macOS 27 Full Disk Access popup

[mkkvcs]

Since macOS27 DB1, KnockKnock on startup shows the Full Disk access popup even when it is granted. Clicking Cancel quits KnockKnock but opening the system settings lets it proceed and since FDA is granted, the scan works perfectly. Reproducible 100%

Logs are attached with TCC related entries. The logs show the process when the FDA settings are opened.

knockknock_logs.txt

[WinkelCode]

Same issue here. I removed it from the Full Disk Access list and added it again but the error still appears. It appears to find all items I'd expect.

$ sw_vers
ProductName:		macOS
ProductVersion:		27.0
BuildVersion:		26A5425a

[brentmid]

Same on macOS 27.0 release (26A428, Mac Studio M4), KnockKnock 4.0.3 via Homebrew. Adding a root cause since I dug into it.

Cause: hasFDA() in utilities.m checks isReadableFileAtPath: on ~/Library/Application Support/com.apple.TCC/TCC.db. On macOS 27 that per-user directory does not exist at all (checked from a shell that has FDA: the error is ENOENT, not EPERM), so the probe fails regardless of the grant. tccd never logs a request for KnockKnock, and System Settings shows FDA on.

Effect: GUI shows the popup on every launch (Cancel quits; Open then returning to the app lets the scan run, as reported). Command-line mode is worse: KnockKnock -whosthere exits 255 with ERROR: KnockKnock (Terminal) requires Full Disk Access. and no output, so any scheduled scan silently breaks.

Temporary workaround (until the check is changed): create an empty placeholder so the readability probe passes; the actual scan still runs under the real TCC grant.

mkdir -p "$HOME/Library/Application Support/com.apple.TCC"
: > "$HOME/Library/Application Support/com.apple.TCC/TCC.db"

With that in place -whosthere -pretty -skipVT completes normally (exit 0, full JSON). A more robust check might probe a path that still exists under FDA on 27, e.g. ~/Library/Mail or ~/Library/Safari, or fall back when the TCC path is absent.

[objective-see]

thanks for the bug report 🙏🏽
Should be fixed (now) in latest release: https://github.com/objective-see/KnockKnock/releases/tag/v4.1.0