macOS Mojave: For app permissions, what’s the difference between Accessibility and Full Disk Access?

The Mac has avoided widespread malware, and Apple tries to keep ahead of the ways in which malicious software can gain a foothold in macOS. In 2015 with El Capitan, that was System Integrity Protection, to keep system files from being modified. Sierra in 2017 removed an option to allow unsigned Mac apps to run without a prompt.

Now in Mojave, macOS has forced apps to request certain kinds of system-level privileges for behavior that it generally allowed in previous releases. In some cases with older apps that haven’t been updated, you have to take a manual step to keep them working, too.

If you have any of these apps installed, after upgrading to Mojave you will receive prompts or warnings from them, explaining that you have to approve or add them to the Security & Privacy system preference pane’s Privacy tab. In some cases, apps need a check in a box next them in the Accessibility list; in others, in Full Disk Access. Macworld reader David wonders about the difference.

For both kinds of permission, an app or macOS should prompt you or explain how to proceed. You shouldn’t have to figure out on your own whether you need to add permission or add an app to the list. Mojave is still new, so some developers are still releasing compatibility updates to streamline how they request permission from you.

Accessibility covers more than just input options

Accessibility permission, which appeared in earlier releases of macOS, let apps use features to monitor and affect how you interact with the system that are primarily designed to work with software that helps people with visual, auditory, or motion issues.

In my Accessibility list, I have LaunchBar, Pastebot, and TextExpander, to name just a few. Apple requires explicit permission, because it’s just these kinds of features that can be leveraged and abused by simpler malware that doesn’t dig deeply into exploiting the system, but could, for instance, try to capture your keystrokes.

mac911 mojave accessibility paneIDG

The Accessibility pane lets app use input and interface-monitoring features.

In Mojave, I had to grant permission for some apps in Accessibility that I’d previously given, or even follow instructions provided by the developer to remove entries from the list and then add them back. That was true for TextExpander.

You might wonder why some apps need “accessibility” access when they don’t appear to rely on any input feature. Macworld reader Robert wrote in to complain about a recurring permission dialog he receives with Dropbox to grant it accessibility privileges. He preferred not to, but there’s no Deny button to stop asking about it (as he found with Photoshop Elements, which he opted to deny), only a Not Now button to defer action.