How macOS Full Disk Access Works and How to Manage It
Summary
An explainer on macOS Full Disk Access, its role in TCC privacy controls, the risks of excessive permissions, and how users and administrators can review and manage access, including through MDM.
Key points
- Full Disk Access is a macOS TCC permission that lets approved applications access files otherwise restricted by the system.
- Malware exploiting TCC bypasses could abuse Full Disk Access to read sensitive data; the article cites XCSSET as an example of malware piggybacking on other TCC permissions.
- Users can review and change application approvals under System Settings > Privacy & Security > Full Disk Access.
- Organizations can use MDM and PPPC payloads to deploy Full Disk Access permissions to managed devices.
- The article explains how to query the TCC SQLite database and distinguishes the system-level database from per-user permission records.
Article Details
- Topic
- macOS Full Disk Access permissions and their management through Transparency, Consent, and Control (TCC) and Mobile Device Management (MDM).
Malware
Vendors
Products
AddigyThere are a handful of MDMs that are out there—Microsoft Intune, Jamf Pro, Addigy, and more.Jamf ProThere are a handful of MDMs that are out there—Microsoft Intune, Jamf Pro, Addigy, and more.macOSIn this series, we've been discussing some of the basic principles around macOS security, such as debunking common macOS security myths and the basics of securing Macs.Microsoft IntuneThere are a handful of MDMs that are out there—Microsoft Intune, Jamf Pro, Addigy, and more.