot is required. You have to get into recovery mode, disable SIP, come back, edit, go back to recovery mode, and maybe it will work. I have not tried this and yes it's annoying but at least it keeps SIP enabled.

jacobsalmela · 2018-02-12T01:11:30Z

I suppose a notice could be added to the utility about SIP and this possible workaround--at the very least.

Tatsh · 2018-07-30T23:48:56Z

This is no longer an issue on Mojave. macOS 10.14 will have a section named Automation under Security & Privacy / Privacy. This utility is no longer necessary at that point. Any app that attempts to use automation will bring up a prompt to confirm once.

jacobsalmela · 2018-08-04T13:42:30Z

Interesting..I guess that's good because I don't have time to maintain it anymore. Thanks @Tatsh

paulz · 2018-08-30T18:06:34Z

works for me with sudo on MacOS X High Sierra:

sudo tccutil -l
/usr/bin/osascript
com.apple.AccessibilityInspector
com.apple.Automator
com.apple.Safari
com.apple.ScriptEditor.id.disconnectHardwareKeyboard
com.apple.ScriptEditor2
com.apple.Terminal
com.apple.dt.Xcode
com.apple.dt.Xcode-Helper
com.apple.sample.UIElementInspector
com.getdropbox.dropbox
com.google.GoogleTalkPluginD
com.screenhero.screenhero
net.sourceforge.sqlitebrowser

sw_vers
ProductName:	Mac OS X
ProductVersion:	10.13.6
BuildVersion:	17G65

ccstone · 2018-09-01T17:57:31Z

sudo tccutil -l is a read command.

What happens when you use a writable command?

ssbarnea · 2018-12-29T14:33:02Z

Clearly it does not work on Mojave:

$ sudo tccutil -l                                                                                                                                                                           Error opening Database.

Any workarounds as I really need to bless osascript?

Ge0rges · 2019-02-01T01:35:58Z

sudo tccutil.py --list yields Error opening Database. on macOS Mojave 10.14.2. Is it related to SiP?

Tatsh · 2019-02-01T02:19:58Z

Yes

jacobsalmela · 2019-10-17T11:56:44Z

I'll add some more info in the message to let users know about SIP

danielbayley · 2020-03-14T00:14:49Z

@jacobsalmela Could you cut a new release (including #32)? So that the @Homebrew formula can be updated… for those with SIP disabled.

jacobsalmela · 2020-03-14T14:20:44Z

I've been meaning to, but I haven't made time to learn all their rules for updating a formula. When I first did it, it wasn't a super easy process.. I'll give it my best, but if anyone has a quick and dirty version of commands to run, let me know.

jacobsalmela · 2020-03-15T11:36:13Z

Never mind. It's quite easy with an existing formula in place:

v1.2.6 is now available via Homebrew. 😄

danielbayley · 2020-03-16T12:09:03Z

I've been meaning to, but I haven't made time to learn all their rules for updating a formula. When I first did it, it wasn't a super easy process.. I'll give it my best, but if anyone has a quick and dirty version of commands to run, let me know.

@jacobsalmela Ah I would have handled the PR to Homebrew… as I deal with formulae/casks quite a lot! Just needed the release… But yeah it should be much easier to update as opposed to creating new. Nice one, thanks 👍🏼

LeoGrin · 2020-07-08T09:59:32Z

Hi,

I'm on Mojave 10.14.6. When I try to use tccutil, I get :

sudo tccutil --list
Error opening Database.  You probably need to disable SIP for this to work.

However, I've disabled SIP:

csrutil status
System Integrity Protection status: disabled.

Thus I'm wondering if SIP is the real problem here. Thank you in advance for your help.

jacobsalmela · 2020-07-08T10:47:53Z

Hmmm. Thanks for the note. There might be more work to do then...

Squactopus · 2020-08-04T20:59:39Z

What does SIP even stand for?
Update: looked it up, and now I know what it stands for. This information does not help at all.

paulz · 2020-08-04T23:16:10Z

About System Integrity Protection on your Mac

https://support.apple.com/en-us/HT204899

jacobsalmela · 2020-08-05T12:06:01Z

Yeah, it basically prevents tools like this from hacking their way into things we know nothing about. It's a good thing 😄 .

mike-myers-tob · 2020-11-20T21:53:46Z

Hi,

I'm on Mojave 10.14.6. When I try to use tccutil, I get :
sudo tccutil --list
Error opening Database.  You probably need to disable SIP for this to work.
However, I've disabled SIP:
csrutil status
System Integrity Protection status: disabled.
Thus I'm wondering if SIP is the real problem here. Thank you in advance for your help.

I've noticed that you can access TCC.db even with SIP enabled, if you grant Full Disk Access to Terminal.app and then open the TCC.db with sqlite3. Note: tested with macOS 11 Big Sur.

jacobsalmela · 2020-11-20T22:23:09Z

That makes sense and is a good solution for this issue I think--assuming you're comfortable doing it. Thanks for the note!

