--- name: bypassing-macos-gatekeeper-tcc-and-sip-3a5c59e6c176 description: Assessing and bypassing macOS userland and platform security controls during authorized engagements - Gatekeeper/quarantine notarization checks, the TCC (Transparency, Consent & Control) privacy database, System Integrity Protection (SIP/rootless), and the App Sandbox - using codesign, spctl, xattr, sqlite3 against TCC.db, csrutil, sandbox-exec, and AppleEvents/Automation abuse. domain: cybersecurity subdomain: macos-security tags: - penetration-testing - macos - security-controls-bypass version: '1.0' author: Krishna Kumar (xalgord) license: Apache-2.0 --- # Bypassing macOS Gatekeeper, TCC, and SIP ## When to Use - During authorized macOS assessments evaluating the strength of platform protections - When testing whether downloaded/quarantined payloads can evade Gatekeeper and notarization - When an app holds (or can obtain) TCC permissions like Full Disk Access, camera, or Automation - When assessing SIP integrity, rootless entitlements, and sealed system volume protections - When a process runs inside the App Sandbox and you need to map or escape its profile ## Critical: Techniques Most Often Missed ### 1. Gatekeeper only checks quarantined files Gatekeeper/notarization checks run **only on files carrying the `com.apple.quarantine` xattr**. Files written by non-quarantining tools (many BitTorrent clients) or with the attribute stripped skip the check entirely. AMFI re-verifies signatures on subsequent launches, but Gatekeeper itself is not run every time. ```bash xattr file.app # is com.apple.quarantine present? xattr -l portada.png # inspect quarantine value + writing app xattr -d com.apple.quarantine payload.app # strip it (needs the file writable) find . -iname '*' -print0 | xargs -0 xattr -d com.apple.quarantine spctl --assess -vv /Applications/App.app # what Gatekeeper would decide ``` **How to CONFIRM:** `xattr` shows no `com.apple.quarantine` (or it was removed), and `spctl --assess` returns `accepted`/no prompt; the app launches without the first-run dialog. ### 2. TCC.db is the source of truth — read it from a privileged context Approvals live in SQLite: the SIP-protected system DB `/Library/Application Support/com.apple.TCC/TCC.db` and the per-user `$HOME/Library/Application Support/com.apple.TCC/TCC.db`. Both are TCC-protected for read, so query them from an FDA/privileged process. ```bash sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \ "select service, client, auth_value, auth_reason from access;" # Find everything granted Full Disk Access: sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \ "select client from access where service='kTCCServiceSystemPolicyAllFiles' and auth_value=2;" ``` `auth_value`: denied(0), unknown(1), allowed(2), limited(3). With write access to a TCC.db you can `INSERT` an `access` row (service, client, client_type 0=bundleid/1=path, auth_value 2, valid `csreq` blob) to grant yourself a permission. **How to CONFIRM:** the row exists with `auth_value=2` and a matching `csreq`; the target app then exercises the permission without prompting. ### 3. Automation (AppleEvents) → Finder's implicit Full Disk Access `kTCCServiceAppleEvents` over `com.apple.Finder` lets you drive Finder, which **always has FDA** (even though it isn't shown in the UI), to copy TCC-protected files. ```applescript osascript<&1 | grep -E "Authority|TeamIdentifier" codesign --verify --verbose /Applications/App.app # tamper check codesign -d --entitlements :- /Applications/App.app # TCC-relevant entitlements spctl --assess --verbose /Applications/App.app # notarization/Gatekeeper verdict ``` Apps need the relevant entitlement (e.g., `com.apple.security.device.camera`) even to request a resource. Apple apps carry pre-granted `com.apple.private.tcc.allow` and never prompt or appear in TCC.db. ### Step 2: Enumerate Gatekeeper policy and the syspolicy DB ```bash spctl --status # assessments enabled? sudo spctl --list # current rules sqlite3 /var/db/SystemPolicy "SELECT requirement,allow,disabled,label FROM authority WHERE label!='GKE' AND disabled=0;" log stream --style syslog --predicate 'process == "syspolicyd"' # live decisions ``` Note: from macOS 15 Sequoia, `spctl --master-disable/--global-disable` no longer work; policy is managed via System Settings or an MDM `com.apple.systempolicy.control` profile. The Finder Ctrl+Open bypass is removed. ### Step 3: Hunt and exercise TCC grants ```bash # both DBs (from an FDA context) for db in "$HOME/Library/Application Support/com.apple.TCC/TCC.db" \ "/Library/Application Support/com.apple.TCC/TCC.db"; do sqlite3 "$db" "select service, client, auth_value from access where auth_value=2;" done tccutil reset All com.some.bundle.id # users may reset/query rules ``` Check the `com.apple.macl` xattr (drag-and-drop grants store an app UUID; SIP-protected, removable only via zip/delete/unzip). Map a process's effective grants via its responsible process. ### Step 4: Assess SIP and rootless protections ```bash csrutil status # SIP enabled? csrutil authenticated-root status # sealed system volume ls -lOd /usr/libexec # 'restricted' flag = SIP-protected ls -lOd /usr/libexec/cups # 'sunlnk' = undeletable cat /System/Library/Sandbox/rootless.conf # protected paths; * = exception ``` Look for SIP-bypass primitives: entitlement `com.apple.rootless.install[.heritable]` (Shrootless / CVE-2022-26712), `system_installd` sourcing `/etc/zshenv` during