MacOS Sophos updates failing - you don’t have permission to access “CID”

Hello, LHerzog 

We appreciate your reaching out to the Sophos Community Forum.

It’s possible that the OS revoked the security permission after the update. Please ensure the required permissions are still in place and grant if needed. Please refer to this for further information and instructions:

Security permissions on macOS - Sophos Central Admin

https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/ProtectDevices/EndpointProtection/MacSecurityPermissions/

Check security permissions on macOS - Sophos Central Admin

https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/ProtectDevices/EndpointProtection/MacCheckSecurityPermissions/

Regards,

Thanks for the doc links you provided  Rutvik Chavda 

I don't like the idea that these permissions may change at random - but in fact they do (we've had that in the past on many devices).

Though I'd expect if the permissions are wrong, we'd have a red X at sophosscand on the status in Central and not all green.

Like this:

The computer I picked initially on my first poth has all green and displayed no issues, just the update failed logs were showing the problem.

But we'll check that on the endpoints locally and report back.

 sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' | grep -i sophos
 
kTCCServiceSystemPolicyAllFiles|com.sophos.SophosScanAgent|0|2|4|1|��
                                                                     ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.macendpoint.CleanD|0|2|4|1|��
                                                                        ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.macendpoint.SophosServiceManager|0|2|4|1|��
                                                                                        ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.liveresponse|0|2|4|1|��
                                                                  ||0|UNUSED||0|1654000571|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.endpoint.uiserver|0|2|4|1|��
                                                                       ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.SDU4OSX|0|2|4|1|��
                                                             ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|/Library/Sophos Managed Detection and Response/SophosMDR|1|2|4|1|��
         ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.endpoint.scanextension|0|2|4|1|��
                                                                              ||0|UNUSED||0|1654000572|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.livequery|0|0|5|1|��
                                                               |||UNUSED||0|1654025980|||UNUSED|0
kTCCServiceEndpointSecurityClient|com.sophos.scan|0|2|4|1|��
                                                            ||0|UNUSED||0|1654072710|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.SophosEncryptionCentralAdapter|0|0|5|1|��
                                                                                        |||UNUSED||0|1666866485|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.SophosEncryptionD|0|0|5|1|��
                                                                           |||UNUSED||0|1666866510|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.enc.preferences|0|0|5|1|��
                                                                     |||UNUSED||0|1691503011|||UNUSED|0
kTCCServiceSystemPolicyAllFiles|com.sophos.updater|0|0|5|1|��
                                                             |||UNUSED||0|1699170796|||UNUSED|0

/Library/Application Support/com.apple.TCC/MDMOverrides.plist: No such file or directory

I had the same problem and soved it. Please check your permissions for hard disk usage, see screenshot. Mine was de-activated after the last macOS update. With activating this my updates are working now.

Hi Michael Heider and thanks for your answer. I'll ask one of the users to check that.

I wonder what Rutvik Chavda says to the permissions report I posted above.

I'ts unclear to me what the results mean.

From your screenshot I translate this would be the line from the report:

kTCCServiceSystemPolicyAllFiles|com.sophos.updater|0|0|5|1

but, what is 0 0 5 1 ?

I've got feedback that at least some of the permissions were not allowed any more.

I hate that the Sophos Endpoint is not able to show a visible warning to the user, that something important like that is misconfigured.

allowing it again, fixes the update problem.

I've got feedback that at least some of the permissions were not allowed any more.

I hate that the Sophos Endpoint is not able to show a visible warning to the user, that something important like that is misconfigured.

allowing it again, fixes the update problem.