1

I'm trying a bash script that works fine when run from the command line (Terminal).

Apart from the shebang, it just has:

ls -alt /Users/<username>/Libary/Mail/V6/.../Lists.mbox

(Using ls as a simple command to illustrate the problem.)

However, when I try a test run using launchd (which I set up using the Lingon X app) I get a permissions error.

1: Operation not permitted
ls: Lists.mbox: Operation not permitted

Terminal and Lingon X both have Full Disk Access allowed in Privacy pref pane, but I don't see any way to allow an individual shell script to be given such access.

I've tried running the same script using AppleScript's do shell script but I get the same error.

The (.sh) script permissions are set to 755, so this should not be a factor.

How can I get around this please?

Improve this question
4
  • What user is the launchd script running as?
    – mmmmmm
    Aug 19, 2019 at 16:53
  • It makes no difference whether it's a user with admin privileges or as root. SIP still prevents access to ~/Library unless specific permission to have full disk access is granted.
    – Lorccan
    Aug 19, 2019 at 16:55
  • Can you provide a reference for SIP protecting user files I thought it was just for common files e.g. /Library
    – mmmmmm
    Aug 19, 2019 at 16:58
  • I assumed Full Disk Access was part of SIP, but it may not be. This is what I found (on one app's site explaining why it needed to be granted such access): "Starting with macOS 10.14, Mojave; VirusBarrier and Personal Backup require Full Disk Access to scan your Mail, Messages, Safari files, and other user data." I'll edit my answer to remove 'SIP' but the rest is correct.
    – Lorccan
    Aug 19, 2019 at 17:04

1 Answer 1

Reset to default
0

I overcame the issue by creating an application wrapper for the script using Platypus - https://sveinbjorn.org/platypus.

I gave the resultant app Full Disk Access in the Privacy pref pane and this allowed it to run.

(Any subsequent change to the core script means regenerating the app and removing and re-adding it in Privacy as the new file is not recognised as having Full Disk Access.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .