Grant full disc access to the Mac OS installer

TidBITS Talk
1

Hello dear Mac specialists,

I wonder if it is possible to grant permanent full disc access to the Mac OS installer. I need to grant this with each and every new or update installation and find it " a bit" annoying with time.

Thanks in advance.

Cheers,

HaPe

2

I doubt it, and I think it would be a bad idea.

You should note that there isn’t any “the Mac OS installer”. Every release of the OS is a separate bundled installer. Each one is a different application.

If Apple would provide a way for some class of apps (like full-OS installers) to gain permissions without asking, then the hacker community would figure out how to exploit it and you’d end up with malware masquerading as an installer and automatically gaining a dangerous amount of permissions.

But that having been said, I do find it strange that you need to grant it permission for “each and every new or update installation”. How are you upgrading your Mac? Are you downloading standalone installers?

On my system, I install updates via the Software Update preference panel and I’ve never had to grant it full disk access.

3 Likes
3

Perhaps I’m misreading, but could @HaPe13 be referring to the application that runs to install .pkg files (/System/Library/CoreServices/Installer.app (at least in Monterey)), and not the installer for an OS update/upgrade (/Applications/Install…)? I suppose, theoretically, you could grant full disk access to Installer.app, but I have to agree with @Shamino, that seems like a security risk with minimal reward.

2 Likes
4

Thanks so much @Shamino and @blm for your replies.

Indeed I was referring to the Installer App (/System/Library/CoreServices/Installer.app (at least in Monterey)).

Indeed I didn’t think of any security risk because whenever I install an application or an update (new version) for it, the installer needs to have full disc access because otherwise the whole installation wouldn’t be possible. Or am I wrong?

It just annoys me that I always have to start the installation process, then grant disc access and after the installation I have to grant it again that the installer is able to move the package into the trash.

Thanks again and enjoy your weekend.

5

OK. This isn’t for installing operating systems, but is run by any application distributed as an installer package.

But I am surprised you require full disk access for it. I’ve never had to grant any installer that kind of access. Installers typically ask for an admin username and password, in order to write to locations like /Applications and /Library, but aside from that I’ve never needed to grant other permissions.

Maybe this is new for Monterey?

2 Likes
6

Thanks @Shamino and yes, I am often asked twice during an installation. It may be related to Monterey. I am sure that the whole security settings have changed with that update.

When I have the next chance maybe I’ll record short screencast to demonstrate what I am writing about. Whenever I granted the access the first time the message does not appear again and I don’t know the criteria that causes the next question.

Thanks again!

7

I just upgraded from Mojave to Monterey and so have been doing more than my usual number of installs, and I can’t remember ever being asked to grant full disc access during an install. I am asked to authentic on occasion, and am doing installs as an admin user, so maybe that makes a difference. So I’m curious what you’re installing that results in the installer asking for full disk access, and whether you’re doing the install as an admin user or not.

Regardless, I still think permanently granting full disk access to the installer is a bad idea. The worry isn’t packages from well known sources, but those from maybe questionable or lesser known sources, or something that maybe carries malware and could take advantage of installer’s heightened privileges. And maybe there are bugs in the installer that could be exploited, who knows.

2 Likes