https://github.com/osquery/osquery logo
#fleet
Title
# fleet
h

Harrison

08/31/2022, 4:22 PM
Anyone have a query to see what applications have access to specific privacy setting? For example, what applications have access to “Screen Recording”?
l

Luke Heath

08/31/2022, 6:30 PM
Hey Harrison! That is contained in the TCC database files (machine is in
/Library/Application\ Support/com.apple.TCC/TCC.db
and user settings in
/Users/username/Library/Application Support/com.apple.TCC/TCC.db
- you could use ATC (auto table construction) to parse it if your osquery agent has full disk access. Your mileage may vary on compatibility across macOS versions. Kolide had a really good post on this a few years ago: https://www.kolide.com/blog/macos-catalina-osquery
h

Harrison

08/31/2022, 6:30 PM
Ah yes! This is what I was looking for! Thanks heaps