OS X folder access permissions

NateWeatherly · August 7, 2020, 4:01pm

It seems like PhotoFlow doesn’t have permission to access folders in OS X, which is causing problems when I try to load OCIO, Luts, etc. I don’t know much about such things, but I’ve noticed the OS has been asking for permission on behalf of other apps before allowing access to various folders, external volumes, etc. I tried to grant permission in System Preferences → Security & Privacy → Files and Folders but PhotoFlow isn’t listed there with the other apps that have requested permissions.

Carmelo_DrRaw · August 7, 2020, 4:25pm

I guess you are running macOS Catalina, right? I have not (yet) experience with the reinforced security measured introduced in Catalina, and so far no user that could give me some feedback.

I need to find out how I should modify Photoflow’s code in order to request the access permission… @HIRAM did you by chance have a look into that for RT?

HIRAM · August 7, 2020, 4:51pm

In RT what I do is give access by way of the signature entitlement:

github.com

Beep6581/RawTherapee/blob/25c5e62b72ba44b495303650d38c3f4d4242e6d7/tools/osx/rt.entitlements#L11-L14

    
      
          	<key>com.apple.security.temporary-exception.files.absolute-path.read-write</key>
          	<array>
          		<string>/</string>
          	</array>

On first run the security pop-up to grant access to / will show up. BTW it’s called “temporary” because the security access only lasts for the duration of the user interaction.

Carmelo_DrRaw · August 7, 2020, 5:47pm

Thanks! Is RT notarized? If yes, would you have some documentation of the process? That’s still black magic for me

HIRAM · August 8, 2020, 12:37am

From RT macos-bundler bash script, roughly inspired by what I found GIMP.

github.com

Beep6581/RawTherapee/blob/25c5e62b72ba44b495303650d38c3f4d4242e6d7/tools/osx/macosx_bundle.sh#L309-L334

    
      
          # Notarize the app
          if [[ -n $NOTARY ]]; then
              msg "Notarizing the application:"
              ditto -c -k --sequesterRsrc --keepParent "${APP}" "${APP}.zip"
              uuid=`xcrun altool --notarize-app --primary-bundle-id "com.rawtherapee.RawTherapee" ${NOTARY} --file "${APP}.zip" 2>&1 | grep 'RequestUUID' | awk '{ print $3 }'`
              echo "Result= $uuid" # Display identifier string
              sleep 15
              while :
              do
                  fullstatus=`xcrun altool --notarization-info "$uuid" ${NOTARY}  2>&1`  # get the status
                  status1=`echo "$fullstatus" | grep 'Status\:' | awk '{ print $2 }'`
                  if [[ $status1 = "success" ]]; then
                      xcrun stapler staple *app   #  staple the ticket
                      xcrun stapler validate -v *app
                      echo "Notarization success"
                      break
                      elif [[ $status1 = "in" ]]; then
                      echo "Notarization still in progress, sleeping for 15 seconds and trying again"
                      sleep 15
                  else

This file has been truncated. show original

The process starts with the previous section where the app bundle is codesigned. The signed app bundle is compressed and sent to the notary. The notarization completes and the ticket is stapled to the app. In a subsequent section, the dmg is compressed and also notarized.

https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow

HIRAM · August 8, 2020, 9:32am

Here’s a more explicit process for notarization…

Carmelo_DrRaw · August 8, 2020, 10:30am

Many thanks! I suppose you are paying an yearly fee to Apple in order to be allowed to run the notarization process, right?

Do you know if there is a way to allow app bundles to access specific folders without going through the notarization process?

HIRAM · August 8, 2020, 3:23pm

In the code signature, entitlements to specific paths can be specified à la

But the real issue you are facing without Apple Dev membership is the inability for a Catalina/Big Sur user to access entitled paths outside of the sandbox without disabling default system security.

There was talk recently of pixls.us obtaining a team dev account with Apple for signatory use. Signing with your own certificate will certainly work for you, but in the wild the only way for the Notary to personally identify your code signatures (and that you are personally vouching for your code) is initiated by the non-insubstantial financial transaction with Apple.

NateWeatherly · August 9, 2020, 4:12pm

Again, I don’t know much at all about coding and creating software, but there are lots of free/unidentified developer apps where you have to go into system preferences, enter your password, and tell the OS to install/run the app even though it isn’t from an identified/authenticated developer. After that the app works fine. So I don’t think it’s necessary to pay Apple to get permission to access folders, etc, you just have to trigger that initial “unidentified developer” dialog to make the “open anyway” option available in the preferences. Like I said, I don’t really know how this works and I’m just sort of guessing. Could be wrong!

paperdigits · August 9, 2020, 4:16pm

We are open to pixls’ dev accounts, but I’m not sure what that would entail exactly.

NateWeatherly · August 9, 2020, 4:16pm

Yes, I’m on the current/latest OSX. I’d be happy to give feedback if there’s anything I can do to help. I also posted an issue on github about a consistent crash when selecting a film emulation stock from the drop down. I’m guessing that is probably related to the same issue.

HIRAM · August 9, 2020, 4:35pm

Launching the app requires a user to get past this warning (Right-Click Open):
By opening this app, you will be overriding system security which can expose your computer and personal information to malware that may harm your Mac or compromise your privacy.
Getting over that is a real challenge for some.

@Carmelo_DrRaw After that I’m also getting this crash on Big Sur 11ß:
https://github.com/aferrero2707/PhotoFlow/issues/218#issuecomment-671072735

Carmelo_DrRaw · August 9, 2020, 6:43pm

I have seen the message about the crash… I guess the easiest solution is to remove libz from the app bundle, so that the system one is picked instead. Would you have the possibility to check if that is enough?

Regarding the code signing, it will unfortunately take some days before I can look into that, as I am overloaded by work at the moment…

Thanks for your help!

HIRAM · August 10, 2020, 1:12am

Yeah, removing libz does allow it to launch. I can read files in only two locations: ~ and ~/Pictures.

Carmelo_DrRaw · August 10, 2020, 6:30am

Could you please give a try to the latest daily snapshot from the stable branch (available here)? The crash should not occur, and I wonder if anything has changed regarding the folder access…

Thanks!

NateWeatherly · August 11, 2020, 1:55am

Yeah, that’s probably true, although if you tend to use a lot of free/open source apps you start to get kind of numb to it