Golden Gate Application Support Protection

Wojciech Reguła:

Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle of macOS 27. (What btw was a great move as now attackers with full disk access permissions can’t modify your privacy settings)macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the com.apple.macl protection that has always guarded sandboxed apps’ ~/Library/Containers//Data folders to a hand-picked set of non-sandboxed apps’ ~/Library/Application Support/ folders too. I noticed it by accident — Firefox’s profile folder was suddenly inaccessible from Terminal, while MacPass, a password manager sitting right next to it, was wide open. That asymmetry didn’t sit well with me, so I pulled the thread. It ends in a hardcoded app allowlist baked into /usr/libexec/sandboxd (thx @ciphwall for the hint), meant to be updated live via XProtect.

Previously:

• Hijacking Apps Using Archive Utility
• Privacy & Security Settings Don’t Show Intent-Based Access
• Resetting TCC
• Persistent File Access via com.apple.macl Xattr