bypassing-macos-gatekeeper-tcc-and-sip

name	bypassing-macos-gatekeeper-tcc-and-sip
description	Assessing and bypassing macOS userland and platform security controls during authorized engagements - Gatekeeper/quarantine notarization checks, the TCC (Transparency, Consent & Control) privacy database, System Integrity Protection (SIP/rootless), and the App Sandbox - using codesign, spctl, xattr, sqlite3 against TCC.db, csrutil, sandbox-exec, and AppleEvents/Automation abuse.
domain	cybersecurity
subdomain	macos-security
tags	["penetration-testing","macos","security-controls-bypass"]
version	1.0
author	xalgorix
license	Apache-2.0

Bypassing macOS Gatekeeper, TCC, and SIP

When to Use

• During authorized macOS assessments evaluating the strength of platform protections
• When testing whether downloaded/quarantined payloads can evade Gatekeeper and notarization
• When an app holds (or can obtain) TCC permissions like Full Disk Access, camera, or Automation
• When assessing SIP integrity, rootless entitlements, and sealed system volume protections
• When a process runs inside the App Sandbox and you need to map or escape its profile

Critical: Techniques Most Often Missed

1. Gatekeeper only checks quarantined files

Gatekeeper/notarization checks run only on files carrying the com.apple.quarantine xattr. Files written by non-quarantining tools (many BitTorrent clients) or with the attribute stripped skip the check entirely. AMFI re-verifies signatures on subsequent launches, but Gatekeeper itself is not run every time.

xattr file.app                                 # is com.apple.quarantine present?
xattr -l portada.png                           # inspect quarantine value + writing app
xattr -d com.apple.quarantine payload.app      # strip it (needs the file writable)
find . -iname '*' -print0 | xargs -0 xattr -d com.apple.quarantine
spctl --assess -vv /Applications/App.app       # what Gatekeeper would decide

How to CONFIRM: xattr shows no com.apple.quarantine (or it was removed), and spctl --assess returns accepted/no prompt; the app launches without the first-run dialog.

2. TCC.db is the source of truth — read it from a privileged context

Approvals live in SQLite: the SIP-protected system DB /Library/Application Support/com.apple.TCC/TCC.db and the per-user $HOME/Library/Application Support/com.apple.TCC/TCC.db. Both are TCC-protected for read, so query them from an FDA/privileged process.

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db \
  "select service, client, auth_value, auth_reason from access;"
# Find everything granted Full Disk Access:
sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db \
  "select client from access where service='kTCCServiceSystemPolicyAllFiles' and auth_value=2;"

: denied(0), unknown(1), allowed(2), limited(3). With write access to a TCC.db you can an row (service, client, client_type 0=bundleid/1=path, auth_value 2, valid blob) to grant yourself a permission.