AXIsProcessTrusted returns wrong value in osX Ventura 13.0+

Facing same issue. Works perfectly in Monterey. Accessibility Setting UI has changed from Monterey to Ventura and there's a bug with the toggle. Monterey has a perfectly working checkbox. Ventura's toggle gives wrong values randomly.

I have an app that needs accessibility trust to install an active global event tap. The only way I found to reliably detect whether I have that trust is to just try calling CGEventTapCreate and see whether it returns NULL or not.

in [macOS 13] if you quickly toggle the accessibility permission for your app, AXIsProcessTrusted returns wrong value.

It sounds like you goal is to report this as a bug. If so, please see tip 1 in Quinn’s Top Ten DevForums Tips.

JWWalker wrote:

I have an app that needs accessibility trust to install an active global event tap.

FYI, you don’t need the Accessibility privilege to do that. There’s a separate Input Monitoring privilege and that has its own mechanism to check for and request access (CGPreflightListenEventAccess and CGRequestListenEventAccess). You can even use it in a sandboxed app!

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Quinn, when I said I have an “active” tap, I meant I need to be able to post events. I was aware of CGPreflightPostEventAccess and CGRequestPostEventAccess (probably heard about them in one of your other posts). (The Settings app displays that access as accessibility trust, though it may not be quite the same internally.) But in my experience, they don’t change their results “live”. That is, if I get a false result from CGPreflightPostEventAccess, then while my app runs, go to Settings and grant the permission, then go back to my app and check the result, it’s still false.

But in my experience, they don’t change their results “live”.

Right. That’s why, when you change these values in System Settings, it offers to quit and relaunch the app.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Right. That’s why, when you change these values in System Settings, it offers to quit and relaunch the app.

I just tried toggling a couple of the Privacy & Security > Accessibility switches, and it did not offer to quit and relaunch the apps.

Anyway, that's why I said that I preferred using CGEventTapCreate, that allows me to detect a change in the permission without a relaunch.

I just tried toggling a couple of the Privacy & Security > Accessibility switches

I was referring to Privacy & Security > Input Monitoring.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I was referring to Privacy & Security > Input Monitoring.

Yeah, we're kind of talking past each other here. Input Monitoring is what you'd be looking at if you used CGRequestListenEventAccess, but in the case of CGRequestPostEventAccess, it's Privacy & Security > Accessibility.

but in the case of CGRequestPostEventAccess

Yeah, that is confusing. There are two separate TCC privileges here:

• Accessibility

• PostEvent

In System Settings these both appear under Privacy & Security > Accessibility but they are different privileges. You can see this when you go to reset them. If you have the PostEvent privilege then this command resets it:

% tccutil reset PostEvent com.example.apple-samplecode.TCCTestORama

but this command does not:

% tccutil reset Accessibility com.example.apple-samplecode.TCCTestORama

I’ve never taken a detailed look at the interaction between these two privileges. For example:

• Presumably Accessibility subsumes PostEvent, but I’ve never tested that.

• Is it possible to get both privileges?

• What does AXIsProcessTrusted return in each case?

One day I’ll get a TSI about this and I’ll do more digging.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"