AppleScript and TCC Prompts

New Contributor

Good evening everyone,

     I'm using dockutil 2.0.5 in combination with the following script:


# ---------------------------------------------------------
#   Set all Variables
# ---------------------------------------------------------
#----- Get Computer Name
CompName=$(scutil --get ComputerName)

#----- Standards
script=$"Set User Account Icons "
now=$(date +"%m-%d-%Y %H:%M:%S")

#----- Debugging
#bash -x ./[] for detailed script output
#bash -n ./[] for syntax checking
set -u   # verbose error checking during execution

#----- Executables
mkdir=`which mkdir`
chown=`which chown`
chmod=`which chmod`

#----- User Account Variables
loggedInUser="$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ && ! /loginwindow/ { print $3 }' )"

#--- Set Logging
if [ ! -d "${Log}" ];
    mkdir $Log
  chown $user:staff $Log
  chmod 777 $Log
exec >> "${Log}"/Test.SetDockIcons.log 2>&1

#  Timestamp
echo ""
echo "##### $script"
echo "##### $now"

#  Script

su -l $user -c "/usr/local/bin/dockutil --remove all --homeloc ~/Library/Preferences/"
echo "All icons have been removed from the dock for all users" && echo ""

if [ $user = mobile ] ; then
$dockutil --add /Applications/Test\  --homeloc ~/Library/Preferences/
$dockutil --add /Applications --view grid --display folder  --homeloc ~/Library/Preferences/
$dockutil --add /Applications/Utilities/ --view grid --display folder  --homeloc ~/Library/Preferences/
$dockutil --add '~/Downloads' --view list --display folder  --homeloc ~/Library/Preferences/

        # rm -f ~/Desktop/*
su -l $user -c "osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/Library/Desktop Pictures/Test/iMacSyncBackground.jpg"'"
su -l $user -c "$dockutil --add /Applications/  --homeloc ~/Library/Preferences/"
su -l $user -c "$dockutil --add /Applications/Google\  --homeloc ~/Library/Preferences/"
su -l $user -c "$dockutil --add /Applications/  --homeloc ~/Library/Preferences/"
su -l $user -c "$dockutil --add /Applications/Test\  --homeloc ~/Library/Preferences/"
su -l $user -c "$dockutil --add /Applications --view grid --display folder  --homeloc ~/Library/Preferences/"
su -l $user -c "$dockutil --add /Applications/Utilities/ --view grid --display folder  --homeloc ~/Library/Preferences/"
su -l $user -c "$dockutil --add '~/Downloads' --view list --display folder  --homeloc ~/Library/Preferences/"
#US Config for BK and AC Alias for desktop
if [[ "$CompName" = RTUS* ]] && [[ $user != sysadmin ]] ; then
su -l $user -c "osascript -e 'tell application "Finder" to make new alias at (path to desktop folder) to file ((path to applications folder as text) & "BK 8.0")'"
su -l $user -c "osascript -e 'tell application "Finder" to make new alias at (path to desktop folder) to file ((path to applications folder as text) & "Apple Configurator")'"
       su -l $user -c "osascript -e 'tell application "Finder" to set desktop picture to POSIX file "/Library/Desktop Pictures/Test/testwallpaper.jpg"'

$dockutil --add '~/Downloads' --view list --display folder  --homeloc ~/Library/Preferences/
echo "Changed Dock & Desktop Icons and Wallpaper for the $user User"

exit 0
    The script is supposed to set the dock and wallpaper for a guest account every time a user logs in. It's deployed via Jamf Pro MDM (10.35) Up until 11.6.3, the script has been working well. With the introduction of 12.2 however, the user is receiving the following prompt:
Screen Shot 2022-02-16 at 7.18.23 PM.png
      If the user selects "ok," the script runs and the wallpaper and dock items adjust accordingly. The issue is if they reject it the prompt disappears and the dock and wallpaper stay as default. These are company machines so we want to limit what's on the dock, wallpaper, etc. 
I've tried creating multiple PPPC Mobileconfig files to allow osascript, sh, bash, terminal, etc. These were created by using the command I found here
log stream --debug --predicate 'subsystem == "" AND eventMessage BEGINSWITH "AttributionChain"'​

I then ran the script and looked for the "responsible" strings. Here's what I found. 


2022-02-16 18:23:53.574944-0800 0xdcb3     Info        0x39a57              146    0    tccd: [] AttributionChain: responsible={<TCCDProcess:, pid=4902, auid=20
1, euid=201, responsible_path=/bin/sh, binary_path=/bin/bash>}, requesting={<TCCDProcess:, pid=5047, auid=201, euid=201, binary_path=/usr/bin/osascript>},



I went to PPPC Utility and created the following mobileconfig (I also made separate ones for .sh, .bash, and created separate configuration profiles for each of them (one payload per config profile).
Screen Shot 2022-02-16 at 7.27.56 PM.png
I then created a Configuration profile in Jamf:
Screen Shot 2022-02-16 at 7.34.40 PM.png
The issue still persists. Some people have recommended desktoppr and dockmaster as alternatives. However, based on hammering away at this for the past three days I don't believe the issue is dockutil but the script itself using osascript to "tell" finder what to do. 
    Sorry for the long post. In short, I've tried different variations of mobileconfigs, I've removed osascript tells entirely from the script, and have been on the slack channels, webpages, and forums trying to find a solution. I'm hoping someone out there can help me crack this puzzle. Any help would be greatly appreciated.



Contributor III

Have you tried adding in PPCUtility, binaries located in;

/Library/Application Support/JAMF/

Also management Daemon on the left hand side, then permissions to, osascript etc. ok the right of each of those?

Daemon should give control to Jamf on login while service is for Self Service policies.

Apologies I’m on my phone, left laptop at work.. Well I bloody hope I have. Oh crap