vscode: VSCode terminal doesn't allow/request permissions to access media devices

  • VSCode Version: 1.44.0
  • OS Version: Max OSX Catalina 10.15.2

Steps to Reproduce:

  1. Run this python script in the VSCode terminal which needs access to the camera:
import cv2

cam = cv2.VideoCapture(0)
print(cam.isOpened())
cam.release()

The result will be Abort trap: 6. This also occurs if you try to run the debugger. The script does work in the Mac Terminal and iTerm.

This is likely because vscode does not have permissions to access the camera. There is no way to force vscode to appear in the Mac permissions (Security & Privacy -> Privacy -> Camera), such that it cannot be enabled by the user.

Does this issue occur when all extensions are disabled?: Yes

About this issue

  • Original URL
  • State: closed
  • Created 4 years ago
  • Reactions: 21
  • Comments: 51 (6 by maintainers)

Most upvoted comments

Summarizing: VSCode cannot access the camera or microphone. In the Security panel of MacOS, under Camera or Mic there is no entry for VSCode to be selectable There is no way to add VSCode using the standard interface.

None of the suggestions above work (for obvious reasons as most people try around and give up prematurely)

Here is the solution that works and an explanation why:

— SOLUTION cd ~/Library/Application Support/com.apple.TCC cp TCC.db TCC.db_backup sqlite3 TCC.db

> INSERT into access (service, client, client_type, auth_value, auth_reason, auth_version) VALUES ("kTCCServiceCamera","com.microsoft.VSCode",0,2,0,1);
> INSERT into access (service, client, client_type, auth_value, auth_reason, auth_version) VALUES ("kTCCServiceMicrophone","com.microsoft.VSCode",0,2,0,1);
> .exit

Logout / Login Check under System Preferences -> Security & Privacy (there should be a VSCode access for both camera and mic)

Test functionality in VSCode Create a Jupyter NB:

import cv2

cam = cv2.VideoCapture(0)
print(cam.isOpened())
cam.release()

Run and enjoy — EXPLANATION MacOS requires applications to register for access of sensitive (privacy related) components of the computer. Therefore it provides a secure part of the OS that can partially be altered in recovery mode (available via cmd-R during boot).

This is not required to fix missing access grants on a per user basis:

Apple maintains a security database that stores the information observable in the System Preferences -> Security & Privacy dialog. This database is stored under ~/Library/Application Support/com.apple.TCC/TCC.db. It is a simple SQLite3 database.

In TCC.db there are several tables, one of which - access - is relevante (the others are empty).

The access table provides 13 fields of which only the first 6 need be entered. The rest has default values.

A comprehesive list of services can be found here:

https://apple.stackexchange.com/questions/339363/how-can-i-remove-applications-from-security-privacy

If you need to figure out the internally used client name, use this command:

osascript -e ‘id of app “Application name.app”’

Application name.app being the name found in the /Application folder.

However, when I start VS Code from terminal, it works.

Thanks for confirming @becting , thats the only workaround available for now.

As I have outlined earlier

The underlying issue is the way macOS TCC responsibility chain works, for ex: if you launch some application from macOS Terminal.app directly, TCC will determine Terminal.app to be the responsible process for the purpose of permission prompts, rather than the launched app itself. Unless the app is started through the LaunchServices (Finder/Open) the permission prompts will be attributed to the parent process that started it.

In VSCode, the builtin terminal is launched in a process forked from the main app, so any application launched without the use of launchservices from the terminal will have their permissions attributed to VSCode app which currently doesn’t obtain the media device permission, and hence you are seeing the issue mentioned.

So to workaround,

  • kill all your running instances of VSCode including any helper process, verify with Activity Monitor
  • make sure macOS Terminal.app has media permissions
  • start VSCode from Terminal.app code or code-insiders
  • Scripts run from the VSCode terminal that required media access should now work

@jelling @MHDFahz can you verify the above workaround ?

+1 it would be great for VScode to simply request permissions on Mac, so that we don’t have to do this workaround.

Similar issue exists with access to the microphone via Pythoh. In both cases it seems that the VSCode terminal is not requesting permissions from MacOS. I say this because if you run the same CLI command via the built-in MacOS Terminal app then permissions are requested and everything works as it should.

Proposed solution: update VSCode terminal to request permissions from MacOS.

Summarizing: VSCode cannot access the camera or microphone. In the Security panel of MacOS, under Camera or Mic there is no entry for VSCode to be selectable There is no way to add VSCode using the standard interface.

None of the suggestions above work (for obvious reasons as most people try around and give up prematurely)

Here is the solution that works and an explanation why:

— SOLUTION cd ~/Library/Application Support/com.apple.TCC cp TCC.db TCC.db_backup sqlite3 TCC.db

> INSERT into access (service, client, client_type, auth_value, auth_reason, auth_version) VALUES ("kTCCServiceCamera","com.microsoft.VSCode",0,2,0,1);
> INSERT into access (service, client, client_type, auth_value, auth_reason, auth_version) VALUES ("kTCCServiceMicrophone","com.microsoft.VSCode",0,2,0,1);
> .exit

Logout / Login Check under System Preferences -> Security & Privacy (there should be a VSCode access for both camera and mic)

Test functionality in VSCode Create a Jupyter NB:

import cv2

cam = cv2.VideoCapture(0)
print(cam.isOpened())
cam.release()

Run and enjoy — EXPLANATION MacOS requires applications to register for access of sensitive (privacy related) components of the computer. Therefore it provides a secure part of the OS that can partially be altered in recovery mode (available via cmd-R during boot).

This is not required to fix missing access grants on a per user basis:

Apple maintains a security database that stores the information observable in the System Preferences -> Security & Privacy dialog. This database is stored under ~/Library/Application Support/com.apple.TCC/TCC.db. It is a simple SQLite3 database.

In TCC.db there are several tables, one of which - access - is relevante (the others are empty).

The access table provides 13 fields of which only the first 6 need be entered. The rest has default values.

A comprehesive list of services can be found here:

https://apple.stackexchange.com/questions/339363/how-can-i-remove-applications-from-security-privacy

If you need to figure out the internally used client name, use this command:

osascript -e ‘id of app “Application name.app”’

Application name.app being the name found in the /Application folder.

That works on Big Sur; for Catalina it’s enough to use the following lines in sqlite3:

> INSERT into access (service, client, client_type, allowed, prompt_count, indirect_object_identifier, flags) VALUES ("kTCCServiceCamera","com.microsoft.VSCoda",0,1,1,"UNUSED",0);
> INSERT into access (service, client, client_type, allowed, prompt_count, indirect_object_identifier, flags) VALUES ("kTCCServiceMicrophone","com.microsoft.VSCode",0,1,1,"UNUSED",0);
> .exit

PS: it’s important you give full access permissions to Terminal in security settings

Try to update the folder permissions recursively with: chmod -R 777 folder

image Here is a simple demonstration. Mac OS Terminal shows the correct result, but terminal in VSCode does not.

Does VSCode spawn a emulated terminal? If MacOS thinks it is VSCode that spawns it, I would expect a permission request to access the camera, but that never happens. My privacy settings do show that Terminal has access to the camera, but there is no way to add VSCode to that list.

(Experimental duplicate detection) Thanks for submitting this issue. Please also check if it is already covered by an existing one, like:

Just ran VSCode as administrator: sudo /Applications/Visual\ Studio\ Code.app/Contents/MacOS/Electron Then my terminal in VSCode will run as root and the program executes as normal.

Of course, that is not a real solution though, but it shows some permissions are not handled correctly.

Comment: https://github.com/microsoft/vscode/issues/95062#issuecomment-751241372

cd ~/Library/Application Support/com.apple.TCC
cp TCC.db TCC.db_backup
sqlite3 TCC.db
INSERT into access (service, client, client_type, auth_value, auth_reason, auth_version) VALUES ("kTCCServiceCamera","com.microsoft.VSCode",0,2,0,1);
INSERT into access (service, client, client_type, auth_value, auth_reason, auth_version) VALUES ("kTCCServiceMicrophone","com.microsoft.VSCode",0,2,0,1);
.exit

Thanks, @wrogner for this useful solution !!

ph1q, thanks for the info regarding BigSur and insiders.

We’d better to wait for the bug fix release but you can try the solution at your own risk. BE CAREFUL, IT’S DANGEROUS ENOUGH TO EDIT THE DATABASE BY HAND.

You Have Been Warned.

Check if ‘Full Disk Access’ is granted to the terminal app you are using inside VS Code.

