Contents

How to List TCC Entries Across All Macs

Using Kolide, you can easily view and query Mac TCC Entries across your fleet.

Introduction

Over the last decade, Apple has worked to provide users with a configurable interface for controlling access to their private data, and for granting permissions to applications. This interface is internally referred to as Transparency, Consent, and Control or TCC for short.

TCC manages the permissions which apps have to access certain protected services, directories and utilities, for example a video conferencing software may request that you grant access to your iSight webcam before it is able to access that hardware.

These preferences are stored in two databases on disk:

/Users/<username>/Library/Application Support/com.apple.TCC/TCC.db
/Library/Application Support/com.apple.TCC/TCC.db

The list of TCC preferences may be reviewed and modified via the macOS GUI by following the steps below:

Open the Apple menu by clicking on the Apple icon at the top-left of your screen.
In the dropdown menu, Click on the item labeled System Preferences
In System Preferences click on the item labeled Security & Privacy
In the Security & Privacy preference pane, click the tab at the top labeled Privacy
This list shows each category of permissions available on your device, the applications which have requested those permissions and the approval state they are currently in.

For more information about TCC permissions please refer to the official Apple Support documentation: Change Privacy preferences on a Mac

What Mac TCC Entry Data Can Kolide Collect?

Kolide's endpoint agent bundles in osquery to efficiently collect Mac TCC Entries from Macs in your fleet. Once collected, Kolide will parse, clean up, and centrally store this data in Inventory for your team to view, query, or export via API.

Kolide meticulously documents every piece of data returned so you can understand the results.

Mac TCC Entries Schema

Column	Type	Description
id	Primary Key	Unique identifier for the object
device_id	Foreign Key	Device associated with the entry
device_name	Text	Display name of the device associated with the entry
access_last_modified_at	Timestamp	The time the TCC permission was last modified on the device
auth_reason	Enum::Text	The reason the `auth_value` was assigned Can be one of the following: `none` - No specific reason was recorded `error` - The authorization could not be determined due to an error `user_consent` - The user explicitly consented via a system prompt `user_set` - The user set the value in System Settings `system_set` - The value was set by the system `service_policy` - The value was determined by a service-specific policy `mdm_policy` - The value was set by an MDM-delivered policy (eg. a PPPC configuration profile) `override_policy` - The value was set by an override policy `missing_usage_string` - Access was denied because the client lacked the required usage description string `prompt_timeout` - The authorization prompt timed out `preflight_unknown` - The pre-flight authorization status was unknown `entitled` - The client was granted access because it carries the appropriate entitlement `app_type_policy` - The value was determined by a policy based on the application type `prompt_cancel` - The user cancelled the authorization prompt
auth_value	Enum::Text	The effective authorization level for the client and service after reconciling the TCC databases with MDM overrides. See `source` for which data source decided it Can be one of the following: `denied` - The client is denied access to the service `unknown` - The authorization status is unknown `allowed` - The client is allowed access to the service `limited` - The client is granted limited access to the service (eg. limited Photos library access) `add_only` - The client may add or modify, but not read, the service's data (eg. add-only Calendar access). Apple's Endpoint Security framework calls this `ADD_MODIFY_ADDED`. Introduced in macOS 14 Sonoma `session` - The client is allowed access only for its current process/login session (eg. an "Allow Once" grant for screen capture). Apple's Endpoint Security framework calls this `SESSION_PID`. Introduced in macOS 14 Sonoma `learn_more` - The user chose to learn more before deciding, deferring the authorization (a secondary prompt stage). Apple's Endpoint Security framework calls this `LEARN_MORE`
client	Text	The application or process the permission applies to, interpreted according to `client_type` (a bundle identifier or an absolute path)
client_type	Enum::Text	How the `client` column should be interpreted. `NULL` when the device did not report an identifier type Can be one of the following: `bundle_identifier` - The client is identified by its bundle identifier (eg. `com.apple.Safari`) `absolute_path` - The client is identified by an absolute path to its executable `policy_id` - The client is identified by a reference to a TCC policy record, typically delivered via an MDM configuration profile (PPPC) `file_provider_domain_id` - The client is identified by a File Provider domain identifier `unknown` - An identifier type Kolide has not yet mapped (eg. a value introduced by a newer macOS release). A reported-but-unrecognized value, as opposed to `NULL` which means no type was reported
indirect_object_identifier	Text	The identifier of the indirect object the permission applies to. Only used for services such as AppleEvents/automation where one application is granted permission to control another (the indirect object is the target). For the majority of permissions, which have no indirect object, macOS stores the placeholder `UNUSED`
indirect_object_identifier_type	Enum::Text	How the `indirect_object_identifier` column should be interpreted. `NULL` when the device did not report a value. Note that when a permission has no indirect object, macOS may store a defaulted `bundle_identifier` (0) alongside the `UNUSED` placeholder Can be one of the following: `bundle_identifier` - The indirect object is identified by its bundle identifier (eg. `com.apple.systemevents`) `absolute_path` - The indirect object is identified by an absolute path to its executable `policy_id` - The indirect object is identified by a reference to a TCC policy record, typically delivered via an MDM configuration profile (PPPC) `file_provider_domain_id` - The indirect object is identified by a File Provider domain identifier `unknown` - An identifier type Kolide has not yet mapped (eg. a value introduced by a newer macOS release). A reported-but-unrecognized value, as opposed to `NULL` which means no type was reported
managed	Boolean	`true` when the effective value is controlled by an MDM/PPPC override (ie. `source` is `MDMOverrides.plist`); otherwise `false`. Filter `managed = true` to see every permission MDM is dictating. Broader than a non-null `superseded_auth_value`, which only flags overrides that replaced a value the TCC database had already recorded
service	Text	The protected TCC service the permission applies to (eg. `kTCCServiceCamera`, `kTCCServiceMicrophone`, `kTCCServiceSystemPolicyAllFiles` for Full Disk Access)
service_display_name	Text	A human-readable name for `service`. Uses the official macOS System Settings (Privacy & Security) pane name where one is known (eg. `kTCCServiceSystemPolicyAllFiles` → `Full Disk Access`); otherwise falls back to a humanized form of the identifier — the `kTCCService`/`kTCCServiceSystemPolicy` prefix stripped and CamelCase split into words (eg. `kTCCServiceFooBar` → `Foo Bar`)
source	Text	The filesystem path of the data source that determined the effective `auth_value`: a per-user TCC database (`/Users/<name>/Library/Application Support/com.apple.TCC/TCC.db`), the system TCC database (`/Library/Application Support/com.apple.TCC/TCC.db`), or the MDM overrides plist (`/Library/Application Support/com.apple.TCC/MDMOverrides.plist`). When this is the MDM overrides plist the value was enforced by policy (`auth_reason` is `mdm_policy`) and `superseded_auth_value` holds any TCC value it replaced
superseded_auth_value	Enum::Text	When an MDM override determined `auth_value`, the TCC database value it replaced; `NULL` when there was no override (ie. `source` is a TCC database path) or the TCC databases had no prior entry. A non-null value here means the on-device record disagreed with the enforced MDM policy Can be one of the following: `denied` - The TCC databases recorded the client as denied before the MDM override `unknown` - The TCC databases recorded the client as unknown before the MDM override `allowed` - The TCC databases recorded the client as allowed before the MDM override `limited` - The TCC databases recorded limited access before the MDM override `add_only` - The TCC databases recorded add-only access before the MDM override `session` - The TCC databases recorded session-scoped access before the MDM override `learn_more` - The TCC databases recorded a deferred (learn-more) state before the MDM override
username	Text	The user account the entry belongs to, or `root` for entries from the system TCC database and MDM overrides
collected_at	Timestamp	Time the row of data was first collected in the database
updated_at	Timestamp	Time the row of data was last changed in the database

