Apple Plans to Tighten Full Disk Access Controls

Article Comments
1

Originally published at: Apple Plans to Tighten Full Disk Access Controls - TidBITS

Last week, Apple said it would be making unspecified changes to Full Disk Access, the macOS “Get Out of Permission Jail Free” card that lets apps access files, email, messages, browsing history, and more. As a newbie developer, I’m particularly curious about what this will entail because some optional features of my own SetShot require Full Disk Access (see “SetShot Tracks macOS Settings Changes,” 19 August 2026). Apple writes:

Updates to Full Disk Access in macOS

October 2, 2026

We give developers powerful APIs to build incredible capabilities into their apps for Apple products, backed by a set of controls designed to protect users’ private data. Full Disk Access largely sidesteps these controls in order to allow backup apps to function properly on the Mac. Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.

Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action. Addressing this is critical. As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.

Apple’s announcement is largely seen as a reaction to Meta’s new Muse AI agent, which seemingly got into data it shouldn’t have. To my mind, that falls into the category of a self-inflicted wound: I cannot recommend installing software (particularly an AI agent!) from a company as ethically bankrupt as Meta, or anything with Elon Musk’s grokky fingerprints on it. What do you think is going to happen?

Notably, nothing like Full Disk Access exists in iOS or any of Apple’s other operating systems apart from macOS. On the Mac, Full Disk Access is essential for powerful utilities like backup apps such as Backblaze, Carbon Copy Cloner, and SuperDuper; disk space analysis apps like GrandPerspective and OmniDiskSweeper; file searching apps like EasyFind and Find Any File; and disk cleaning apps like CleanMyMac and EtreCheck. However, when you look in System Settings > Privacy & Security > Full Disk Access, you may see many other apps listed. All it takes for an app to appear in that list is that it attempts to open a protected file. But that doesn’t mean you need to grant it access.

We won’t know what Apple has planned until it happens, but it’s worth thinking about the importance of Full Disk Access to us. How widespread are such utilities among the TidBITS audience? Do we wish to use our Macs in ways that require Full Disk Access? After you vote in this poll about how many apps you’ve granted Full Disk Access to, scroll through the comments and, for any app that hasn’t been mentioned yet, say what it is and why it needs Full Disk Access. When I report on the results, I’ll say more about how to audit your list.

How many apps have you granted Full Disk Access to?
  • 0
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6–10
  • 11–20
  • 21+
0 voters
1 Like
4

For me, the list is:

Backup

  • Backblaze (including Backblaze Restore and bzbmenu)
  • Carbon Copy Cloner
  • SuperDuper

File search

  • EasyFind
  • Everywhere (a new app I’m testing)

Disk analysis

  • GrandPerspective
  • OmniDiskSweeper
  • OpenDisk (another new app I’m testing)

Settings tracking

  • SetShot
1 Like
5

How about Default Folder X and Keyboard Maestro?

1 Like
6

If you’re granting them full disk access, then sure. I don’t use Default Folder X, so I don’t know what it needs offhand, and I don’t give Keyboard Maestro full disk access because I haven’t needed it for any of the macros I use.

7

I can’t speak for Default Folder X, but I have Keyboard Maestro installed on macOS (Sequoia), and it is not listed under Full Disk Access.

8

FYI, I have 8 entries listed under Full Disk Access that have been granted access; however, several are all apps for the same program.
E.g., ClamXAV has 3 apps listed (and enabled): ClamXAV, and 2 helper apps, clamd and uk.co.canimaansoftware.ClamXAV.

9

At least as interesting to me is how many have asked for it. I’ve granted 20 (actually just turned off one, so 19 but in the same range on the poll), but 50 have asked for it. And I can’t remember the last time I had something fail because it needed Full Disk Access but didn’t have it, so I think at least part of the problem is apps just requesting it… because.

1 Like
10

I don’t think that OnyX was mentioned but that needs access. Also, if you’re running old versions of iTunes and you want to do syncing, it needs access but not for regular playback which is all I use it for.

11

I have 41 apps requesting FDA and have granted it to 19. Some of these apps have helper apps that also request FDA. I have included links to the lesser known apps.

Backup/Sync

  • BackupLoupe (One Stop Shop for Time Machine)
  • Carbon Copy Cloner
  • Chronosync
  • SuperDuper!

