How to avoid "Operation not permitted" on macOS when `sudo` and `bypass` don't do the trick

Question

On macOS (High Sierra) when I attempt to list the file at the path

/private/var/db/ConfigurationProfiles/Store

I get the error "Operation not permitted". Using sudo doesn't better it and even employing the bypass helper doesn't change anything:

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass ls -l /private/var/db/ConfigurationProfiles/Store

gives "Operation not permitted" as well. How can I list/access the file under the path /private/var/db/ConfigurationProfiles/Store?

Additional info:

An list of the the enclosing directory via ls -al /private/var/db/ConfigurationProfiles displays:

drwxr-xr-x   5 root  wheel   160 13 Apr  2018 .
drwxr-xr-x  85 root  wheel  2720 28 Sep 06:27 ..
drwxr-xr-x@  4 root  wheel   128 16 Dec  2017 Settings
drwx------   3 root  wheel    96  1 Oct 21:56 Setup
ls: Store: Operation not permitted

Consistently, but rather strangely Store cannot be listed. This happens both when executing ls as current user and via sudo.

Guilty

Could you give us the ls -la of /private/var/db/ConfigurationProfiles? – Billposter

@Billposter See my question. I have added the relevant details. – Guilty

did you try sudo ls -la too? – Billposter

Yes, as mentioned in the question it happens both as current user and via sudo. – Guilty

Do you have system integrity on (csrutil status)? -> this is the most probable reason you will have to disable the protection to see the file. Did you verified your disk? – Billposter

@Billposter SIP is enabled. Haven't verified disk yet. Will do that next. – Guilty

You need to disable SIP in order to view .../Store – Billposter

I guess the question is: what are you trying to do? There is likely another way of interrogating the system for that info. – Marlomarlon

@Billposter Why on earth do I have to disable SIP when I just want to view a directory? I do not change anything! - I thought SIP is about modifications to some areas of the filesystem... – Guilty

@Marlomarlon I just compare the start up disk to a backup - and of course I can exclude Store but I want to understand why... – Guilty

Answer 1

Most probable reason is the system integrity protection (SIP) - csrutil is the command line utility. You need to disable it to view the directory.

• To view your status you need to:

csrutil status

• To disable it (which is usually a bad idea):

csrutil disable (then you will probably need to reboot).

• To enable it (which should be turned back on when you are done):

csrutil enable

Billposter

I can confirm that disabling SIP solves the access issue: Then sudo ls -al /private/var/db/ConfigurationProfiles/Store lists the content of that directory. - This is not the solution I was hoping for, but it is a solution (and probably the only possible one). – Guilty

@Guilty well that is how the MacOS works. If SIP it is covered by SIP the "ordinary" user does not have an access, to guard the system from the ordinary users. – Billposter

Disabling SIP is using a bulldozer to open a door. Full Disk Access is the key, as explained above. – Empedocles

Answer 2

TWO things you can try below...

Sometimes "operation not permitted" relates to permissions, so one thing you can try to solve the problem is to go into the permissions for the folder in question.

1. Open Finder, and get to the folder which is giving you the failed operations (such as "ls").

2. Right-click the folder, and select "Get Info"

3. Add users to have read/write permission for the folder; aka, add your user profile (you).

Another thing which could be causing the problem... It could be that Terminal app itself isn't able to access the data via privacy fireballing. To solve that:

1. Click on Apple symbol top left and select "System Preferences"
2. Open "Security & Privacy"
3. Select the "Privacy" menu
4. On the left-hand side, select "Full Disk Access"
5. on lower left, click the lock and enter your MacOS password or swipe your finger (eyes).
6. Click the plus button on the right to add Terminal app to the list of things with Full Disk Access. Make sure Terminal is checked when you're done.
7. reset the lock, and you're done.
8. shut down Termainal, then restart it.

This should allow Terminal access to the folder in question.

for more info: https://osxdaily.com/2018/10/09/fix-operation-not-permitted-terminal-error-macos/

Magruder

As mentioned by the OP, turning off SIP is not really a useful solution. I was thrown off by the first part of this answer (changing file permission is an obvious thing to try). But the second part of this answer is, IMHO, THE correct answer. Under "Privacy" there is also a "Files and Folders" item. In my case, the offending directory, Documents, was not checked. I checked it, and voilà, I can access the Documents folder from the iTerm app. So I think this answer is the best answer. – Paint

Operation not permitted never relates to permissions - ignore the misleading first part which can only fix Permission Denied errors. – Empedocles

Enabling Full Disk Access for iTerm did not help in my case - trying to modify a file in /System/Library/CoreServices/PowerChimeapp. And wasn't able to enable Files and Folders for iTerm. – Prehistory

Answer 3

If the file is not locally created in mac system and downloaded from some website, the quarantine flag is set on downloads to prevent drive-by and other security shenanigans.

Remove the quarantine flag:

xattr -d com.apple.quarantine <filename> (to remove in single file)
xattr -d -r com.apple.quarantine <foldername> (to remove in all file inside a folder)

Leviticus