macOS: request Files and Folders access from python

Question

Is there a way to request Files and Folders access on macOS from python?

Specifically, this is a Chrome extension, using native host messaging, that invokes a python script which calls os.listdir on a removable volume.

When I run the script from a terminal, os.listdir returns the listing as expected.

When I run the script from the extension (i.e. from the "path" key in the native host manifest), os.listdir (and other os. functions) throws a permission exception 'Operation not permitted'.

Looks like this is just the way of the world now, so I'd like to find the least-invasive and clearest way to prompt the user to add the correct permission.

The only workaround I found so far is to have the native host manifest call a wrapper script that invokes a terminal to call the original script. Since the terminal has the correct permissions (in my case, it did prompt me for the permissions the first time), the entire script runs as expected.

The files:

/Library/GPSIO/filetest.py (this has execute permissions)

#!/usr/bin/env python3
import os
import time

gpxdir='/Volumes/NONAME/Garmin/GPX' # this is the removable drive
try:
    l=str(os.listdir(gpxdir))
except Exception as e:
    l=str(e)

with open(os.path.join(os.path.expanduser('~'),'log.txt'),'w') as f:
    f.write(time.strftime("%a %d %b %Y %H:%M:%S")+"
")
    f.write(l)

Native host manifest:

{
  "name": "com.blahblahblah",
  "description": "GPS IO",
  "path": "/Library/GPSIO/filetest.py",
  "type": "stdio",
  "allowed_origins": [
    "chrome-extension://blahblahblahblah..../"
  ]
}

~/log.txt, after running filetest.py from a terminal:

Sat 04 Dec 2021 10:27:08
['Contacts', 'Current', 'Nav', 'gpsio2021_11_29_091524.gpx', 'gpsio2021_12_02_123606.gpx']

~/log.txt, after running filetest.py from the extension (i.e. by calling whatever part of the extension that invokes the native host):

Sat 04 Dec 2021 10:28:06
[Errno 1] Operation not permitted: '/Volumes/NONAME/Garmin/GPX'

For the workaround, if I instead call this file from the native host manifest, then filetest.py is actually running inside a terminal, and after mac asks for permission, it runs as expected:

#!/usr/bin/python3
import os
os.system("""osascript -e 'tell application "Terminal" to do script "/Library/GPSIO/filetest.py"'""")

After that initial request for permission, you can control the behavior like a light switch by toggling 'Removable Volumes' in System Preferences --> Security & Privacy --> Privacy --> Files and Folders --> Terminal - but only as long as you are still running that wrapper which invokes a real terminal:

Ultimately, it would be very helpful - much more clear to the user; much less workaroundish for the host executable; and tighter permissions, rather than giving the permission to the terminal app as a whole - to have the "plain" native host, filetest.py, ask for its own permissions - such that it appears as its own app in the permissions list, like this other adobe app does:

Is that possible? Are there other ways to accomplish the goal of having the os.listdir function work as expected when called from the extension?

macOS: request Files and Folders access from python

0 Answers