Apple-signed pkg installs, `systemmigrationd` honoring `BASH_ENV`/`PERL5OPT`, or a non-existent path listed in `rootless.conf` you can create. A `rootless.conf` entry that doesn't yet exist (e.g., a plist under `/System/Library/LaunchDaemons`) can be created for SIP-resident persistence. ### Step 5: Map and escape the App Sandbox Any binary with `com.apple.security.app-sandbox` runs sandboxed; containers live in `~/Library/Containers/{BundleID}`. Profiles use SBPL (Scheme). On macOS, processes opt in to the sandbox themselves. ```bash # run a binary under a custom profile and trace every check cat > /tmp/trace.sb <<'EOF' (version 1) (trace /tmp/trace.out) EOF sandbox-exec -f /tmp/trace.sb /bin/ls log show --style syslog --predicate 'eventMessage contains[c] "sandbox"' --last 30s # inspect a running PID's sandbox state (platform binaries / sbtool) sbtool inspect ``` Review system profiles in `/System/Library/Sandbox/Profiles/*.sb` and `/usr/share/sandbox/`. App Store apps use `application.sb`. Anything a sandboxed app creates gets the quarantine attribute. ## Key Concepts | Concept | Description | |---------|-------------| | **Gatekeeper** | Verifies developer signature + Apple notarization before first run; enforced by `syspolicyd` | | **Quarantine xattr** | `com.apple.quarantine` flag; Gatekeeper checks ONLY quarantined files | | **Notarization** | Apple Notary Service ticket "stapled" to apps; absence/strip can skip checks | | **TCC** | Privacy framework gating camera, mic, FDA, Automation, etc.; state in TCC.db SQLite | | **csreq** | Code-signing requirement blob in TCC.db binding a grant to a specific signed binary | | **Entitlements** | Plist capabilities in the code signature; required to even request a TCC resource | | **SIP / rootless** | Kernel-enforced protection of system paths; flags `restricted`/`sunlnk`, config `rootless.conf` | | **Sealed System Volume** | Cryptographically signed, read-only system snapshot mounted at `/` | | **App Sandbox (Seatbelt)** | MACF-enforced profile (SBPL) limiting a process to allowed operations | ## Tools & Systems | Tool | Purpose | |------|---------| | **codesign** | Inspect signature, TeamID, entitlements; verify tampering | | **spctl** | Query Gatekeeper status, assess apps, manage labels (read-only on Sequoia+) | | **xattr** | View/strip `com.apple.quarantine` and `com.apple.macl` attributes | | **sqlite3** | Read/modify TCC.db `access` table and the `/var/db/SystemPolicy` authority table | | **tccutil** | Reset/query TCC permissions | | **csrutil** | Check SIP and sealed-root status (configured only in recovery) | | **osascript** | Drive AppleEvents/Automation (Finder/Automator) to abuse FDA | | **sandbox-exec / sbtool** | Run under a profile, trace sandbox checks, inspect a PID's sandbox state | | **log stream/show** | Observe syspolicyd, XProtect, and sandbox decisions | ## Common Scenarios ### Scenario 1: Quarantine strip A payload downloaded outside a quarantining app (or after `xattr -d com.apple.quarantine`) launches without any Gatekeeper prompt because no quarantine flag triggers the check. ### Scenario 2: FDA app abused to copy TCC.db An app with Full Disk Access (or Automation over Finder) reads the system TCC.db and stages it, enabling offline analysis of all granted privacy permissions. ### Scenario 3: TCC.db row injection With write access to a user TCC.db, an attacker inserts an `access` row with `auth_value=2` and a valid `csreq`, silently granting a controlled app a sensitive permission. ### Scenario 4: SIP-resident persistence via rootless.conf gap A path listed in `rootless.conf` that does not yet exist (e.g., a LaunchDaemon plist) is created, planting a payload in a SIP-protected location resistant to removal. ## Output Format ``` ## macOS Protection Bypass Finding **Vulnerability**: TCC bypass via Automation → Finder Full Disk Access **Severity**: High (CVSS 7.7) **Control**: Transparency, Consent & Control (TCC) **Host**: macHost.local (macOS 14.4, SIP enabled) ### Reproduction Steps 1. App holds kTCCServiceAppleEvents over com.apple.Finder 2. osascript drives Finder (implicit FDA) to duplicate TCC.db to /tmp 3. sqlite3 dumps all granted privacy permissions ### Evidence | Artifact | Detail | |----------|--------| | Granting row | kTCCServiceAppleEvents / / auth_value=2 | | Exfiltrated | /tmp/TCC.db (system, normally SIP/TCC protected) | | Verdict | spctl --assess: accepted (notarized) | ### Recommendation 1. Restrict Automation grants; review apps with FDA / AppleEvents over Finder 2. Keep SIP enabled; monitor TCC.db and com.apple.macl integrity 3. Enforce Gatekeeper via MDM com.apple.systempolicy.control profile 4. Alert on quarantine-attribute removal and syspolicyd anomalies 5. Sandbox third-party apps and minimize entitlement grants ``` --- Source attribution: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/macos-security/bypassing-macos-gatekeeper-tcc-and-sip/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2026 xalgord Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: xalgord Original project: https://github.com/xalgord/xalgorix/blob/cec44d71b1d998208e1e2091982d0ee2f928041f/internal/tools/skills/data/macos-security/bypassing-macos-gatekeeper-tcc-and-sip/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Security Engineer Specialties: Backend Tools: Sqlite3 Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 9938ac908e88d8d6c72d3a6659a2714cf83453b07a1db227c31537b7647d5d56