  • Open System Preferences ▸ Security & Privacy. Select the Privacy tab and select Full Disk Access,
  • If you can’t see the terminal app there, click the lock icon to unlock, then add the app.
cd ~/Library/Application\ Support/com.apple.TCC/
cp TCC.db TCC.db.bak
sqlite3 TCC.db    # sqlite> prompt appears.
for Mojave, Catalina
INSERT into access VALUES('kTCCServiceCamera',"com.microsoft.VSCode",0,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,1541440109);

for BigSur
INSERT into access VALUES('kTCCServiceCamera',"com.microsoft.VSCode",0,1,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,1541440109);

for Microphone, replace the keyword with
'kTCCServiceMicrophone'

for VS Code Insiders, go with
'com.microsoft.VSCodeInsiders'

There’s a slight error in the above for Catalina for the Camera permission, this will work:

> INSERT into access (service, client, client_type, allowed, prompt_count, indirect_object_identifier, flags) VALUES ("kTCCServiceCamera","com.microsoft.VSCode",0,1,1,"UNUSED",0);

@jvanheugten

Here is my steps.

  • os: Catalina 10.15.5

1, There’s a sqlite3 db file(TCC.db) in this path: ~/Library/Application Support/com.apple.TCC/ 2, Insert a row to table access, like this: INSERT INTO access VALUES(‘kTCCServiceMicrophone’,‘com.microsoft.VSCode’,0,1,1,NULL,NULL,NULL,‘UNUSED’,NULL,0,1590575788); 3, Check the permission(Security & Privacy -> Privacy -> Microphone) 4, Restart vscode

Cheers! 🍺🍺🍺

I am having the same issue the python code runs without issue from terminal which is able to request the appropriate permissions. VSCode however does not request permissions as expected.

The line cap = cv.VideoCapture(0) generates the output OpenCV: not authorized to capture video (status 0), requesting... yet there is no request

@HoBu23 : Please read the suggested solutions (and verify them) before submitting an addition. Solutions for > 10.15.x by @wrogner Solutions for < 10.15.x by @mattialibera

okay, thanks for your info, but I have no success with @wrogner way. Problem with open .db in sqlite3. But with comment from @sst2010 it works.

Now I tried it in IntelliJ IDEA.

This is the result: IntelliJ IDEA

I think Microsoft should still think about this

I code with vscode but run the code with iTerm. Its work for me

Thanks @Naohiro2g ! Worked for me on Big Sur 11.3 Beta after adding another value and restarting VSCode.

For the Insider version, just use “com.microsoft.VSCodeInsiders”.

VALUES('kTCCServiceCamera',"com.microsoft.VSCode",0,1,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,1541440109);

First of all, there is no need to be in the recovery mode to edit the database but terminal app needs full disk access.

Mojave version is here, at your own risk. Be careful.

cd ~/Library/Application\ Support/com.apple.TCC/
cp TCC.db TCC.db.bak
sqlite3 TCC.db    # sqlite> prompt appears.


# for Camera

INSERT into access VALUES('kTCCServiceCamera',"com.microsoft.VSCode",0,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,1541440109);

#  for Microphone

INSERT into access VALUES('kTCCServiceMicrophone','com.microsoft.VSCode',0,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,1541440109);

【Abort trap: 6】crashed on macOS , cv2.VideoCapture(0) #96167

Tried to insert above statements (the last parameter is the time stamp).

Did not work:

a. The number of columns has been changed from 12 to 13 (which can be mitigated by adding a NULL value) b. the TCC.db is read only and cannot be changed to be written.

So, sorry, NO.

The issue still exists

https://streamable.com/zsa8ro

However, when I start VS Code from terminal, it works.

@jelling thanks for the report. the root cause is same. I have updated the bug title.

Thanks for the context, based on https://github.com/microsoft/vscode/issues/95062#issuecomment-614044993 since we execvp, macOS tcc utility will consider the permissions of the parent process instead of the forked process.

But I am still confused why it wasn’t an issue with my setup, moving this next milestone for further investigation.

Have your restarted code after giving your macOS terminal access to camera ? Otherwise code wouldn’t pick up the privilege for the terminals it opens.

Does VSCode spawn a emulated terminal?

@Tyriar how do we spawn terminals on macOS ?

I tried the following steps and it seems to work , https://streamable.com/zsa8ro

My privacy settings do show that Terminal has access to the camera, but there is no way to add VSCode to that list.

Yes you can’t do that at the moment, because code doesn’t carry the entitlement that requests access to camera. I am looking to avoid adding this unless necessary, but for the current use case through the terminal things should work the way it is.