XProtect asks for full disk access?

[bogdanw]

softwareupdate --history

i'm always checking "Intallations" in "about this Mac"

From Terminal

system_profiler SPInstallHistoryDataType | grep -A 4 "MRT*"

system_profiler SPInstallHistoryDataType | grep -A 4 "XProtect*"

Some commands discussed here no longer work https://forums.macrumors.com/threads/how-to-know-mrt-version.2210895/

 

[unrigestered]

yup, also using system_profiler (though not with grep yet, but cmd+F)
the About this Mac way is more convenient for me for some things though (if they are listed there, as system_profiler is holding a whole bunch more info)

 

[Analog Kid]

I've had in my Full Disk Access list for some time now, not sure when it showed up. It's a bit of a conundrum-- wasn't sure if I should give it access or not. It didn't request access that I remember. Shouldn't need access, given that it's a system service, but I also don't want to deny it access...

 

[bogdanw]

I've had in my Full Disk Access list for some time now, not sure when it showed up. It's a bit of a conundrum-- wasn't sure if I should give it access or not. It didn't request access that I remember. Shouldn't need access, given that it's a system service, but I also don't want to deny it access...

Remove it from the Full Disk Access list and see if it shows up again.

 

[philippe2014]

I removed it from the Full Disk Access list a few hours ago and restarted the system, for the moment it no longer appears.

 

[Analog Kid]

Remove it from the Full Disk Access list and see if it shows up again.

As long as that doesn't cause it to silently fail...

 

[KaliYoni]

Hello, XProtect appears in privacy? and asks for disk access, Monterey version 12.5.1

Apple seems to be in the process of replacing MRT with XProtect Remediator. So it is possible the "XProtect" that has begun appearing in System Preferences/Security & Privacy/Privacy/Full Disk Access is really XProtect Remediator.

----------
For anybody interested, here is some detailed info (this website, The Eclectic Light Company, is well worth following if you're into how macOS works and into troubleshooting):

MRT and XProtect Remediator: an update

During this transition period, with both MRT and XProtect Remediator active on Macs running Catalina and later, what runs when?

eclecticlight.co

Last Week on My Mac: Introducing XProtect Remediator, successor to MRT

MRT’s days appear numbered. On 14 March this year, Apple released its successor – a new version of XProtect, which now does the lot.

eclecticlight.co

 

[philippe2014]

Thanks for the link that sheds light on the story.But still strange that the behavior of having to request authorization for a service that affects security.

 

[OhSoSterling]

Hello, XProtect appears in privacy? and asks for disk access, Monterey version 12.5.1

I've got the same thing here on my MBP 14 M1 Base Model running Monterey 12.5.1 did you give it access?

 

[philippe2014]

I've got the same thing here on my MBP 14 M1 Base Model running Monterey 12.5.1 did you give it access?

Hi no because the request for authorization is strange especially for a protection service and especially at Apple.

 

[philippe2014]

macOS now scans for malware whenever it gets a chance

How macOS now has anti-malware scanners checking your Mac automatically many times each day for the most frequent malware.

eclecticlight.co

I think Xprotect needs full disk permission is quite legit. Yet when I uncheck disk access permission for Xprotect in activity monitor the services don't move and are still present check or uncheck nothing changes. But maybe the authorization request is legitimate in its precise qua for mail, safari, etc. so an authorization imposed by the native system and another granted by the user???

 

[bogdanw]

macOS now scans for malware whenever it gets a chance

How macOS now has anti-malware scanners checking your Mac automatically many times each day for the most frequent malware.

eclecticlight.co

I think Xprotect needs full disk permission is quite legit. Yet when I uncheck disk access permission for Xprotect in activity monitor the services don't move and are still present check or uncheck nothing changes. But maybe the authorization request is legitimate in its precise qua for mail, safari, etc. so an authorization imposed by the native system and another granted by the user???

It makes absolutely no sense for Apple’s own anti-malware protection to request permission from the user. That would mean malware could easily bypass it.

 

[philippe2014]

thank you for your answer exactly, strange behavior that this request for full disk access.

 

[bogdanw]

Easy like this: tccutil reset SystemPolicyAllFiles com.apple.XProtectFramework.XProtect
Notice that reading the database requires sudo, but deleting the Full Disk Access for XProtect does not.

 

[philippe2014]

Good this morning the xprotech request came back I think the best immediately and let uncheck.
See the info in the future to find out why this strange disk access request.
Apple does not disclose any information on a security-sensitive subject.

 

[philippe2014]

I installed macos ventura 7 and XProtect does not ask for full disk access?