screencapture grant: also grant /bin/bash for failure screenshots (RELOPS-2454) - #77
Merged
Merged
Conversation
…LOPS-2454) The failure-screenshot LaunchAgent (ronin macos_screenshot_helper) runs a bash script, so TCC attributes its captures to /bin/bash, not the worker binaries. On SIP-on hosts nothing grants bash (macos_tcc_perms writes it only with SIP off), so screencapture returns wallpaper + app menus only: 475/475 failure screenshots from SIP-on hosts were blank over 2026-09-09..23, vs 0/1,542 on SIP-off hosts. bash is not listed in the Screen Recording pane until added, so it goes in via the "+" button + Go-to-Folder. It is now required by both the already-granted short-circuit and the final verify. Proven on macmini-m4-118: 59KB blank -> 400KB capture with window + clock, row /bin/bash 2/4/0, survives reboot. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Failure screenshots on SIP-on
gecko-t-osx-1500-m4hosts are always blank (RELOPS-2454). The screenshot LaunchAgent (roninmacos_screenshot_helper,com.mozilla.screencapture) runs a bash script, so TCC attributes the capture to/bin/bash, not to the worker binaries that #76 grants. Nothing grants bash on SIP-on hosts (macos_tcc_permswrites it only with SIP off), soscreencapture"succeeds" but returns only the wallpaper and app menus: no windows, and no menu-bar clock.Measured over 2026-09-09..23 (2,091 failure screenshots, 166 hosts):
/bin/bashScreenCaptureWhat
screencapture-approve.shnow also adds/bin/bash. Bash isn't listed in the Screen Recording pane until it's added, so it goes in via the "+" button, the admin sheet and Go-to-Folder, and lands ticked. If bash is already listed but unticked, it's ticked instead./bin/bashis required by both the already-granted short-circuit and the final verify, so a missing bash row fails the step instead of passing it.Proof
Tested on macmini-m4-118 (SIP on) through the real LaunchAgent trigger, with TextEdit frontmost:
/bin/bash 2/4/0, and it survives a reboot.Trade-off
This gives SIP-on hosts the same access SIP-off hosts already have: any bash running as cltbld can capture the screen. A narrower Developer-ID-signed capture helper is the planned follow-up.
🤖 Generated with Claude Code