tccutil reset doesn't remove items from System Default Permissions

Question

Created Feb ’23

Replies 2

Boosts 1

Views 1.8k

Participants 3

We have used Forticlient AV/VPN clients in our environment and I find that after using their client uninstaller there are items still listed in the privacy settings for Full Disk Access. The files they reference have been removed but the TCC.db still contains the "Allowed" setting. I have run into this issue in Big Sur, Monterey and Ventura.

Using the tccutil reset SystemPolicyAllFiles removes them from the GUI (and everything else unfortunately from Full Disk Access) but I find that when querying the TCC.db they still exist with Full Disk Access. Trying to target by bundleID just generates an error. (i.e. tccutil reset SystemPolicyAllFiles com.forticlient.FortiClient returns tccutil: No such bundle identifier "com.fortinet.FortiClientAgent": The operation couldn’t be completed. (OSStatus error -10814.)

With the handy script from Mac-Nerd I can see that there are still entries.

Mac-TCC-DB-Translator.sh output (excerpted)

How can I clear these entries from the TCC.db other than deleting the file? That would be excessively destructive in our environment and troublesome for users.

Boost

Answer 1

madkrupt OP

Apr ’23

I have the same issue, my TCC.db is full of garbage entries from years of developing and downloading applications. It also appears that sometimes not all permissions are working. It seems like it may be an issue of versioning (IE a major application upgrade renders the application without its assigned permissions). Toggling or removing the app from the GUI does nothing.

0

Answer 2

JetForMe OP

Dec ’23

I'm running into this issue now, too. I disabled SIP and manually edited the TCC.db, removing all trace of my app's bundle ID (since tccutil said it couldn't find it), and it still shows up in System Settings -> Privacy & Security -> Accessibility. Double entries for each of two old apps. It must also be recorded somewhere else. Apple needs to be much more transparent about how this stuff works.

0