mac permissions overhaul

Overlord-Client/cmd/agent/sysinfo/admin_darwin.go

@@ -3,7 +3,10 @@
 package sysinfo
 
 import (
+	"errors"
+	"io"
 	"os"
+	"path/filepath"
 )
 
 func IsAdmin() bool {
@@ -19,9 +22,50 @@ func Elevation() string {
 
 func DarwinPermissions() map[string]bool {
 	return map[string]bool{
-		"screenRecording": false,
-		"accessibility":   false,
-		"fullDiskAccess":  false,
+		"screenRecording": darwinScreenRecordingPermission(),
+		"accessibility":   darwinAccessibilityPermission(),
+		"fullDiskAccess":  darwinFullDiskAccessPermission(),
 		"root":            os.Getuid() == 0,
 	}
 }
+
+func darwinFullDiskAccessPermission() bool {
+	home, _ := os.UserHomeDir()
+	candidates := []string{
+		"/Library/Application Support/com.apple.TCC/TCC.db",
+	}
+	if home != "" {
+		candidates = append(candidates,
+			filepath.Join(home, "Library", "Mail"),
+			filepath.Join(home, "Library", "Messages"),
+			filepath.Join(home, "Library", "Safari"),
+			filepath.Join(home, "Library", "Calendars"),
+			filepath.Join(home, "Library", "Application Support", "AddressBook"),
+		)
+	}
+
+	for _, path := range candidates {
+		if canOpenProtectedPath(path) {
+			return true
+		}
+	}
+	return false
+}
+
+func canOpenProtectedPath(path string) bool {
+	f, err := os.Open(path)
+	if err != nil {
+		return false
+	}
+	defer f.Close()
+
+	info, err := f.Stat()
+	if err != nil {
+		return false
+	}
+	if !info.IsDir() {
+		return true
+	}
+	_, err = f.Readdirnames(1)
+	return err == nil || errors.Is(err, io.EOF)
+}

Overlord-Client/cmd/agent/sysinfo/darwin_permissions_cgo.go

@@ -0,0 +1,31 @@
+//go:build darwin && cgo
+
+package sysinfo
+
+/*
+#cgo LDFLAGS: -framework ApplicationServices -framework CoreGraphics
+
+#include <ApplicationServices/ApplicationServices.h>
+#include <CoreGraphics/CoreGraphics.h>
+#include <stdbool.h>
+
+extern bool CGPreflightScreenCaptureAccess(void) __attribute__((weak_import));
+
+static int checkAccessibilityPermission(void) {
+	return AXIsProcessTrusted() ? 1 : 0;
+}
+
+static int checkScreenRecordingPermission(void) {
+	if (CGPreflightScreenCaptureAccess == NULL) return 0;
+	return CGPreflightScreenCaptureAccess() ? 1 : 0;
+}
+*/
+import "C"
+
+func darwinAccessibilityPermission() bool {
+	return C.checkAccessibilityPermission() == 1
+}
+
+func darwinScreenRecordingPermission() bool {
+	return C.checkScreenRecordingPermission() == 1
+}

Overlord-Client/cmd/agent/sysinfo/darwin_permissions_nocgo.go

@@ -0,0 +1,11 @@
+//go:build darwin && !cgo
+
+package sysinfo
+
+func darwinAccessibilityPermission() bool {
+	return false
+}
+
+func darwinScreenRecordingPermission() bool {
+	return false
+}