I have an automation workflow that I use as a Quick Action. It takes a Finder item and calls a shell script with it. Part of the shell script runs a find command on the directory of the Finder item. Prior to Catalina, this worked. Now I get

find: <path to the directory>: Operation not permitted

This only happens when I'm running it as the Service Quick Action. If I call the script in Terminal, it works fine, as does the find command in Terminal.

# Directory to delete files from
REAL_FILE=$(/usr/local/bin/realpath "$1")
DIR=$(dirname "$REAL_FILE")

find "$DIR" -type f -depth 1 -print0 | while read -d $'\0' FILE
    if [[ "$FILE" < "$REAL_FILE" ]] ; then
        mv "$FILE" ~/.Trash/
  • What shell have you selected in the “Run Shell Script” block? Try giving that shell Full Disk Access (System Preferences > Security & Privacy > Privacy > Full Disk Access)
    – Harm
    Commented Oct 9, 2020 at 11:48

2 Answers 2


You need to grant the Finder full disk access:

  1. Open Security & Privacy preferences
  2. Go to the Full Disk Access option.
  3. Click the plus button.
  4. Locate the Finder in /System/Library/CoreServices/ (or simply type 'Finder' into Search).

Compare Grant “Full Disk Access” to Workflows run via the Services menu.


I had a somewhat related issue. I created a periodic script that was running under /etc/daily.local. This was on macOS Catalina. It had the following line:

find "/Users/brianc/Downloads" -Btime +3d -name 'GBH4SN2*.rdp' -type f -print

And when the script ran, I would see the following:

find: /Users/brianc/Downloads: Operation not permitted

So, I granted Full Disk Access (System Preferences > Security & Privacy > Privacy > Full Disk Access) to find. No difference. Granted FDA to bash. No difference. Granted FDA to sh. No difference. Finally, by going through all the different scripts, I found that periodic scripts are run under /usr/libexec/periodic-wrapper which is executed from /System/Library/LaunchDaemons/com.apple.periodic-daily.plist. So, I granted FDA to periodic-wrapper. Problem solved.

  • So for /etc/daily.local it's a matter of giving /usr/libexec/periodic-wrapper FDA. For LaunchAgents, it's giving FDA to bash (source). But the OP asked about Quick Actions...
    – Harm
    Commented Oct 9, 2020 at 11:39
  • It didn’t work for me. I launch the script with cron and granting FDA to /usr/sbin/cron seems to have done the trick. Commented Jan 8, 2021 at 19:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .