0

In macOS preferences, there is a "Security and Privacy" icon.

In the "Privacy" tab, I can see "Full Disk Access" and "Files and Folders".

I can allow specific apps to access to Desktop or Documents folders for example.

Some applications are not present in "Full Disk Access" and "Files and Folders". For example Thunderbird. So Thunderbird can access to the whole disk.

My questions are:

  • Why is Thunderbird not present in the "Full disk Access" and "Files and Folders" sections?
  • How can I add Thunderbird in these sections in order to disallow Thunderbird to access to Documents folder for example ?
  • Is it possible to add other folders (for example if I want to protect a subfolder of Documents folder)?
IconDaemon
  • 19,234
Bob5421
  • 119

2 Answers2

1

You're making an incorrect assumption: apps that aren't listed are not allowed access to "private" file & folder areas. Not being listed is equivalent to being listed, but with access denied.

The basic idea is that software has to ask for your permission to access private data. Generally, the first time a particular app tries to access a particular category of private data (or use something like the camera or microphone), the system will ask you if that's ok, and your answer will be reflected in the Security & Privacy preferences (and you can change it there). Thunderbird isn't listed because it's never tried to access private file/folder areas.

I should maybe also explain that macOS actually has three(ish) layers of access restrictions/permissions, and for a program to access something it must be allowed by all of the layers (i.e. any layer can veto access):

  1. macOS has "normal" user-based unix file & folder permissions. If you have multiple user accounts on the Mac, this is what restricts your access to each other's files. It also restricts access to a lot of the OS itself (e.g. a non-admin user doesn't have free access to install & remove apps).

  2. Recent versions (since El Capitan v10.11) of macOS also have "System Integrity Protection" (SIP), which adds additional protection to the core OS (mostly to limit malware's ability to get around/past the first type of permissions). See my answer here.

    Starting in macOS Catalina (v10.15), this is reinforced by storing most system files on a separate volume that is mounted read-only, and starting in Big Sur (v11.0) the system volume is also cryptographically sealed (see here).

  3. Even newer versions (since Mojave v10.14) also have "Personal Information Protection" aka "Transparency Consent and Control" (TCC), which is the one we're talking about here. This restricts apps' access to certain private categories of files & folders, data, etc, unless you grant the app access. See here for more info.

    Note that the categories of access that can be controlled with TCC are not customizable. For example, you can't decide you want your Public folder to be considered private, and require permission to access. Similarly, you can't apply separate access restrictions to a subfolder of Documents.

    Also, granting an app "Full Disk Access" only grants it that access as far as the TCC layer is concerned; it's still fully subject to SIP and unix permission restrictions.

  4. Application sandboxing could be considered a fourth layer. This one is opt-in for the application, and restricts the app's access to anything outside its private sandbox.

Gordon Davisson
  • 33,702
  • Thanks but you are wrong in your first paragraph : Thunderbird never asked me anything and i can browse the full disk when i want to select an attachement file – Bob5421 Nov 10 '21 at 20:08
  • @Bob5421 AIUI that's because of inferred user intent -- you requested that Thunderbird access that file via the Open dialog, so an exception is made for it. See this Apple developer conference presentation, starting at 24:21. – Gordon Davisson Nov 10 '21 at 21:18
  • Okay thanks a lot. So you mean if Thunderbird was opening a file by itself, it will be rejected ? And what about python scripts ? They are linked to terminal application ? Thanks – Bob5421 Nov 10 '21 at 21:27
  • And sorry but i have another question: If i install Parallels Desktop: The installation requires administration privileges: If i disallow Parallels to access to Documents folder: Parallels won't access to this folder, or is it possible for Parallels to install a kernel module (for example) which will bypass TCC ? Thanks – Bob5421 Nov 10 '21 at 21:38
  • @Bob5421 Yes, if Thunderbird tried to open a file in a private folder without something the OS can identify as your permission, it'd be blocked. For python scripts, it's generally dependent on what application-like-thing they're running under (which would be Terminal if you run them from a Terminal window). I don't know how Parallels Desktop is set up, so I can't really comment on it. – Gordon Davisson Nov 10 '21 at 23:25
0

Thunderbird is not present in this section because its developers didn't believe it was required to opt into this security scheme. For most apps, that means that, when trying to access a protected location, a pop up will ask you if you want to permit it. There are only a handful of protected locations, most of the disk is accessible to any program and if you use directories outside of the protected locations, you cannot control access to them per application.

There is a utility that uses undocumented API that allows adding apps and folder permissions. It is found here: https://github.com/jslegendre/tccplus

You do need to turn off system integrity protection for it to do its job, which is generally not recommended to do for security reasons.

Apple supposedly locked down that feature because it would be too easy for users to be fooled into granting malicious apps permission.

Also note that It is not possible to add arbitrary folders, the list is limited to a fixed set of folders to grant access to.

If you choose to use this feature, make sure to reenable SIP once done. It is not only more secure, but on a Mac with SIP disabled, you will not be offered to update macOS when new versions come out.

Melanie
  • 1
  • Thanks for your answer but this does not make sense if the developer has to require permission. Let's suppose i download a malware: The malware won't ask permission ! – Bob5421 Nov 10 '21 at 18:23
  • To state again and expand on it: There are a handful of locations that a program downloaded from the internet can't access, most notably the Documents folder, but there are others:

    Desktop DeveloperFiles Downloads Network

    Those are the only locations that an application can request access to and they are listed under the application as checkboxes. The entire rest of the disk is accessible to all applications, even malware. You can not add custom paths there and you can not block access to anything not in this list using this feature.

     – Melanie Nov 11 '21 at 19:17
  • I have installed Arduino software. No authorization were asked. I have no Arduino Entry in "Files and Folder" / "Full Disk Access" but this software was able to create a folder in Documents. How can it do that ? Thanks – Bob5421 Dec 03 '21 at 20:19