Persistent TCC Permission Prompts on External Home Folder Setup (Bartender, Shottr etc.)

[wiffle]

Hi everyone,

Wondering if anyone else has run into this:

I’m running macOS Sequoia on an M4 Mac mini with my user account’s home folder located on an external SSD (Thunderbolt 4 APFS-encrypted). Most apps are installed on the internal SSD.

However, since moving to this setup, I’m frequently being re-prompted for TCC-related permissions at every boot or relaunch for multiple apps:

• Bartender 5 – asks repeatedly for screen/window picker access
• Shottr – keeps requesting screen capture permissions

These permissions don’t seem to persist even after:

• Manually granting access in System Settings → Privacy & Security
• Running tccutil reset and re-approving
• Verifying full disk access is enabled

I suspect this is due to the ~/Library/Application Support/com.apple.TCC database being on the external volume, which may trigger sandbox-related or SIP-enforced behavior. I’ve tried to symlink the TCC directory to /Users/Shared, but as expected, SIP blocks access or ignores it. I’m exploring bind mounts as a workaround, but it’s not straightforward on macOS due to lack of native support without modifying /etc/fstab.

Has anyone run into similar issues with:

• External home folder setups
• Persistent permission prompts for sandboxed apps
• Workarounds that persist across reboots?

Would love to hear if others have solved this (or gave up and moved the home folder back to internal storage). Open to creative solutions.

Thanks!

 

[Bigwaff]

Why not disable SIP and see if that resolves issue?

 

[wiffle]

Why not disable SIP and see if that resolves issue?

I'm not too familiar with SIP disabling. What would that put me at risk for?

 

[Bigwaff]

I'm not too familiar with SIP disabling. What would that put me at risk for?

For testing the issue? No risk. Disable, test, re-enable.

Disabling and Enabling System Integrity Protection | Apple Developer Documentation

Disable system protections only temporarily during development to test drivers, kernel extensions, and other low-level code.

developer.apple.com

 

[ifxf]

This is Apple appealing to the tin foil hat users. They now ask on a weekly basis if an app can record the screen. You can follow the instructions on lifehacker to disable the nags.

 

[nmt1900]

These who think that it is about "tin foil hat" should probably switch to Windows, which does not have any real protection to system files in place.

And by the way - instructions from Lifehacker do not work any more at least what comes to screen recording prompts.