How macOS TCC Tracks App Permissions—and How MDM Overrides Can Grant Excessive Access

Summary

An explainer of macOS TCC covers how tccd and its database track app permissions, and warns that MDMOverrides.plist can grant broad access, such as full disk access for bash, without a clear reflection in the UI.

Key points

macOS TCC is managed by tccd, which mediates application requests for services such as microphone access.
The system TCC database records the requesting client, requested service, authorization value, and other metadata.
MDM administrators can deploy PPPC payloads that store TCC permissions in MDMOverrides.plist rather than the TCC database.
Those MDM-managed permissions may not appear in the usual UI, complicating permission reviews and troubleshooting.
The author describes an MDM payload that granted bash full disk access, warning that overly broad permissions can create an opportunity for threat actors to live off the land.