Operation Not Permitted in Terminal — macOS Privacy Permission Denied Error
About Operation Not Permitted in Terminal
Fix 'Operation not permitted' errors in Terminal and command-line tools caused by macOS privacy protections blocking access to protected directories. This guide covers everything you need to know about this topic, including common causes, step-by-step solutions, and answers to frequently asked questions.
Here are the key things to understand: macOS TCC (Transparency, Consent, and Control) protects sensitive directories and resources. Terminal, iTerm2, and other CLI tools need Full Disk Access to access Desktop, Documents, Downloads, and more. Even with sudo (root), TCC restrictions still apply — SIP and TCC override root privileges. Protected locations include: ~/Desktop, ~/Documents, ~/Downloads, Mail data, Safari data, Time Machine backups. This protection was introduced in macOS Mojave and has been strengthened in each subsequent release. Understanding these fundamentals will help you diagnose and resolve this issue more effectively.
The most common reasons this occurs include: Terminal app not granted Full Disk Access in Privacy & Security settings. Script or tool trying to access TCC-protected directories without proper entitlements. Homebrew, Node.js, or Python scripts accessing protected user directories. Cron jobs or launchd scripts running without Full Disk Access permissions. Identifying the root cause is the first step toward finding the right solution.
To resolve this, follow these recommended steps: Grant Full Disk Access: System Settings > Privacy & Security > Full Disk Access > add Terminal (or iTerm2). Restart Terminal after granting Full Disk Access (permission takes effect on next launch). For cron/launchd scripts: grant Full Disk Access to the interpreter (/bin/bash, /usr/bin/python3). If you need specific access only: grant the narrower permission (Files and Folders) instead of Full Disk Access. Never disable SIP to bypass these protections — grant proper permissions instead. If these steps do not resolve the issue, consider consulting additional resources or a qualified professional.
This article is part of our Mac Error Codes collection on Error Codes Wiki. We provide comprehensive, up-to-date information to help you find solutions quickly.
Quick Answer
Why does sudo not bypass this restriction?
macOS TCC (Transparency, Consent, and Control) operates at a level above Unix permissions. Even root cannot bypass TCC without proper entitlements. This is enforced by System Integrity Protection (SIP) and the TCC database.
Overview
Fix 'Operation not permitted' errors in Terminal and command-line tools caused by macOS privacy protections blocking access to protected directories.
Key Details
- macOS TCC (Transparency, Consent, and Control) protects sensitive directories and resources
- Terminal, iTerm2, and other CLI tools need Full Disk Access to access Desktop, Documents, Downloads, and more
- Even with sudo (root), TCC restrictions still apply — SIP and TCC override root privileges
- Protected locations include: ~/Desktop, ~/Documents, ~/Downloads, Mail data, Safari data, Time Machine backups
- This protection was introduced in macOS Mojave and has been strengthened in each subsequent release
Common Causes
- Terminal app not granted Full Disk Access in Privacy & Security settings
- Script or tool trying to access TCC-protected directories without proper entitlements
- Homebrew, Node.js, or Python scripts accessing protected user directories
- Cron jobs or launchd scripts running without Full Disk Access permissions
Steps
- 1Grant Full Disk Access: System Settings > Privacy & Security > Full Disk Access > add Terminal (or iTerm2)
- 2Restart Terminal after granting Full Disk Access (permission takes effect on next launch)
- 3For cron/launchd scripts: grant Full Disk Access to the interpreter (/bin/bash, /usr/bin/python3)
- 4If you need specific access only: grant the narrower permission (Files and Folders) instead of Full Disk Access
- 5Never disable SIP to bypass these protections — grant proper permissions instead