Docker.app requests unexpected permissions: 'Reminders' and 'Downloads folder'

[p487morgan]

• I have tried with the latest version of my channel (Stable or Edge)
• I have uploaded Diagnostics
• Diagnostics ID: 81FD0FD9-CF67-4E24-862B-6CC88F3E0946/20201007150127

Expected behavior

Docker.app does not need permission for 'Reminders' or 'Downloads folder'

Actual behavior

Docker.app requests permissions for 'Reminders' and 'Downloads folder'

Information

• macOS Version: 10.15.6 (19G2021)

• Occurred after a recent update to latest version

• Wasn't actively using Docker or any containers at the time. Some containers were idling in the background.

Diagnostic logs

Docker for Mac: version 2.4.0.0
Diagnose succeeded

Steps to reproduce the behavior

1. ... Update to 2.4.0.0
2. ... Wait to be asked permission for access to 'Reminders' and 'Downloads folder'

[stephen-turner]

Thanks for the report. We found this before the release and we thought we'd fixed it. We'll have another look.

[stephen-turner]

Also strange that we've only had one report of this; there must be a corner case we haven't found. Do you have a repro case, e.g. a compose file or a set of containers that reliably exhibits the bug?

[p487morgan]

I've only seen it once. I assume I won't be repeatedly asked by Docker to give permission, after declining it once? I had been using a network of containers: schickling/beanstalkd, bitnami/redis, plus one for my work but I can't disclose too much from there. Sorry that I can't provide more useful info but I wasn't interacting with Docker or any container at the time either of the permissions (Reminders or Downloads) were requested.

…

On Thu, Oct 8, 2020 at 10:18 AM Stephen Turner ***@***.***> wrote: Also strange that we've only had one report of this; there must be a corner case we haven't found. Do you have a repro case, e.g. a compose file or a set of containers that reliably exhibits the bug? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#4975 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AIIUNSV5TA7ZI566MFXF2STSJV7YDANCNFSM4SHRLR6A> .

[stephen-turner]

Thanks @p487morgan, we've managed to reproduce this now and will have a fix soon.

[p487morgan]

Great stuff. Thanks! I have just seen another case: I took a screenshot (again, not whilst using Docker or any containers) and immediately Docker requested permission to access the Desktop (where the screenshot is saved).

…

On Fri, Oct 9, 2020 at 2:59 PM Stephen Turner ***@***.***> wrote: Thanks @p487morgan <https://github.com/p487morgan>, we've managed to reproduce this now and will have a fix soon. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#4975 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AIIUNSQRAWWLYMWYAYJ6FVDSJ4JNPANCNFSM4SHRLR6A> .

[ebriney]

Can you try that build @p487morgan and give us some feedback please:
https://desktop-stage.docker.com/mac/edge/49130/Docker.dmg

[p487morgan]

Hey I tried to run it, but:
“Docker.app” can’t be opened because Apple cannot check it for malicious software.

[p487morgan]

I opened it anyway.. but it is stuck Starting :(

[p487morgan]

Having reinstalled the stable version it's working as usual. I didn't get the request for permissions this time - looking in System Preferences->Security & Privacy->Privacy, I can see Docker has the relevant boxes (in Reminders, and Files & Folders) unchecked. I doubt I'll see the permissions popups again, with any install.

[sidwarkd]

I have also seen this same behavior. As far as a repro scenario I just came back from lunch and the request to access my reminders was on the screen when my Mac woke up. It was not there when I locked it to go to lunch. Similarly the request to access my Downloads folder also appeared to happen randomly. My Docker About shows I'm running 2.4.0.0(48506) with Engine 19.03.13. I'm running Mac OS Catalina 10.15.7.

[brentgreeff]

Just saw it myself - opening finder & then the calendar.

[k-dahl]

I have had Docker for mac recently ask for permissions to Downloads, Reminders, Network shares, and just a minute ago my Desktop. I am not actively using anything docker related right now (it has k8s w/prometheus, but that is all) - it seems to just make these requests at random times, and doesn't appear to be as a result of anything that I am doing.

Using 2.4.2.0/edge

[stephen-turner]

We believe this is fixed in 2.5.0.0. If not, please post a note on this ticket and I will reopen it.

[yoodame]

Thanks for the fix but I got a prompt to give docker access to my reminders. I am running 2.5.0.0 on macOS 10.15.7.

