macOS Terminal "Operation not permitted", even with sudo: Full Disk Access and SIP
Fix macOS "Operation not permitted" in Terminal, even with sudo: give Terminal Full Disk Access, and understand System Integrity Protection and app permissions.
by OhSudo ··
% ls ~/Library/Maills: Mail: Operation not permitted
% sudo rm /usr/bin/somethingrm: /usr/bin/something: Operation not permittedIt’s confusing for anyone who knows Linux: you’re root, and you’re refused. On a Mac, sudo isn’t the last word. Permission denied is about ordinary file permissions, and Operation not permitted usually means a macOS protection said no. Two of them do most of this: privacy permissions, and System Integrity Protection.
- Terminal, even with sudols ~/Library/Mail, rm /usr/bin/…checked by
- File permissionspass(works)then(fails)
- macOS protectionOperation not permitted(breaks here)
TL;DR
For your own files, in folders like Desktop, Documents, Downloads or Mail: System Settings → Privacy & Security → Full Disk Access, turn on your terminal app, and restart it.
For system paths such as /usr/bin and /System: you’re not meant to change those. Put your files in /usr/local or /opt.
1. Which kind of path is it?
| The path | Blocked by | Fix |
|---|---|---|
~/Desktop, ~/Documents, ~/Downloads, ~/Library/Mail, Photos |
Privacy permissions (TCC) | Section 2 |
/System, /usr (except /usr/local), /bin, /sbin |
System Integrity Protection | Section 3 |
Any file with restricted or uchg flags |
File flags | Section 4 |
| A network or external disk | Ownership or the disk itself | Section 5 |
2. Give your terminal access
macOS protects personal folders from programs you haven’t approved, and it treats your terminal app as a program. sudo doesn’t get around this, as the request still comes from Terminal.
Go to System Settings → Privacy & Security → Full Disk Access, then turn on Terminal, or iTerm, VS Code, or whatever you’re using. Quit that app fully and open it again.
For less access, Files and Folders in the same place lists single folders. This is often what you see when you click Allow on a popup.
Scripts and scheduled jobs have the same issue. A launchd job or cron needs its own permission: for cron, add /usr/sbin/cron under Full Disk Access, using Cmd+Shift+G to enter the path in the file dialog. An SSH session needs Remote Login with Allow full disk access for remote users turned on under General → Sharing.
To start over, if you clicked Don’t Allow once and it never asks again:
tccutil reset All com.apple.Terminal3. System Integrity Protection
SIP protects the operating system itself, even from root:
csrutil statusParts of /usr, /bin and /System are off limits, and on recent macOS versions, the system lives on a sealed, read-only volume anyway. So change where you work, rather than the protection:
- Your own programs:
/usr/local/binon Intel, or/opt/homebrew/binwith Homebrew on Apple silicon. Add them to yourPATH. Ifbrewisn’t found, see command not found: brew. - A newer version of a system tool: install it with Homebrew, which comes first in your
PATH, and leave Apple’s alone. - Custom root folders:
/etc/synthetic.confis the supported way to make something like/dataappear at the root.
See which files are protected:
ls -lO /usr/bin/ssh-rwxr-xr-x 1 root wheel restricted,compressed 1234567 Oct 1 10:00 /usr/bin/sshThe word restricted means SIP.
4. File flags
A file can be locked apart from its permissions. ls -lO shows uchg if it is, which is what ticking Locked in Finder does:
ls -lO file.txtchflags nouchg file.txtExtended attributes such as com.apple.provenance don’t usually block a delete, while some on app bundles can block changing them. To change another app’s files, your terminal needs App Management in the same Privacy & Security page.
5. Other cases
A download that won’t run gets a different message, as Gatekeeper is involved: see is damaged and can’t be opened.
An external disk may be mounted with Ignore ownership on this volume off, or have a Windows format like NTFS, which macOS can only read. diskutil info /Volumes/Name shows the format.
Operation not permitted from xattr or chmod on a file in iCloud Drive or a protected folder usually comes back to Full Disk Access.
Warning
Don’t turn off SIP to fix this. It means booting into Recovery, and it removes a main defense against malware for as long as it’s off. It’s only for rare low-level development. And a script asking you to turn it off, or to give it Full Disk Access, deserves a good look first.
Shell, we have a problem!
Similar, but different: Permission denied means ordinary file permissions, as on any Unix: check with ls -l, and see permission denied when running a script, or zsh: permission denied on a Mac. Read-only file system on / means you’re writing to the sealed system volume. xcrun: error: invalid active developer path is about developer tools.
Found this useful? Share it.
Found a mistake? Let us know at contact@ohsudo.com.