commit 4931a903f04303265bdde3bc7951dd449d9a0f9e
author Tom Burgin <bur@chromium.org> Mon Mar 21 21:59:30 2022
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Mar 21 21:59:30 2022
tree 9a723fcfc60af49f91ebe4ae8da7e154c087e1bb
parent 50b7b6e73b47649bfb371ed47f000e14234c6790

Chrome on macOS: purge stale screen capture permission

If Chrome 97 or earlier was used to screen share a stale designated
requirement may be cached in the system TCC.db. This stale record can
cause issues starting with Chrome 98.0.4758.132 (extended stable),
99.0.4844.74 (stable), 100.0.4896.45 (beta), 101.0.4929.5 (dev),
101.0.4933.0 (canary). These are the first releases to be signed with
the new Developer ID certificate (https://crbug.com/1263152).

This CL will attempt to purge stale or thought to be stale screen
capture records at early startup on macOS 10.15+. See
https://crbug.com/1307502#c11 for more details.

Without the TCC reset, the checkbox in System Preferences:Security &
Privacy:Privacy:Screen Recording is wrong—it will show Chrome as
approved (checked checkbox) based on its bundle ID, but contemporary
Chromes will not match the saved designated requirement. Users looking
at the checked checkbox will see that they’ve given Chrome access, but
the system will not actually allow it access. The TCC reset revokes
Chrome’s permission based on bundle ID, so the next attempt to access
the screen will be treated the same as the initial attempt in a fresh
installation. The system will create a new entry with the updated
designated requirement on first access, the user will see an unchecked
checkbox, and by checking it, will grant Chrome access, which the
system will respect.

This doesn’t carry existing screen recording permission granted to
archaic Chromes forward to modern Chromes, but it does make it so that
the established UI flow for inspecting and granting permission works as
intended and tracks reality.

(cherry picked from commit 682276951958656e68188b004f4109b90a9ecc15)

Bug: 1307502
Change-Id: I88cf37fefc6511a9406bb8ebcab2b3e25e938e04
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3535659
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Tom Burgin <bur@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#983016}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3540053
Commit-Queue: Mark Mentovai <mark@chromium.org>
Auto-Submit: Mark Mentovai <mark@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/4951@{#24}
Cr-Branched-From: 27de6227ca357da0d57ae2c7b18da170c4651438-refs/heads/main@{#982481}