Bypassing macOS TCC user privacy protections by accident and design
> <i>At least, that’s how it’s supposed to work, but if Alice is an admin user and gives Terminal Full Disk Access (FDA), then Alice can quite happily navigate to Bob’s Desktop and Downloads folders (and everyone else’s) regardless of what TCC settings Bob (or those other users) set... When Alice grants FDA permission to the Terminal for herself, all users now have FDA permission via the Terminal as well. The upshot is that Alice isn’t only granting herself the privilege to access others’ data, she’s granting others the privilege to access her data, too... Any application granted Full Disk Access has access to all user data, by design.</i><p>This indeed seems dangerously counterintuitive.<p>I, like most other people I'd think, always assumed the permission dialogs ("TCC") were a layer of restrictions <i>on top of</i> traditional UNIX user permissions. Not <i>overriding</i> them.<p>In other words, granting full-disk access to an app would give it access to everything <i>my user</i> can access. Not "sudo" access to other users' data as well.<p>Why would an app ever need <i>that</i> level of access? For installing files, maybe, but not while running.<p>Can anyone else confirm this is how macOS actually works? And if there's some justification I'm missing? It seems <i>so</i> crazy that I can't actually believe it without somebody else verifying it.