ls: : Operation not permitted - Mojave security?

Question

Is this directory protected by Mojave's new security features?

$ sudo ls -laR /var/db/dslocal/nodes/Default/
ls: Operation not permitted

It works in High Sierra but not Mojave. How do we view the contents of this directory?

score 90 · Answer 1 · edited Dec 17 '18 at 10:10

90

A less drastic way:

Go to System Preferences > Security & Privacy and give Full Disk Access to Terminal.

Adapted from https://discussions.apple.com/thread/8637915

edited Dec 17 '18 at 10:10

answered Dec 09 '18 at 15:11

Roger

909

20

Did not work for me in Mojave (v10.14.1) - I am still getting Operation not permitted – Robin Feb 25 '19 at 18:59
2

Worked for me on Mojave 10.14.4 using iTerm2 as my terminal. – Quantum7 Apr 12 '19 at 06:44
Are your terminals closed when you added it in Privacy->Full Disk Access? – Joe Apr 13 '19 at 20:37
7

Doesn't matter whether the terminal is closed or not. In any case, I can conform what Robin said for 10.14.5, it does not work (Terminal app is added to Full Disk Access list), even after a reboot. – Marius Hofert Jun 08 '19 at 20:19
2

I can confirm that this worked on macOS Mojave 10.14.6; closing Terminal was required (and prompted for with "Terminal.app" will not have full disk access until it is quit); rebooting the computer was not necessary. Thanks! – kayge Feb 23 '20 at 19:40
Trust me, it does not work for me (nor for Robin), I closed the terminal many times... – Marius Hofert Mar 20 '20 at 20:18
4

Solved error Operation not permitted on ls ~/Documents after upgrading to MacOS Catalina 10.15.5 – Olivier Jun 06 '20 at 13:50
1

Worked for me in macOS Mojave 10.14.6 after quitting and re-starting Terminal. Reboot was not necessary. I suspect Apple fixed this between 10.14.5 and 10.14.6 – András Aszódi Sep 03 '20 at 08:24

score 25 · Answer 2 · answered Sep 27 '19 at 00:40

25

This did it for me

Steps:

 Apple menu -> System Preferences -> Security & Privacy -> Privacy -> Full Disk Access -> +

Choose:

Applications -> Utilities -> folder -> Terminal -> open/grant terminal full disk access privileges. -> Relaunch terminal

answered Sep 27 '19 at 00:40

ScottyBlades

429

How does this differ from earlier answer https://apple.stackexchange.com/a/345142/237? – mmmmmm Sep 27 '19 at 11:55
2

@Mark It provides full steps, not partial steps which weren't enough for me to figure it out looking at the answer you mentioned, along with a guide that has pictures. – ScottyBlades Sep 27 '19 at 19:35
Works for me on latest Monterey. – Bruce Sun Mar 04 '22 at 14:35

score 2 · Answer 3 · answered Nov 08 '19 at 08:27

2

In my case helped simply:
chflags -R nouchg .
This code I used in terminal in folder with problematic file.
Source: https://txcowboycoder.wordpress.com/2011/01/10/svn-cant-move-svntmpentries-operation-not-permitted/

answered Nov 08 '19 at 08:27

Marcin Knitter

21

score 0 · Answer 4 · answered Jan 22 '22 at 18:14

0

that way worked for me

Go to System Preferences > Security & Privacy and give Full Disk Access to Terminal and sshd-keygen-wrapper

answered Jan 22 '22 at 18:14

Cihat Şaman

101

Ruskes · Accepted Answer · 2018-12-19T22:14:43.413

-1

You can turn it of System Integrity Protection (the SIP) but be aware of potential risks.

to disable

Reboot the Mac and hold down Command + R.

From the Utilities menu, choose Terminal.

Type csrutil disable

To turn it back on --Highly Recommended !!

You can re-enable SIP by following the above steps, but using csrutil enable instead.

edited Dec 19 '18 at 22:14

answered Oct 17 '18 at 21:58

Ruskes

48,129

3

awesome. thanks so much. where did you learn to do that? is there some official SIP/Mojave documentation i can use to better understand technical details? – user306643 Oct 17 '18 at 22:08
it was there before Mojave, Apple just made it more stringent in Mojave. – Ruskes Oct 17 '18 at 22:14
13

Disabling SIP is massive overkill, and completely unnecessary to solve the problem. It opens your system to all sorts of vulnerabilities. It's like removing your front door because someone needs to enter your house. See the answer about Full Disk Access in System Prefs for a better way. – benwiggy Dec 19 '18 at 10:41
1

@benwiggy Giving Terminal full-access is just as bad. I think I'd ask why the OP thinks he needs to be manipulating that directory. – Marc Wilson Dec 19 '18 at 21:07
1

I'd argue "less bad". – benwiggy Dec 19 '18 at 22:05
@MarcWilson for example because one wants to link an executable from /usr/bin to a newer version installed by homebrew that lives in /usr/local/bin. This seems to be permitted (at least in Mojave). – Robin Feb 25 '19 at 19:02
1

@Robin Perhaps you've heard of this thing called $PATH? – Marc Wilson Feb 26 '19 at 00:40
@MarcWilson Yes, I know about the concepts of $PATH. In my case /usr/local/bin is within the PATH and even listed before /usr/bin so it "should" take precedence over /usr/bin - but my rsync version from /usr/bin was used anyways :shrug: – Robin Feb 28 '19 at 08:45
You can use csrutil enable --without fs for a slightly safer alternative. – Joy Jin Oct 21 '20 at 09:55
Yeah, poor decision. First step for every new Mac: disable system integrity protection. – Julian F. Weinert Jun 24 '21 at 08:41

ls: : Operation not permitted - Mojave security?

5 Answers5

Linked