Background

What is TCC?

TCC is a subsystem on macOS that is responsible for managing which applications
a user has permitted to access certain resources. Its full name is
“Transparency, Consent and Control”. If you’ve ever seen an “Application” would
like to access the camera prompt… that’s TCC.

TCC is used to gate access to resources that Apple considers to be sensitive. Protected
resources include:

• Hardware devices such as the camera and microphone
• Location services
• A user’s photos, contacts, calendar, or reminders
• Files in a user’s desktop, downloads or documents folders
• Data managed by other third-party applications

TCC permissions are mediated by the tccd process that runs as part of macOS.
System frameworks that access sensitive resources use private APIs, such as
TCCAccessRequest to determine whether they have permission to access the
resource. The API performs an interprocess call to tccd, which will trigger a
prompt if it is the first time the application has attempted to access that
class of resource. Otherwise, it will return the stored permission decision.

What is the Platform Sandbox Policy?

For background about what sandboxing is on macOS and how it works, see
Sandboxing on macOS.

The Platform Sandbox Policy is a sandbox policy that is applied to all processes
running on macOS. It is applied transparently to all processes on the system,
irrespective of whether they are explicitly sandboxed.

The Platform Sandbox Policy implements one part of System Integrity Protection
on macOS. It defines and enforces the restrictions on access to the file system,
Mach bootstrap names, IOKit devices, and other resources. Amongst other
things, the platform sandbox policy uses process attributes (such as signing
identity, bundle identifier, and entitlements) to allow specific applications to
bypass restrictions that System Integrity Protection would typically apply to
them. This allows applications that are part of macOS to provide system
functionality, such as app installation and software updates, that would
otherwise be prohibited by System Integrity Protection.

(with user-approval …)

One aspect of TCC that most existing analyses of it miss is that the Platform
Sandbox Policy also backstops TCC. The sandbox kernel extension supports
triggering TCC prompts when a program accesses specific resources, rather than
being limited to merely allowing or denying the access, and the platform sandbox
policy makes use of this facility

Specifically, allow actions in the platform sandbox policy can have a (with user-approval "") modifier attached to them. This triggers an up-call
from the Sandbox kernel extension to the sandboxd user-space helper asking for
TCC approval of the specified type. sandboxd translates this into a call to
tccd, much like a system framework using TCCAccessRequest to verify
that the calling application is permitted to access a given resource.

A “simple” example

Access to the computer’s camera is gated behind the kTCCServiceCamera TCC
policy. Frameworks that provide access to the camera, such as AVFoundation,
explicitly call TCCAccessRequest(kTCCServiceCamera, …) to ensure that the
application is permitted to access the camera. But as the camera is a hardware
device, a sufficiently motivated application could access it directly via the
IOKit framework. To safeguard against this, the Platform Sandbox Profile has a
policy in place for iokit-open-user-client operations that will trigger a TCC
prompt if a camera device is accessed directly via IOKit:

(allow iokit-open-user-client
  (with user-approval "kTCCServiceCamera")
  (require-all
    (process-attribute is-sandcastle-constrained)
    (require-any
      (require-all
        (iokit-registry-entry-class "IOFireWireAVCUserClient")
        (require-any
          (require-not
            (signing-identifier "com.apple.AVCAssistant"))
          (require-not
            (process-attribute is-platform-binary))))
      (require-all
        (iokit-registry-entry-class "IOUSBInterfaceUserClientV2")
        (iokit-usb-interface-class kUSBVideoInterfaceClass)
        (require-any
          (require-not
            (process-attribute is-platform-binary))
          (require-not
            (signing-identifier "com.apple.VDCAssistant"))))
      (require-all
        (require-not
          (%entitlement-is-bool-true "com.apple.camera.iokit-user-access"))
        (iokit-registry-entry-class "AppleCamInUserClient")))))

This triggers a kTCCServiceCamera prompt for any access to
IOFireWireAVCUserClient, IOUSBInterfaceUserClientV2 with class
kUSBVideoInterfaceClass, and AppleCamInUserClient. Platform binaries and
binaries with certain entitlements or identifiers are excluded from the
prompting.

Storage classes

One of the key attributes used within the Platform Sandbox Policy is the concept
of the storage class of a file system object. This is a way of classifying a
given file system object as containing some type of data that may need special
attention.

File system objects are tracked in the sandbox kernel extension as kernel
vnode objects. A given vnode is assigned to exactly one storage class at a
time, though the storage class it is assigned to can change. The sandbox kernel
extension caches the mapping from vnode objects to storage class to avoid
recomputing them. The cache is invalidated in response to certain events
that could cause the mapping to change.

Storage classes are assigned by the Platform Sandbox Policy. The special
storage-class-map sandbox operation is used along with the (with assign-storage-class "") action modifier to determine which storage
class should be assigned to a given file system object. Within this portion of
the policy, the same filter operations that are applicable to file system
operations are available, along with predicates involving process or system
attributes.

There are around 130 storage classes defined by the Platform Sandbox Policy as
of macOS 15.1. Most of the storage classes describe data as belonging to a
specific application or framework (CloudKit, FaceTime, Safari, and many
others), while a handful correspond directly to TCC policies (for instance,
kTCCServiceAddressBook, kTCCServiceSystemPolicyAppBundles,
kTCCServiceSsytemPolicySysAdminFiles). You can see the complete list of storage classes
here.

TCC prompting based on storage classes

Much like the iokit-open-user-client / kTCCServiceCamera case presented above, file system
operations consider a combination of path, storage class, and process attributes to determine
whether an operation should result in a TCC prompt.

A sampling of storage classes

kTCCServiceSystemPolicyNetworkVolumes

(file-attribute local-filesystem)

kTCCServiceSystemPolicyAppBundles

(file-attribute app-bundle)

kTCCServiceSystemPolicyDownloadsFolder

(path (subpath "${any_user_home}/downloads"))

kTCCServiceSystemPolicySysAdminFiles

(path
  "/library/application support/apple/remote desktop/remotemanagement.launchd"
  "/library/preferences/com.apple.security.smartcard.plist"
  "/library/preferences/directoryservice/directoryservice.plist"
  "/library/preferences/systemconfiguration/com.apple.smb.server.plist"
  "/private/etc/auto_home"
  "/private/etc/auto_master"
  "/private/etc/autofs.conf"
  "/private/etc/crontab"
  "/private/etc/exports"
  "/private/etc/master.passwd"
  "/private/etc/passwd"
  "/private/etc/sudo.conf"
  "/usr/lib/cron"
  (prefix "/private/etc/rc.")
  (subpath "/library/directoryservices/plugins")
  (subpath "/library/perl")
  (subpath "/library/preferences/logging")
  (subpath "/private/etc/pam.d")
  (subpath "/private/etc/postfix")
  (subpath "/private/var/at")
  (subpath "/private/var/db/com.apple.xpc.launchd"))

Safari

(path
  (subpath "${any_user_home}/library/caches/com.apple.safari")
  (subpath "${any_user_home}/library/caches/com.apple.safari.safebrowsing")
  (subpath "${any_user_home}/library/caches/com.apple.safaridavclient")
  (subpath "${any_user_home}/library/caches/com.apple.safaritechnologypreview")
  (subpath "${any_user_home}/library/containers/com.apple.safari")
  (subpath "${any_user_home}/library/containers/com.apple.safari.webapp")
  (subpath
    "${any_user_home}/library/containers/com.apple.safaritechnologypreview")
  (subpath "${any_user_home}/library/safari")
  (subpath "${any_user_home}/library/safaritechnologypreview"))