search

univ-of-utah-marriott-library-apple / privacy_services_manager

A single management utility to administer Location Services, Contacts requests, Accessibility, and iCloud access in Apple's OS X.
MIT License
126 stars 10 forks source link

SIP on Sierra blocks changes to the accessibility database #51

Open hb3b opened 7 years ago

hb3b commented 7 years ago

ERROR: OperationalError: attempt to write a readonly database

uurazzle commented 7 years ago

Hello hb3b:

Here is a workaround the issue...

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.locationd.plist sudo /usr/libexec/PlistBuddy -c "Set :com.apple.locationd.bundle-/System/Library/PrivateFrameworks/AssistantServices.framework:Authorized true" /var/db/locationd/clients.plist sudo launchctl load /System/Library/LaunchDaemons/com.apple.locationd.plist

uurazzle commented 7 years ago

Hello Ben:

Here is a workaround the issue...

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.locationd.plist sudo /usr/libexec/PlistBuddy -c "Set :com.apple.locationd.bundle-/System/Library/PrivateFrameworks/AssistantServices.framework:Authorized true" /var/db/locationd/clients.plist sudo launchctl load /System/Library/LaunchDaemons/com.apple.locationd.plist

Hope this helps

On Jan 30, 2017, at 12:52 AM, Ben Hecht notifications@github.com wrote:

ERROR: OperationalError: attempt to write a readonly database

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

dhoer commented 7 years ago

I tried this and it didn't work: https://github.com/dhoer/chef-privacy_services_manager/blob/sierra/providers/default.rb#L25-L38

Error: https://travis-ci.org/dhoer/chef-privacy_services_manager/jobs/200815034#L406

Any advice on what to try to resolve this SIP issue would be welcomed.

uurazzle commented 7 years ago

Currently, with macOS Sierra, you have a couple options, modify the TCC database booted from another system like during imaging, others are doing this. Or disable SIP temporarily to make changes using like using a NetInstall to disable/enable SIP and make modification to the TCC database when SIP is disabled. I would recommend sending Apple feedback to include the ability to set items like this via Configuration Profiles.

uurazzle commented 7 years ago

FYI:

Here is one workaround the SIP restrictions, not sure this will work for your environment or system management, but...

Once rebooted, no restrictions will be on the TCC.db even while SIP is enabled.

You might be able to create a NetInstall script that does the above steps that could be include in a imaging process.

Hope this helps.

dhoer commented 7 years ago

Thank you for the help!

uurazzle commented 7 years ago

Note, this workaround might go away in a future OS upgrade. I would recommend filing a radar to support this functionality using a configuration profile. It's because the folder in question is only set one time via rootless.conf and it's not part of the current core to perpetually protected paths. So if you strip the flag post OS install, then it stays stripped. A major or minor OS update in the future can repair/re-set it.

https://pbs.twimg.com/media/C4qki5zVMAAKLMf.jpg