Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Fix Emacs permissions on macOS Catalina
;;; package --- Fix permissions for Emacs.app on macOS Catalina
;;; Author: Artem Loenko
;;; Mail-To: <artyom.loenko@mac.com>
;;; Commentary:
;;; Code:
(defconst _default-emacs-app-plist-path "/Applications/Emacs.app/Contents/Info.plist")
(defconst _temp-buffer-name "*fixing Emacs permissions*")
(defconst _temp-buffer (get-buffer-create _temp-buffer-name))
(with-current-buffer _temp-buffer (erase-buffer))
(defun add-description-if-needed (description_key description)
"DESCRIPTION_KEY - DESCRIPTION."
(defconst read-args (list "read" _default-emacs-app-plist-path description_key))
(if (equal 1 (with-temp-buffer (apply 'call-process "defaults" nil (current-buffer) nil read-args)))
(progn
(princ (format "Missing: %s. Adding...\n" description_key) _temp-buffer)
(defconst write-args (list "write" _default-emacs-app-plist-path description_key "-string" description))
(apply 'call-process "defaults" nil (current-buffer) nil write-args))
(princ (format "Existed: %s. Skipping.\n" description_key) _temp-buffer)))
(add-description-if-needed
"NSDesktopFolderUsageDescription"
"Emacs requires permission to access the Desktop folder.")
(add-description-if-needed
"NSDocumentsFolderUsageDescription"
"Emacs requires permission to access the Documents folder.")
(add-description-if-needed
"NSDownloadsFolderUsageDescription"
"Emacs requires permission to access the Downloads folder.")
(add-description-if-needed
"NSRemovableVolumesUsageDescription"
"Emacs requires permission to access files on Removable Volumes.")
(switch-to-buffer-other-window _temp-buffer)
;;; fix-emacs-permissions-catalina.el ends here
@dive

This comment has been minimized.

Copy link
Owner Author

dive commented Sep 29, 2019

There are some additional privacy restrictions on macOS Catalina related to folder access. Now we have to ask for permission to access Documents, Downloads, Desktop and files on removable volumes (documentation).
The script provides the necessary descriptions to access the folders mentioned above because in some cases Catalina rejects to provide access without these changes (especially, when your sync Documents and Desktop with iCloud).

How to use

  1. Copy the code to the scratch buffer;
  2. Change the _default-emacs-app-plist-path to point to a proper place where your Emacs is installed;
  3. Evaluate the buffer (with eval-buffer in Emacs-Lisp major mode);
  4. Check the output for changes (in temporary buffer *fixing Emacs permissions*);
  5. Restart Emacs.

How to get access to the SIP protected folders

The easiest way is to call ns-open-file-using-panel and open a file from the protected folder. macOS will ask about the permission. In some cases, you can open a file directly from Emacs.app with the permission dialogue but you have to provide a full path and completions will be unavailable.

Notes

The script will convert the Info.plist from xml representation to the binary form. To convert back use the following command:

plutil -convert xml1 /Applications/Emacs.app/Contents/Info.plist
@dylanjm

This comment has been minimized.

Copy link

dylanjm commented Oct 8, 2019

I have emacsclient running through brew services. I've run this script but my emacsclient is still blocked from the filesystem. Is there a way to get this script to work for emacsclient?

@waqarsaleem

This comment has been minimized.

Copy link

waqarsaleem commented Oct 8, 2019

I granted Emacs Full Disk Access under System Preferences -> Security & Privacy -> Privacy.

Clicking the app icon launches Emacs with no access to the files under my account. However, if I launch an executable from the app contents in Finder, a terminal launches which then launches the same version of Emacs but with file access. This may be because I have a already granted permission to Terminal through a popup that appeared earlier.

Running the above script does not change this situation.

GNU Emacs 26.3 (build 1, x86_64-apple-darwin18.2.0, NS appkit-1671.20 Version 10.14.3 (Build 18D109)) of 2019-09-02

@apple0012

This comment has been minimized.

Copy link

apple0012 commented Oct 8, 2019

it doesn't work for me

@efroemling

This comment has been minimized.

Copy link

efroemling commented Oct 8, 2019

The ns-open-file-using-panel bit did the trick for me. However this seemed to be regardless of whether I had run the permission-fix script or not (tried it on multiple machines). I never saw any 'Emacs would like to access XXX' popups. This is on 10.15 release with homebrew cask Emacs.app.

