How do I reset TCC permissions

[janvhs]

Hi, how do I reset TCC permissions?

I have tried the following without success.

tccutil reset ALL com.apple.container
tccutil reset ALL com.apple.container-runtime-linux
tccutil reset ALL com.apple.container.container-runtime-linux.alpine-latest-16a51c

Does someone have an idea? I want to regain access to my Downloads.

Thank you

[stephenlclarke]

My best guess is that macOS is recording the permission against a different process than the one you’re resetting. For CLI tools, TCC often attributes file access to the launcher app, such as Terminal, Ghostty, iTerm2, or VS Code.

For Downloads access, reset SystemPolicyDownloadsFolder service first, not All:

tccutil reset SystemPolicyDownloadsFolder com.apple.container
tccutil reset SystemPolicyDownloadsFolder com.apple.container-runtime-linux
tccutil reset SystemPolicyDownloadsFolder com.apple.container.container-runtime-linux.alpine-latest-16a51c

Also reset the terminal app you actually use:

tccutil reset SystemPolicyDownloadsFolder com.apple.Terminal
tccutil reset SystemPolicyDownloadsFolder com.mitchellh.ghostty
tccutil reset SystemPolicyDownloadsFolder com.googlecode.iterm2
tccutil reset SystemPolicyDownloadsFolder com.microsoft.VSCode

Then quit and reopen the terminal, and restart container:

container system stop
container system start

If it still does not prompt, check the UI:

open "x-apple.systempreferences:com.apple.preference.security?Privacy_FilesAndFolders"

Look under System Settings > Privacy & Security > Files and Folders for Terminal, Ghostty, iTerm2, VS Code, container, or the runtime helper, and toggle Downloads access there.

Notes:

• Use SystemPolicyDownloadsFolder for Downloads access.
• Avoid sudo unless the blocked process runs as root.
• Do not edit TCC.db directly.
• Full Disk Access may supersede the Downloads-specific prompt.

I regurgitated most of this info from what I found here;

• Resetting access to protected resources in macOS
• NSDownloadsFolderUsageDescription
• Allow apps to access your Downloads folder
• Control access to files and folders on Mac
• Change Privacy & Security settings on Mac

Hope this helps

[stephenlclarke]

Also...

This is probably better suited to Apple Developer Forums than to this apple/container discussion.

The issue sounds like macOS TCC / Files & Folders permission state for ~/Downloads, rather than a container-specific bug. I’d ask under one of these tags:

• Privacy
• Files and Storage

If you can show that container is requesting or recording the wrong bundle identity, then it would be worth bringing back here with:

• macOS version
• container version
• launcher app used, such as Terminal, Ghostty, iTerm2, or VS Code
• exact denied path and error
• whether resetting SystemPolicyDownloadsFolder for the launcher changes the behavior

So if my suggestions didn't work for you I’d try Apple Developer Forums next, and use this discussion only if there is evidence that container itself is mishandling the permission request, helper identity, or signing attribution.

[janvhs]

Hi, thanks for the response. The problem I have is that I can't figure out the bundle identifier for the container tool. I tried the com.apple.container ID, because I saw the tool using that ID, but that doesn't seem be registered.

I removed the denials vis the system settings UI, thanks for the tip, but I would like to find out what ID I need to use.

$ tccutil reset All com.apple.container
tccutil: No such bundle identifier "com.apple.container": The operation couldn’t be completed. (OSStatus error -10814.)