Screen recording permissions

[antonshkurenko]

Describe Request:

I'm trying to record test videos using either ffmpeg or appium mac2 driver (as far as I know, it uses ffmpeg behind the scenes anyway)

Examples:

deviceId == 0 is screen capture in CircleCI VM.

In python code is simple:

appium_driver.start_recording_screen(deviceId=0)

Or using raw ffmpeg:

ffmpeg -f avfoundation -i "0" -t 10 output.mp4

But I can't give permissions somehow. Once I start video recording, there is a popup:

And an error:

 [ffmpeg] objc[23088]: class `NSKVONotifying_AVCaptureScreenInput' not linked into application

What I've tried:

basically main are ffmpeg and .machine-agent, others are just out of desperation 🙂

      - macos/add-permission:
         bundle-id: /Applications/Utilities/Terminal.app
         permission-type: kTCCServiceScreenCapture
     - macos/add-permission:
         bundle-id: /private/tmp/.machine-agent
         permission-type: kTCCServiceScreenCapture
     - macos/add-permission:
         bundle-id: /usr/local/bin/ffmpeg
         permission-type: kTCCServiceScreenCapture
     - macos/add-permission:
         bundle-id: /opt/homebrew/bin/appium
         permission-type: kTCCServiceScreenCapture

Supporting Documentation Links:

[nljohnson]

It's a shame this has been sitting for over a year without any progress. Part of the problem here is that the client value getting set in the TCC db needs to be accompanied by an appropriate client_type. That client_type is currently being hardcoded by the macos orb to 0, which means "Bundle Identifer" rather than "Absolute Path." The other half of the issue for many permissions is that the orb has no mechanism for setting the indirect_object_identifer or indirect_object_identifier_type, which identifies what target application the permission has. This is important for a number of permissions. Probably what you need is an updated sqlite request. Pulled from the orb and modified for your use, you're probably looking at something similar to:

if csrutil status | grep -q 'disabled'; then
  epochdate=$(($(date +'%s * 1000 + %-N / 1000000')))
  tcc_update="replace into access (service,client,client_type,auth_value,auth_reason,auth_version,indirect_object_identifier,flags,last_modified) values (\"kTCCServiceScreenCapture\",\"/private/tmp/.machine-agent\",1,2,3,1,\"UNUSED\",0,$epochdate);"
  sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" "$tcc_update"
  sudo sqlite3 "/Users/$USER/Library/Application Support/com.apple.TCC/TCC.db" "$tcc_update"
else
  echo "Unable to add permissions! System Integrity Protection is enabled on this image"
  echo "Please choose an image with SIP disabled. Documentation: https://circleci.com/docs/2.0/testing-macos"
  exit 1
fi

I'm not certain about the indirect_object_identifier, though.