News for hackers. Stuff that matters.
Re:Yet another macOS privacy protections bypass by hanche on Wednesday December 02, 2020 @01:52AM (#25273866)
You need the r permission to read a directory, in the sense of getting a list of filenames. But the x permission lets you access files and subdirectories if you already know the filename. Of course, you need r permission in the file to read it, but you can always stat() it.
Re:Yet another macOS privacy protections bypass by musicale on Wednesday December 02, 2020 @08:31PM (#25284174)
Indeed, I actually meant "read (or check) a specified path/directory status entry" rather than "read a directory" but probably hit submit too quickly.

What this "privacy protections bypass" is doing looks like the former rather than the latter, and it seems like normal behavior if you have x/stat permission.

It could be that Apple's sandbox blocks r/readdir permission but not x/stat permission for some reason.