Top
Best
New

Posted by zdw 6 hours ago

You can't trust macOS Privacy and Security settings(eclecticlight.co)
356 points | 128 commentspage 2
lapcat 3 hours ago|
It turns out the issue is a com.apple.macl extended attribute that gets set on the Documents folder and can't be removed, due to SIP.
ezfe 3 hours ago|
Doesn’t seem like a bug to me - it’s just a poor UI. Two different security systems both working properly but only one has a UI to show the protections.
lapcat 3 hours ago||
Why would you think it's "working properly"?

The app somehow gained a permanent permission that I didn't give and that I can't remove no matter what I do. That's not working properly in any sense.

ezfe 10 minutes ago|||
>I didn't give

This is not true, you do give consent when you pick a folder to open

kccqzy 3 hours ago|||
It’s working properly in the sense that the Apple-provided file picker UI is designed to give permanent file permission access to an app. But the user thinks that access is temporary. It’s a mismatch between the user’s mental model and what’s actually happening.
lapcat 2 hours ago||
> It’s working properly in the sense that the Apple-provided file picker UI is designed to give permanent file permission access to an app.

In the case of sandboxed apps, this is not true. The open panel provides temporary access, and a sandboxed app needs to create a security-scoped bookmark to retain persistent access across launches.

For non-sandboxed apps, it's usually not an issue, because non-sandboxed apps have access to most of the file system by default. The weirdness occurs only for certain files and folders that are restricted by TCC, such as Desktop and Documents. But for non-restricted folders, nothing needs to be done. Observe that if you use the Open from folder... command from Insent on a non-restricted folder, then no com.apple.macl is set on the folder. No special permanent access is granted, because none is required. The only time the system automatically grants permanent access is with TCC-restricted files and folders, so we can't pretend that this is a "normal" thing.

In general, non-sandboxed apps don't even need the open panel for file access. They can just read whatever file they want... except for the TCC-restricted files. The purpose of the open panel in a non-sandboxed app is just to provide a file picker UI to the user.

kccqzy 1 hour ago||
The security-scoped bookmark is exactly why a user should treat all macOS file access permission prompts as permanent. There is also no UI to show to a user whether an app has created a security-scoped bookmark.

And this is for sandboxed apps. You correctly point out that non-sandboxed apps have even more access. So a user’s mental model should be that all open dialogs grant permanent access.

dangus 5 hours ago||
The first thing I wondered after reading this article is whether there might be a scheduled task to run the permission reset similarly to how the author ran it via the command line.

It seems most likely that this is some kind of bug where that command or its underlying actions should be called every time the user unchecks something in the settings panel.

This is what we get when the iPhone’s permission system is grafted on top of a desktop OS that was never designed for it. I think they could have done something that is more Unix-like and yet friendly to the GUI end user.

bombcar 5 hours ago|
This reminds me of the early days of MacOS where "repair permissions" was the magic fix to everything, or so it was rumored.
dangus 5 hours ago||
Whoa you are bringing back some memories.

And it absolutely was a magic fix. I stand by it.

bombcar 3 hours ago|||
I remember verifying it really DID fix some problems (just not all) and it was so easy to do you might as well always do it.

(You could see permissions errors in the logs that would go away after running it, which often didn't really fix anything but could make it faster since it didn't have to error out.)

steve1977 3 hours ago|||
Safari is snappier now
heyaco 4 hours ago||
is this is why apple pushed an update yestersay?
jijji 4 hours ago||
linux and unix before it has been a pretty consistent interface for decades, especially since the introduction of X windows in the 1980's..
MORPHOICES 5 hours ago||
[dead]
dogusyilmaz 4 hours ago||
I guess yes
xvector 4 hours ago||
The post misunderstands how the permission system works.

Giving access to a file via the Open and Save panel is an explicit declaration of consent.

Because the panel is provided by OS itself, the app doesn't get access to the item until the user has selected a folder or file through that panel.

glitchc 4 hours ago|
No, this is definitely a bug. The Privacy and Security panel is part of Settings, which is definitely part of the OS. Saying the Open and Save panel somehow has priority suggests that the Privacy and Security panel is not looking at the same parameters as the Open and Save panel, ergo a bug.
ezfe 3 hours ago||
It’s not a bug and that is clear if you don’t use the documents folder as your example. When granting specific access it is not the same system as when granting general Documents folder access.

The UI just doesn’t reflect this.

glitchc 1 hour ago||
> The UI just doesn’t reflect this.

That's the bug. Either that or MacOS has two separate/distinct mechanisms for managing permissions, which would be a huge security flaw.

ezfe 11 minutes ago||
MacOS has two distinct mechanisms. One gates access to Desktop, Documents, etc. for general access. The other grants access through the Open dialog. The open dialog is always superior because it's consent for a specific location.
throwyu 5 hours ago||
I never trust american and Chinese companies
dackdel 6 hours ago||
can you trust vpn to run well on a mac tho. like mullvad or something good.
MegagramEnjoyer 5 hours ago||
imo, you can't really ever fully trust a closed-source system, which is why I advocate for linux distros, even though I'm a mac user myself (for now)

VPN should be properly implemented though as you're able to verify network requests on your own and don't necessarily have to trust apple. Best guarantee is to have a VPN at router level that can't be circumvented by anything (+ a trusted router vendor)

post-it 5 hours ago||
Yeah, they run fine.
AlexandrB 5 hours ago||
This is a few years old, but at one point Apple was happy to bypass VPN or firewall settings to allow their own apps to communicate[1]. I don't know if this is still true on Tahoe, but I wouldn't be surprised if at least the mechanism still exists. So "they run fine", but they may not do what you expect them to do when it comes to Apple's products/services.

[1] https://www.macworld.com/article/675671/apples-own-programs-...

throwaway290 5 hours ago|
It seems that author basically found a 0day and published it. It's for sure better than selling it on the dark web but maybe it's better first tell it to Apple?
ethanrutherford 5 hours ago||
Not exactly. It's not a "new" attack vector, any software which was malicious would have already been able to attack when you first gave it permission (a prerequisite for this sticky permission issue). If you had downloaded an app and discovered it was malicious the remedy would generally be to uninstall the app, not just "revoke the permission for the one folder".

It's not a good look for Apple, and it's not great that the permission revocation basically doesn't actually work, but any malware that could have infected the system due to this issue would have also been able to infect the system while the permission was still (intentionally) enabled.

throwaway290 4 hours ago||
> If you had downloaded an app and discovered it was malicious the remedy would generally be to uninstall the app

There are many apps that themselves are not malicious but they run untrusted code via plugins and stuff. Like VS Code for example.

So you gave it a permission and then revoked it thinking all is fine. tomorrow an extension was hijacked and it now reads your files. cool?

concinds 4 hours ago|||
Apple Security would instantly close it as "don't see the problem here" if you reported it to them. They have a poor reputation around TCC bug reports.
throwaway290 4 hours ago||
That makes it OK for you to not responsibly disclose a vuln? Cool I guess)
concinds 3 hours ago||
I have nothing to do with any of this.

But since they don't consider these as vulnerabilities in the first place, then yeah, sure.

post-it 5 hours ago||
Not really, just an unintuitive security feature. You still need the user's permission to access that folder, but that permission is then persistent. I consider it a UX bug for sure but not an exploit.
lugoues 5 hours ago||
I agree, it's a ui/ux problem. It would seem that using the open file dialog should also request access but I'm guessing that was too intrusive and the user action is seen as implicit authorization. Security is one of those things that should aways be explicit though.
More comments...