Wojciech Reguła:

Looks like moving the user’s TCC db to /private/var/containers/Data/ProtectedSystem/[UUID]/Data/Library/Application Support/com.apple.TCC/ was not the only change in the whole privacy castle of macOS 27. (What btw was a great move as now attackers with full disk access permissions can’t modify your privacy settings)

macOS 27 quietly ships a new privacy mechanism I hadn’t seen documented anywhere: it extends the com.apple.macl protection that has always guarded sandboxed apps’ ~/Library/Containers/<bundle-id>/Data folders to a hand-picked set of non-sandboxed apps’ ~/Library/Application Support/<name> folders too. I noticed it by accident — Firefox’s profile folder was suddenly inaccessible from Terminal, while MacPass, a password manager sitting right next to it, was wide open. That asymmetry didn’t sit well with me, so I pulled the thread. It ends in a hardcoded app allowlist baked into /usr/libexec/sandboxd (thx @ciphwall for the hint), meant to be updated live via XProtect.

Previously:

• Hijacking Apps Using Archive Utility
• Privacy & Security Settings Don’t Show Intent-Based Access
• Resetting TCC
• Persistent File Access via com.apple.macl Xattr

Ready for a glimpse into our future as Apple users? Public betas for macOS 27 Golden Gate, iOS 27, iPadOS 27, and other major Apple operating systems are now available—but beware of bugs and be sure to back up your devices first.

Apple has finally completed its silicon transition: macOS 27 drops all Intel-based Macs, and iPadOS 27 and watchOS 27 each leave five models by the wayside, whereas the iPhone compatibility list remains unchanged.