preemptively enable external volume access

Question

Created Aug ’21

Replies 3

Boosts 0

Views 1.1k

Participants 3

We have a network copy utility which reads from an external volume (specifically camera media). We'd like to grant it external volume access at installation time, preferably without having to find and insert media.

But triggering an 'external volumes' dialog (and hence adding an entry to Security / Files and Folders) seems to require accessing an actual external volume.

In contrast Full Disk Access can be granted preemptively, but it's a huge security hazard - it would give the copy utility unrestricted access to the entire machine.

Is it possible to grant 'external volume' access when you don't (yet) have an external volume connected ?

Boost

Answer 1

DTS Engineer OP

Apple

Aug ’21

Is it possible to grant 'external volume' access when you don't (yet) have an external volume connected ?

No. Many TCC privileges have an API to explicitly request that privilege. For example, the Screen Recording privilege has CGPreflightScreenCaptureAccess and CGRequestScreenCaptureAccess. Unfortunately, there is no such API for Files and Folders > Removable Volumes. You can only implicitly trigger a request for that privilege by performing a file system operation on a removable volume.

This would, IMO, make a fine enhancement request. Please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

willcor OP

Aug ’21

Thanks for the quick response. Apple Bug Reporter is no longer available, but I've filed a feedback suggestion - FB9447999

0

Answer 3

DTS Engineer OP

Apple

May ’22

The linked feedback is not found?

Right. In Feedback Assistant you can only see bugs that you filed [1]. The fact that DevForums renders another user’s FB number as a link is quite misleading. I generally work around this by putting such numbers in code style (like FB9447999) but we should do better (r. 92946014).

Would love to add support for getting this issue addressed.

Feedback Assistant doesn’t have a specific mechanism for this, but feel free to file your own bug about this, with a description of your own specific requirements.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] Modulo the relatively recent teams feature, but that won’t help in this case.

0