File Search/Disk Analysis

  • DaisyDisk
  • EasyFind
  • Find Any File

Malware Diagnostics

  • BlockBlock (BlockBlock monitors common persistence locations and alerts whenever a new persistent component is added.)
  • Malwarebytes Protection
  • SpamSieve

System Analysis

  • EtreCheckPro
  • Onyx

Others

  • smdb
  • sshd-keygen-wrapper
12

What I can’t quite tease out right now is if apps that appear in the list and are disabled actually asked or just did something that caused them to be added? My suspicion is that most did not ask and don’t need it.

13

I have given Full Disk Access to:

BlockBlock
Carbon Copy Cloner
DetectX Swift
KnockKnock
Malwarebytes Protection
OnyX
RansomWhere
Sophos (multiple)

There are 33 applications in my list. Some may be for out-of-date software (example: com.bombich has a generic icon but Carbon Copy Cloner has the “correct” icon). I haven’t looked at my FDA settings for a long time, so I don’t remember which of the blocked applications I explictly set that way.

14

These apps have Full Disk Access on my Mac:

Backup

  • Arq
  • ArqMonitor (part of Arq)
  • Backblaze
  • bzbMenu (part of Backblaze)
  • Carbon Copy Cloner
  • SuperDuper!

Search

  • Find Any File
  • HistoryHound

Filesystem Navigation

  • Bloom
  • Default Folder X
  • ForkLift
  • LaunchBar
  • Path Finder
  • smbd (File Sharing)

Misc

  • Terminal
  • Jettison

One category that I’m particularly concerned about (because I’m the developer of one of them) is apps that help you navigate your filesystem. These include Finder substitutes like Bloom, ForkLift and Path Finder, which obviously need to be able to go in and out of folders so you can browse your files. They also include Default Folder X (my app) and LaunchBar, which let you quickly navigate around your filesystem via menus and a keyboard-based search interface.

These apps need full disk access because you’re relying on them to browse all of your files and folders - it defeats their purpose to restrict them to only a portion of your Mac (at least in most cases). I’m hoping that Apple comes up with tighter controls without kneecapping these applications - but I have to honestly say I’m not optimistic, given how the current privacy controls work.

15

SuperDuper and. CommanderOne

16

Me:

ClipBook
Terminal
GrandPerspective

17

For me it’s Find Any File (search) and Acronis (backup). But the computer is brand new so I haven’t used all apps, yet. DaisyDisk for search probably, too.

Both my apps Mail Archiver and MAX Messges need full disk access. Mail Archiver for the emails from Mail and MAX Messages for the messages from iMessage.

Apple has turned macOS into clicker training. Do normal users really know what they click and why? Or do they just allow everything like for the blasted cookies on each website?

1 Like
18
  • I gave Chrome Full Disk Access because it has it’s own security blocks accessing sites on a local network or html files. Not sure it’s the correct way to do it, and it feels kind of sketchy. Still trying to figure that one out.
  • I remember seeing something about SSH-AskPass, but I don’t have it open on this computer (maybe on another?). I think it had something to do with the 1Password CLI in a remote connection. I also may have enabled it then turned it off.
  • Multipass, an Ubuntu VM from Canonical, needs Full Disk Access to mount any folders in the Documents folder. It doesn’t seem to need access for any other reason.
19
  • BBEdit
  • iTerm
  • TinkerTool
  • plus others already listed above

I have many dozens in the list, but only carefully chosen apps are enabled.

20

I’m not really sure how to answer this fairly because I run with SIP off on my two desktop Macs, and most of the entries on my MacBook are for scripts I wrote myself that run under launchd. But, yes, many of those already mentioned are here, including ChronoSync, FAF, Terminal, Arq and smbd. Put simply, I’d be mortified if barriers were erected that made FDA unreliable under any circumstances.

21

I presume any app that searches for files/whatever needs full disk access? So one that hasn’t been mentioned but which I use is Houdahspot.

22

I’m really not trying to be pedantic, but you answered your own question in the article:

Apps can’t “ask” for Full Disk Access. They can try to access a protected file (which gets them listed), and optionally react to the permissions error by prompting the user to grant them FDA (and even help them by opening the System Settings > Privacy & Security > Full Disk Access panel), but that’s not the same as adding a required permission to their info.plist file in Xcode for, say, access to the Photos library. That is possible; asking for FDA is not. (Again, not directly.)

1 Like