Tatsh · 2020-11-23T03:05:47Z

Hi,
I'm on Mojave 10.14.6. When I try to use tccutil, I get :
sudo tccutil --list
Error opening Database.  You probably need to disable SIP for this to work.
However, I've disabled SIP:
csrutil status
System Integrity Protection status: disabled.
Thus I'm wondering if SIP is the real problem here. Thank you in advance for your help.
I've noticed that you can access TCC.db even with SIP enabled, if you grant Full Disk Access to Terminal.app and then open the TCC.db with sqlite3. Note: tested with macOS 11 Big Sur.

Access, but are you able to write to it?

jacobsalmela · 2021-01-27T12:55:30Z

I'm moving this into a Discussion.

#44

jacobsalmela changed the title ~~Sierra Beta~~ TCC.db protected by SIP in Sierra Sep 12, 2016

jacobsalmela mentioned this issue Oct 8, 2016

Can't remove "Upgrade to OS X El Capitan" nag annoyance on OS X 10.9 jacobsalmela/NCutil#14

Open

jfindlay mentioned this issue Oct 31, 2016

macOS assistive execution module fails on 10.12 saltstack/salt#37356

Closed

dhoer mentioned this issue Feb 12, 2017

TCC.db protected by SIP in Sierra dhoer/chef-privacy_services_manager#5

Open

jacobsalmela mentioned this issue Oct 16, 2019

File "./tccutil", line 76 print "%s %s" % (util_name, util_version) #30

Closed

jacobsalmela self-assigned this Oct 17, 2019

brycebostwick mentioned this issue Dec 8, 2019

Add insert support for Catalina #32

Merged

jacobsalmela mentioned this issue May 14, 2020

add more verbose warning for error opening database #35

Merged

kdeldycke mentioned this issue Jan 20, 2021

tccutil on BigSur kdeldycke/dotfiles#21

Closed

jacobsalmela closed this as completed Jan 27, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TCC.db protected by SIP in Sierra #18

TCC.db protected by SIP in Sierra #18

avivais commented Sep 3, 2016

avivais commented Sep 3, 2016

jacobsalmela commented Sep 12, 2016

avindra commented Jan 17, 2017

keyurp1987 commented Oct 18, 2017

jacobsalmela commented Oct 20, 2017

Tatsh commented Feb 11, 2018

jacobsalmela commented Feb 11, 2018

Tatsh commented Feb 11, 2018

jacobsalmela commented Feb 12, 2018

Tatsh commented Jul 30, 2018

jacobsalmela commented Aug 4, 2018

paulz commented Aug 30, 2018

ccstone commented Sep 1, 2018

ssbarnea commented Dec 29, 2018 •

edited

Loading

Ge0rges commented Feb 1, 2019

Tatsh commented Feb 1, 2019

jacobsalmela commented Oct 17, 2019

danielbayley commented Mar 14, 2020 •

edited

Loading

jacobsalmela commented Mar 14, 2020

jacobsalmela commented Mar 15, 2020

danielbayley commented Mar 16, 2020 •

edited

Loading

LeoGrin commented Jul 8, 2020 •

edited

Loading

jacobsalmela commented Jul 8, 2020

Squactopus commented Aug 4, 2020 •

edited

Loading

paulz commented Aug 4, 2020

jacobsalmela commented Aug 5, 2020

mike-myers-tob commented Nov 20, 2020

jacobsalmela commented Nov 20, 2020

Tatsh commented Nov 23, 2020

jacobsalmela commented Jan 27, 2021

TCC.db protected by SIP in Sierra #18

TCC.db protected by SIP in Sierra #18

Comments

avivais commented Sep 3, 2016

avivais commented Sep 3, 2016

jacobsalmela commented Sep 12, 2016

avindra commented Jan 17, 2017

keyurp1987 commented Oct 18, 2017

jacobsalmela commented Oct 20, 2017

Tatsh commented Feb 11, 2018

jacobsalmela commented Feb 11, 2018

Tatsh commented Feb 11, 2018

jacobsalmela commented Feb 12, 2018

Tatsh commented Jul 30, 2018

jacobsalmela commented Aug 4, 2018

paulz commented Aug 30, 2018

ccstone commented Sep 1, 2018

ssbarnea commented Dec 29, 2018 • edited Loading

Ge0rges commented Feb 1, 2019

Tatsh commented Feb 1, 2019

jacobsalmela commented Oct 17, 2019

danielbayley commented Mar 14, 2020 • edited Loading

jacobsalmela commented Mar 14, 2020

jacobsalmela commented Mar 15, 2020

danielbayley commented Mar 16, 2020 • edited Loading

LeoGrin commented Jul 8, 2020 • edited Loading

jacobsalmela commented Jul 8, 2020

Squactopus commented Aug 4, 2020 • edited Loading

paulz commented Aug 4, 2020

jacobsalmela commented Aug 5, 2020

mike-myers-tob commented Nov 20, 2020

jacobsalmela commented Nov 20, 2020

Tatsh commented Nov 23, 2020

jacobsalmela commented Jan 27, 2021

ssbarnea commented Dec 29, 2018 •

edited

Loading

danielbayley commented Mar 14, 2020 •

edited

Loading

danielbayley commented Mar 16, 2020 •

edited

Loading

LeoGrin commented Jul 8, 2020 •

edited

Loading

Squactopus commented Aug 4, 2020 •

edited

Loading