I found that if I do File->Open (or ns-open-file-using-panel) and select ~/Documents/somedir/somefile, emacs can then see everything under ~/Documents/somedir/ (but still not ~/Documents). So to get emacs back to fully functional I had to be sure to open files at the root of the 3 special dirs: ~/Documents/somefile, ~/Downloads/somefile, ~/Desktop/somefile.

Does anyone know what we need to do to get this working better out of the box? I'm curious if it's Apple or Emacs' fault that we're not getting access permission popups by default.

@waqarsaleem

This comment has been minimized.

Copy link

waqarsaleem commented Oct 8, 2019

Traversing the file system in the dialog for ns-open-file-using-panel causes my Emacs to crash. My Emacs is from https://emacsformacosx.com.

@jhirn

This comment has been minimized.

Copy link

jhirn commented Oct 8, 2019

I got prompted once for access and not again. Didn't need an elisp script.

Using emacs-mac via homebrew.

@waqarsaleem

This comment has been minimized.

Copy link

waqarsaleem commented Oct 8, 2019

I fixed my problem by granting Full Disk Access to /usr/bin/ruby as instructed here.
https://emacs.stackexchange.com/a/53037/11143

@dylanjm

This comment has been minimized.

Copy link

dylanjm commented Oct 9, 2019

Full disk access is working for my emacs install but won't work for emacsclient. I've granted full-disk access to ruby, emacsclient, emacs, and still won't work.

@niallor

This comment has been minimized.

Copy link

niallor commented Oct 10, 2019

I had to be sure to open files at the root of the 3 special dirs: ~/Documents/somefile, ~/Downloads/somefile, ~/Desktop/somefile.

Thanks. I needed to do this too.

@roderik333

This comment has been minimized.

Copy link

roderik333 commented Oct 14, 2019

I solved this by creating a Automator "Application": Utilities -> Run Shell Script -> exec /Applications/Emacs.app/Contents/MacOS/Emacs 2>&1

@dku

This comment has been minimized.

Copy link

dku commented Oct 20, 2019

I solved this by creating a Automator "Application": Utilities -> Run Shell Script -> exec /Applications/Emacs.app/Contents/MacOS/Emacs 2>&1

Thanks -- that works for me for the time being.

@dixius99

This comment has been minimized.

Copy link

dixius99 commented Nov 3, 2019

I've tried all of the above, tried different Emacs distributions, and no matter what I do, File > Open crashes Emacs immediately, as does clicking on the File Open button on the tool bar, or "Open a File" on the splash page. This is what I get:

Application Specific Information:
*** Terminating app due to uncaught exception 'NSObjectNotAvailableException', reason: 'EmacsOpenPanel is not a supported subclass for sandboxing'
abort() called
terminating with uncaught exception of type NSException

Any thoughts?

@lovaulonze

This comment has been minimized.

Copy link

lovaulonze commented Nov 10, 2019

I found that if I do File->Open (or ns-open-file-using-panel) and select ~/Documents/somedir/somefile, emacs can then see everything under ~/Documents/somedir/ (but still not ~/Documents). So to get emacs back to fully functional I had to be sure to open files at the root of the 3 special dirs: ~/Documents/somefile, ~/Downloads/somefile, ~/Desktop/somefile.

Exactly. Somehow in my case these files should also be "real" files under the ~/Documents (and etc.) folders but not symlinked.

This trick also works for mounted volumes under /Volumes folder.

@rtlong

This comment has been minimized.

Copy link

rtlong commented Nov 12, 2019

I've also installed via https://emacsformacosx.com/ – thanks for this script but it didn't help me either. What finally worked for me is adding /usr/bin/ruby and /usr/bin/emacsclient and Emacs.app under System Preferences > Security & Privacy > Full Disk Access

@TerryFunggg

This comment has been minimized.

Copy link

TerryFunggg commented Dec 2, 2019

I fixed my problem by granting Full Disk Access to /usr/bin/ruby as instructed here.
https://emacs.stackexchange.com/a/53037/11143

Oh so it using a ruby script? Thanks! It‘s work!This problem confuse me as long time!😭

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.