Updated

macOS Mojave: For app permissions, what’s the difference between Accessibility and Full Disk Access?

Mojave offers new controls to prevent apps from gaining unwanted access.

macos mojave mac app stor
Apple

The Mac has avoided widespread malware, and Apple tries to keep ahead of the ways in which malicious software can gain a foothold in macOS. In 2015 with El Capitan, that was System Integrity Protection, to keep system files from being modified. Sierra in 2017 removed an option to allow unsigned Mac apps to run without a prompt.

Now in Mojave, macOS has forced apps to request certain kinds of system-level privileges for behavior that it generally allowed in previous releases. In some cases with older apps that haven’t been updated, you have to take a manual step to keep them working, too.

If you have any of these apps installed, after upgrading to Mojave you will receive prompts or warnings from them, explaining that you have to approve or add them to the Security & Privacy system preference pane’s Privacy tab. In some cases, apps need a check in a box next them in the Accessibility list; in others, in Full Disk Access. Macworld reader David wonders about the difference.

For both kinds of permission, an app or macOS should prompt you or explain how to proceed. You shouldn’t have to figure out on your own whether you need to add permission or add an app to the list. Mojave is still new, so some developers are still releasing compatibility updates to streamline how they request permission from you.

Accessibility covers more than just input options

Accessibility permission, which appeared in earlier releases of macOS, let apps use features to monitor and affect how you interact with the system that are primarily designed to work with software that helps people with visual, auditory, or motion issues.

In my Accessibility list, I have LaunchBar, Pastebot, and TextExpander, to name just a few. Apple requires explicit permission, because it’s just these kinds of features that can be leveraged and abused by simpler malware that doesn’t dig deeply into exploiting the system, but could, for instance, try to capture your keystrokes.

mac911 mojave accessibility pane IDG

The Accessibility pane lets app use input and interface-monitoring features.

In Mojave, I had to grant permission for some apps in Accessibility that I’d previously given, or even follow instructions provided by the developer to remove entries from the list and then add them back. That was true for TextExpander.

You might wonder why some apps need “accessibility” access when they don’t appear to rely on any input feature. Macworld reader Robert wrote in to complain about a recurring permission dialog he receives with Dropbox to grant it accessibility privileges. He preferred not to, but there’s no Deny button to stop asking about it (as he found with Photoshop Elements, which he opted to deny), only a Not Now button to defer action. 

Dropbox explains at its site that it need accessibility permission for three items that seemingly have no relationship to how you orally, visually, or manually interact with a computer: to update its badge (it shows what the app is up to in the system menu bar), to show to someone else if you’re viewing a file (which requires monitoring whether you’re viewing it), and for better “file synchronization priority” (which I can only assume requires monitoring your file interactions to figure out which are most important).

mac911 dropbox accessibility dialog IDG

Dropbox says it won’t show this dialog again, but that’s not accurate.

Fortunately, Dropbox solved this in an October 10 update that should have appeared for all users automatically. If you’re experiencing this problem, select the Dropbox icon in the menu bar, select Preferences, and look at the About Dropbox version number: if it’s 59 or higher, contact Dropbox for help. If it’s below 59, you can visit the Dropbox Web site and manually download and install the latest update.

Full Disk Access for backup, sync, and clone, and maybe more

Full Disk Access is new, and blocks apps without permission from accessing just any file on a drive that it wants to.

Backup, sync, and cloning software, like Backblaze, ChronoSync, and Carbon Copy Cloner, need full-disk access, and you should make sure you’re up to date with the latest versions of such apps before using them in Mojave.

mac911 mojave full disk access pane IDG

Mojave’s Full Disk Access lets only those apps that need to look at every file on the disk have that permission.

For now, you should also check the developers’ sites before launching the first time, too, although some have already built in prompts and installation instructions that help.

I found for three apps above, there are three different approaches. For Backblaze, you can click the + sign and add the app or drag it into the window. ChronoSync explains why you might grant access just for certain kinds of data (like Contacts) that you sync, or use full-disk access. But with CCC, you need to add two separate files, and the developer created a shortcut that manages that.

Update: Dropbox started rolling out a fix to macOS users for a problem cited in an earlier version of this article on October 10. This article has been updated with more information about checking the version number of Dropbox installed.

Ask Mac 911

We’ve compiled a list of the questions we get asked most frequently along with answers and links to columns: read our super FAQ to see if your question is covered. If not, we’re always looking for new problems to solve! Email yours to mac911@macworld.com including screen captures as appropriate, and whether you want your full name used. Every question won’t be answered, we don’t reply to email, and we cannot provide direct troubleshooting advice.

  
Shop Tech Products at Amazon