0

I'm running into an odd issue on my Mac (macOS 10.14.3). I ran sudo du -xk / to get detailed data on my disk usage, and ran into several errors:

du: /Users/brx/Library/Application Support/MobileSync: Operation not permitted
du: /Users/brx/Library/Application Support/CallHistoryTransactions: Operation not permitted
du: /Users/brx/Library/Application Support/com.apple.TCC: Operation not permitted
du: /Users/brx/Library/Application Support/CallHistoryDB: Operation not permitted
du: /Users/brx/Library/IdentityServices: Operation not permitted
du: /Users/brx/Library/Messages: Operation not permitted
du: /Users/brx/Library/HomeKit: Operation not permitted
du: /Users/brx/Library/Mail: Operation not permitted
du: /Users/brx/Library/Safari: Operation not permitted
du: /Users/brx/Library/Suggestions: Operation not permitted
du: /Users/brx/Library/Containers/com.apple.VoiceMemos: Operation not permitted
du: /Users/brx/Library/Containers/com.apple.Home: Operation not permitted
du: /Users/brx/Library/Containers/com.apple.Safari: Operation not permitted
du: /Users/brx/Library/Containers/com.apple.iChat: Operation not permitted
du: /Users/brx/Library/Containers/com.apple.mail: Operation not permitted
du: /Users/brx/Library/Containers/com.apple.news: Operation not permitted
du: /Users/brx/Library/Containers/com.apple.stocks: Operation not permitted
du: /Users/brx/Library/PersonalizationPortrait: Operation not permitted
du: /Users/brx/Library/Metadata/CoreSpotlight: Operation not permitted
du: /Users/brx/Library/Metadata/com.apple.IntelligentSuggestions: Operation not permitted
du: /Users/brx/Library/Cookies: Operation not permitted
du: /Users/brx/Library/Caches/com.apple.safaridavclient: Operation not permitted
du: /Users/brx/Library/Caches/com.apple.HomeKit.configurations: Operation not permitted
du: /Users/brx/Library/Caches/CloudKit/com.apple.Safari: Operation not permitted
du: /Users/brx/Library/Caches/com.apple.Safari: Operation not permitted
du: /Users/brx/Library/Caches/com.apple.homed: Operation not permitted

This is strange because I should have permissions to these directories even without sudo. If I open them in Finder, I can see the contents fine, but in Terminal:

~/Library/Caches$ ls -la com.apple.homed/
ls: : Operation not permitted
~/Library/Caches$ sudo ls -la com.apple.homed/
ls: : Operation not permitted
~/Library/Caches$ ls -lade@ com.apple.homed/
drwxr-xr-x  7 brx  staff  224 Mar 18 14:36 com.apple.homed/

So there's no ACLs nor extended attributes. I own the directory so I should be able to list it!

Yet if I do open /Users/brx/Library/Caches/com.apple.homed/, a Finder window pops up with the contents (three files Cache.db{,-shm,-wal} and a directory called fsCachedData).

What's going on here?

3

I believe that it is macOS's SIP (System Integrity Protection) that stops the du and ls processes from accessing the files/directories, even when running as root. SIP appears to be, since macOS Mojave, active for a number of locations under ~/Library, which means that only trusted applications can access them.

I added my terminal application (iTerm2) to the list of applications that should be granted "Full Disk Access", and I did that in the "Security & Privacy" Systems Preferences settings, under the "Privacy" tab. This seems to have solved it for me. I say "seems" as I'm no macOS expert, but I believe this is what made me able to access everything under ~/Library.

Apple recommends not turning off SIP globally on the system, for obvious reasons, and I don't see a real reason to do so either.

  • Interesting. What surprises me is that Finder has access to these directories by default - I'd expect them to block access to any unrelated apps. – nneonneo Mar 19 '19 at 5:18
  • @nneonneo It may be that Finder is simply assumed to be "a trusted application". – Kusalananda Mar 19 '19 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.