/tcctool

Scripts to report on macOS TCC/PPPC settings.

Primary LanguageShell

TCC Tool

version 2.9, 1 February 2023

Note: Terminal.app (or the process used to launch this script) will need Full Disk Access

What does it do?

Reads the system and user tcc.db and translates the following:

  • service name
  • client name
  • auth_value (allowed, denied)
  • auth_reason (user, system default, MDM)
  • indirect_object_identifier
  • last modified date
  • code signing requirement

Outputs the report in CSV

Usage

zsh tcctool.sh [-o outputfile]

If an output file path is not specified, the report text is sent to stdout.

See also:

https://www.rainforestqa.com/blog/macos-tcc-db-deep-dive

To Do

  • List of apps present in TCC.db that are no longer installed.
  • Offer to clean missing apps from TCC.db with tccutil