What Can You Do With This Information?

Kolide enables you to write your own queries against the data the agent collects. This allows you to build your own reports and API endpoints. For example, you can:

Find applications granted Camera or Microphone access

Show Query

Apps where an MDM override changed the OS-recorded TCC permission

Show Query

Find applications granted Camera or Microphone access

Kolide SQL

SELECT device_name, client, service, auth_value, auth_reason, username
FROM mac_tcc_entries
WHERE service IN ('kTCCServiceCamera', 'kTCCServiceMicrophone')
  AND auth_value = 'allowed'
ORDER BY device_name

Example Results

device_name	client	service	auth_value	auth_reason	username
bamboo	com.google.Chrome	kTCCServiceMicrophone	allowed	user_consent	jordan
conference-room-zoom	com.cisco.webexmeetingsapp	kTCCServiceCamera	allowed	mdm_policy	root
kangaroo	us.zoom.xos	kTCCServiceCamera	allowed	user_consent	ashley

Apps where an MDM override changed the OS-recorded TCC permission

Kolide SQL

SELECT device_name, client, service,
  auth_value AS effective,
  superseded_auth_value AS os_recorded
FROM mac_tcc_entries
WHERE managed = true
  AND superseded_auth_value IS NOT NULL
ORDER BY client, service

Example Results

device_name	client	service	effective	os_recorded
Fritzs-MacBook-Pro	com.crowdstrike.falcon.Agent	kTCCServiceSystemPolicyAllFiles	allowed	denied

Why Should I Collect Mac TCC Entries?

The TCC permissions configured for your device are an important item to audit and review for your IT and Security team. These permissions can indicate malicious applications which have requested additional permissions which will allow them access sensitive information or resources (your microphone or webcam).

Likewise, this information can be important in a troubleshooting context if a user is experiencing difficulty with a particular piece of software which requires permissions (eg. Chrome requesting webcam access in order to perform video conferencing).

Additionally, some security software (like Kolide) may need Full Disk Access permissions in order to adequately inspect the configuration of certain services or applications.

End-User Privacy Consideration

Kolide practices Honest Security. We believe that data should be collected from end-user devices transparently and with privacy in mind.

Because requested TCC permissions typically accompany an installed application, they may indicate or suggest certain personal or private user behavior based on the name of the app. For example:

eCigarette-Vaporizer-Control.app
Adult-Toy-Control.app
Fertility-Window-Tracker.app
Torrenting-Software.app

When you use Kolide to list Mac TCC Entry data from end-user devices, Kolide gives the people using those devices insight into exactly what data is collected, the privacy implications, and who on the IT team can see the data. This all happens in our end-user privacy center which can be accessed directly by employees.