[stephen-turner]

Thanks for the note, @yoodame. Could you give steps to reproduce (such as your docker run command or compose.yml)? Thanks.

[yoodame]

I just saw another prompt to allow access to my download folder while trying to download a file from a site (unrelated to docker or my local site).

Unfortunately this is one of those wait for the prompt step. I did run a lando rebuild ~5 minutes prior to the prompt, however. My lando version is (v3.0.18).

[ErikStammes]

I just upgraded to Docker 2.5.0.1 (49550) (from 2.5.0) on macOS 10.15.7 and it requested access to my reminders a few minutes later:

[stephen-turner]

@ErikStammes Could you give steps to reproduce (such as your docker run command or compose.yml)? There's not much we can do without that. Thanks.

[k-dahl]

@stephen-turner Not sure if it helps or not, but on the four occasions that this happened to me I was not even actively using docker or docker-desktop at the time. I think that's what is kind of alarming about these reqs for access - they don't appear related to anything the user is doing.

At least two of the reqs that I received happened when I had left my computer and come back (and had not been using docker), so - I'm skeptical that the issue is anything triggered by user actions directly.

I would try the newest docker - but mine is still reporting that 2.4.0.2 is the latest in the edge channel. Somewhere along the way it seems that stable has leapt ahead of the edge channel.

[sidwarkd]

@stephen-turner I can corroborate @blitzd 's report on this. I received the requests after returning to my machine after lunch and nothing was running in Docker. In all instances of getting the request for perms I had no containers running. Feels like the service itself is triggering something.

[stephen-turner]

If any of you see it again, could you please upload diagnostics and paste the diagnostics id here? Thank you.

[yoodame]

@stephen-turner I got the access prompt again this morning. This time asking access to my desktop folder while I was attempting to take a screen capture. I should mention I started Lando about 5 minutes prior to seeing this.

Here's my diagnostics id 7D0FF2B9-54CC-4975-A7E8-DCFDA0918CD6/20201119163212.

[stephen-turner]

Thanks @yoodame.

[RoloDMonkey]

I just got a request to access Reminders after opening my laptop for the first time this morning. I hadn't run anything that should have triggered Docker in about 12 hours.

I am running 2.5.0.0 on a Mac. I just installed the latest version of Lando yesterday. I did get a request for access to Documents yesterday, which I approved without thinking it through.

[ebriney]

Hi @yoodame I looked at the diagnostics and saw that you have a container that mount $HOME and so we watch all the subdirs, a file is modified on your Desktop, we forward the event in the vm which must refresh file attributes and finally macOS ask you if you authorize that operation.
The problem is that we can't know if a process in your container is listening notification on this file.
So if you want to avoid such request, don't mount your $HOME directory but the specific one that contains your data/source.
Generally speaking it's also degrading performances on your machine because we must send all events in ~/Library for ex. in the vm.
We are thinking about filtering those directories but we must consider all use cases before.

@RoloDMonkey can you send a diagnostic because I tried on my freshly installed big sur machine, the app (2.5.0.0) ran for 12h and I didn't get any popup.

[RoloDMonkey]

@ebriney Here is my Diagnostic ID: D6818DF0-1C0E-4340-AA7B-14182C12D20D/20201202181447

[ebriney]

Thanks @RoloDMonkey, I looked in your diagnostic, same as @yoodame.
Lando creates containers that bind mount your home directory.
I have a PR to disable event injection on protected folder which should fix it in the future.

[stephen-turner]

However, even if we fix this case, it's worth emphasising again that you really shouldn't be sharing your whole home directory unless you need it, but rather just the directory containing your source code. We have to watch the whole of the shared directory and forward changes to the VM, which will cause unnecessary load.

[stephen-turner]

Heads-up: we fixed this in 3.0.0 but we are about to partially revert the fix because it caused far more trouble than the original bug did (see #5115). We will still exclude everything in ~/Library from sharing, which includes your Reminders. But ~/Downloads will still be tracked, because some people need access to that, and that may generate pop-ups.

We will see later whether we can get rid of the pop-ups another way, but the immediate solution is not to share the whole of $HOME: for both performance and security reasons, you should get into the habit of only sharing the directories that are actually needed by the container.

[stephen-turner]

In the end we have "fixed" this by adding a warning if you share your home folder or Library folder. This is in 3.0.2.

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows.
/lifecycle locked