mac-nerd/tcctool

Scripts to report on macOS TCC/PPPC settings.

TCC Tool

version 2.9, 1 February 2023

Note: Terminal.app (or the process used to launch this script) will need Full Disk Access

What does it do?

Reads the system and user tcc.db and translates the following:

• service name
• client name
• auth_value (allowed, denied)
• auth_reason (user, system default, MDM)
• indirect_object_identifier
• last modified date
• code signing requirement

Outputs the report in CSV

Usage

zsh tcctool.sh [-o outputfile]

If an output file path is not specified, the report text is sent to stdout.

See also:

https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive

To Do

• List of apps present in TCC.db that are no longer installed.
• Offer to clean missing apps from TCC.db with tccutil

tcctool's Issues

macOS 13 broke date -jI hours

It seems there's been a regression in the functionality of date in Ventura which is causing a flood of errors in tcctool like this

While -I hours works on macOS 12 and under it now fails on macOS 13 with with date: illegal time format
Example: date -jI hours -r $(date +%s)

FYI - using the arcane what tool the project and version of date can be obtained but weirdly I can find no difference in the date source code, so who knows how or why it's broken... it's still broken. Time to get explicit with the format as a workaround I guess! 🤷
Ventura - shell_cmds-278

% what $(which date)
/bin/date:
	PROGRAM:date  PROJECT:shell_cmds-278

Monterey - shell_cmds-240.100.15

% what $(which date)
/bin/date:
	PROGRAM:date  PROJECT:shell_cmds-240.100.15

Neat tool, thanks!