Not allowed on Mojave

[dubf]

I can't get it to work on my MacBook Pro running macOS 10.14 Mojave.
I'm trying to add Camera permissions, since the regular mechanism seems to be unresponsive: it's not picking up the permission request. I even tried deleting the TCC.db but it didn't help. Any idea?

$ tccutil.py -id us.zoom.xos --camera
You are not allowed to do this operation.

When I run with sudo, I just don't get any output, it seems to do nothing.

I also note that the older version of this tccutil utility did not work at all for me.
It didn't show the usage info.

[Michael-Z-Freeman]

SIP off ?

[dubf]

Yes, SIP is off.

[ordinary-hacker]

@dubf I edited a little bit the "legacy" (1.1) version of this and more than some little upgrades what matters is that I added debugging:

import os
import sys
import argparse
import subprocess
from plistlib import readPlist

def is_root():
    return os.geteuid() == 0

def run_sql(sql, debug=False):
    db_path = os.path.expanduser('~/Library/Application Support/com.apple.TCC/TCC.db')
    if not os.path.exists(db_path):
        print(f"[ERROR] TCC.db not found at: {db_path}")
        sys.exit(1)

    cmd = ['sqlite3', db_path, sql]
    if debug:
        print(f"[DEBUG] Running: {' '.join(cmd)}")
    try:
        result = subprocess.run(cmd, check=True, capture_output=True, text=True)
        if debug and result.stdout.strip():
            print(f"[DEBUG] Output: {result.stdout.strip()}")
    except subprocess.CalledProcessError as e:
        print(f"[ERROR] SQLite failed: {e}")
        if e.stderr:
            print(f"[STDERR] {e.stderr.strip()}")
        sys.exit(1)

parser = argparse.ArgumentParser()
parser.add_argument("-e", "--enable", help="Enable App Function", action="store_true")
parser.add_argument("-d", "--disable", help="Disable App Function", action="store_true")
parser.add_argument("-id", "--bundleid", help="Defines App Bundle ID")
parser.add_argument("-p", "--apppath", help="Defines App Path to automatically find Bundle ID")
parser.add_argument("-n", "--appname", help="Defines App Name to automatically find Bundle ID (if app is stored in /Applications/, else, please use --apppath)")
parser.add_argument("--contacts", help="Change Contacts Access Status for the selected app", action="store_true")
parser.add_argument("--calendar", help="Change Calendar Access Status for the selected app", action="store_true")
parser.add_argument("--reminders", help="Change Reminders Access Status for the selected app", action="store_true")
parser.add_argument("--photos", help="Change Photos Access Status for the selected app", action="store_true")
parser.add_argument("--camera", help="Change Camera Status for the selected app", action="store_true")
parser.add_argument("--micro", help="Change Microphone Status for the selected app", action="store_true")
parser.add_argument("--debug", help="Enable debug mode", action="store_true")

args = parser.parse_args()
debug = args.debug

def get_bundle_id():
    if args.bundleid:
        return args.bundleid
    elif args.apppath:
        plist = readPlist(os.path.join(args.apppath, "Contents/Info.plist"))
        return plist["CFBundleIdentifier"]
    elif args.appname:
        plist = readPlist(f"/Applications/{args.appname}.app/Contents/Info.plist")
        return plist["CFBundleIdentifier"]
    else:
        app_path = input("Drag the application here: ").strip()
        plist = readPlist(app_path + "/Contents/Info.plist")
        return plist["CFBundleIdentifier"]

services = {
    "contacts": "kTCCServiceAddressBook",
    "calendar": "kTCCServiceCalendar",
    "reminders": "kTCCServiceReminders",
    "photos": "kTCCServicePhotos",
    "camera": "kTCCServiceCamera",
    "micro": "kTCCServiceMicrophone",
}

if not (args.enable or args.disable):
    parser.print_help()
    sys.exit(0)

if not is_root():
    print("You are not allowed to do this operation (not root)")
    sys.exit(1)

appBundleId = get_bundle_id()

for key, service in services.items():
    if getattr(args, key):
        if args.enable:
            sql = f"""
            INSERT OR REPLACE INTO access VALUES(
                '{service}','{appBundleId}',0,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,{int(os.time())});
            """
            run_sql(sql.strip(), debug)
            print(f"Enabled access to {key.capitalize()}")
        elif args.disable:
            sql = f"""
            DELETE FROM access WHERE service = '{service}' AND client = '{appBundleId}';
            """
            run_sql(sql.strip(), debug)
            print(f"Disabled access to {key.capitalize()}")

You could check if this drops some meaningful output/errors?